code-review

Code review

Surface findings on code quality across correctness, security, scaling, error handling, naming/style, and maintainability. Read-only — never modify code. Report findings; the user decides what to change.

Best invoked via /code-review for strict read-only enforcement. Natural-language invocation works for the audit pass, but adversarial follow-ups ("fix this") are not reliably refused under NL — slash command is the recommended path.

1. Determine review target

Pick the first that applies:

1. User specified a target (file path, function name, branch/ref, "the changes I just made") — use that.
2. In a git repo with uncommitted changes — run git status then git diff (and git diff --staged) to scope the review to working-tree changes.
3. In a git repo, clean tree, on a feature branch — diff against the merge base: git diff main...HEAD (substitute master if that's the default).
4. None of the above — ask the user what to review. Do not guess.

For repo-wide audits the user explicitly requests, narrow by language or directory rather than scanning everything.

2. Review checklist

Apply in priority order and report every finding with its severity. Cut a later category short only where an earlier finding makes it moot (unrunnable code makes style moot), and say so when you do.

Correctness

• Logic errors: off-by-one, inverted boolean, wrong operator
• Null / empty / missing-key handling — does it crash or silently produce wrong output?
• Race conditions, concurrent mutation of shared state
• Integer overflow, float comparison without tolerance, timezone-naive datetimes
• Loop invariants that don't hold on first or last iteration
• Return paths that don't return (implicit None, missing else)

Security

• Hardcoded secrets, API keys, connection strings, tokens
• Unparameterized SQL — f-strings, .format(), or + concatenation building queries
• Unsafe deserialization: pickle.loads, yaml.load (without SafeLoader), eval, exec, compile on untrusted input
• Path traversal: user input fed into open(), Path(), file I/O without validation
• Overly broad permissions: chmod 777, * in IAM/RBAC, public storage containers
• Subprocess with shell=True and string-interpolated arguments
• TLS verification disabled (verify=False, InsecureRequestWarning suppressed)