A checklist and process for reviewing code before it is submitted or merged. A pull request, or PR, is a proposed set of code changes for review.

Use it for personal checks before submitting code, pull-request reviews, and general code-quality checks.

It helps catch quality problems and missed checks before changes reach the shared codebase.

How zhangloveyan/backend-skill configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to zhangloveyan/backend-skill. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/zhangloveyan/backend-skill/main/.claude/skills/proj-review/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/zhangloveyan/backend-skill

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/zhangloveyan/backend-skill/proj-review/github.svg)](https://agentmods.dev/skills/zhangloveyan/backend-skill/proj-review)

Your own site

<a href="https://agentmods.dev/skills/zhangloveyan/backend-skill/proj-review"><img src="https://agentmods.dev/badge/skills/zhangloveyan/backend-skill/proj-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/zhangloveyan/backend-skill/proj-review"><img src="https://agentmods.dev/badge/skills/zhangloveyan/backend-skill/proj-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 28 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,718 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00028	$0.01718
Opus 5.5	$0.00011	$0.00687
Sonnet 5.5	$0.00006	$0.00344
Haiku 4.5	$0.00003	$0.00172

Measured 23d ago against content hash 9545af38f704, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

proj-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 23d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/proj-review/SKILL.md · 228 lines

How it starts

The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.

代码审查

适用场景

代码提交前自检
Pull Request 审查
代码质量检查

审查流程

前置: 任务文档校验 → Step 0: 编译检查 → Step 1: 功能检查 → Step 2: 代码规范 → Step 3: 安全检查 → Step 4: 性能检查 → Step 5: 自动修复 → Step 6: 测试检查 → Step 7: 输出报告

前置：任务文档校验

确认全流程任务文档存在
若缺失，先创建任务文档骨架并补齐流程状态与上下文快照
将“代码审查”状态标记为进行中

Step 0: 编译检查（前置）

执行 mvn compile 检查：

类名与文件名是否匹配
语法错误
依赖缺失

如有编译错误，先修复再继续审查。

审查清单

1. 功能检查

功能是否符合需求
边界条件是否处理
异常情况是否处理
是否有遗漏的场景

2. 代码规范

命名是否符合规范（参考 CLAUDE.md）
新增或重命名的表、字段是否按 SQL 命名规范检查目标 MySQL 版本全部关键字（含非保留关键字），并记录版本、来源和结果；反引号不能豁免，未核验不得判为通过
已有冲突名称是否具有经确认的迁移方案，DDL、Entity 映射、Mapper SQL、索引引用、测试和文档是否同步；禁止自动重命名已有表或字段
代码格式是否统一
注释是否清晰必要
是否有重复代码
方法是否过长（建议不超过50行）
类是否过大（建议不超过500行）

3. 安全检查（安全红线）

强制规则 - 违反必须修复：

禁止明文存储密码（必须 BCrypt）
禁止日志打印敏感信息（密码、手机号、身份证）
禁止 SQL 拼接（必须使用 #{} 参数化查询）
禁止信任前端传入的用户ID（必须从 Token 获取）

其他安全检查：

是否有 XSS 风险
敏感信息是否脱敏
权限校验是否完整

4. 性能检查（性能红线）

强制规则 - 违反必须修复：

禁止循环内查询数据库（N+1 问题）
禁止深度分页（offset > 10000）
禁止不带条件的全表查询
禁止单次查询超过 1000 条不分批

其他性能检查：

是否在循环中执行数据库操作
是否有不必要的数据库查询
大数据量是否分页处理（单次 ≤ 1000）
批量操作是否分批执行（每批 ≤ 500）
是否有全表扫描（缺少索引）
是否有内存泄漏风险

5. 日志检查

关键操作是否有日志
日志格式是否规范
是否打印了敏感信息
是否在循环中打印日志

6. 异常处理

异常是否被正确捕获
异常信息是否有意义
是否有空的 catch 块
事务是否正确回滚

Step 5: 自动修复

对于以下问题，直接修复而非仅报告：

问题类型	修复方式
NPE 风险（Integer/Long 比较）	改用 `equals()` 或 `Objects.equals()`
类名与文件名不匹配	修改类名与文件名一致
缺少 `@ApiLog` 注解	添加注解
硬编码常量	提取为常量或使用 `BaseConstant`

Step 6: 测试检查

是否有单元测试
测试覆盖率是否足够
边界条件是否测试

常见问题

命名问题

// ✗ 错误
int a = 1;
String str = "hello";
public void process() {}

// ✓ 正确
int userCount = 1;
String userName = "hello";
public void processOrder() {}

空指针风险

Read the full file on GitHub · 228 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

templates/review-report.md 1.2 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

23d ago Changed · +2 lines 9545af38f704
2mo ago First seen · 226 lines · 28 tokens per session scan A be926fcc63b4

Subscribe to this mod's changes

proj-review is a skill published in the GitHub repository zhangloveyan/backend-skill (103 stars, last pushed 23d ago), licensed MIT. It adds 28 tokens to every session and 1,718 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review

proj-review next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
proj-reviewzhangloveyan/backend-skill	Skill	103	23d ago	MIT	A	28	Claude Code
autoreviewopenclaw/clawhub	Skill	9.5k	yesterday	MIT	A	17	Claude Code, Codex
agent-teams-simplify-and-hardenLeoYeAI/openclaw-master-skills	Skill	2.2k	6d ago	MIT	A	115	Claude Code, Codex
omh-code-reviewrlaope/oh-my-hermes	Skill	5.2k	yesterday	MIT	A	48	Claude Code, Codex
revdiff-planumputun/revdiff	Skill	945	yesterday	MIT	A	84	Claude Code
explore-unknownsdzhng/skills	Skill	1.4k	2d ago	MIT	A	162	Claude Code, Codex
re0-mergeLilMGenius/paperthin	Skill	1.4k	4d ago	MIT	A	70	Claude Code

backend-skill: Skill for Claude Code