Code Reviewer Skill
Overview
This skill provides comprehensive code review capabilities across multiple programming languages including TypeScript, JavaScript, Python, Swift, and Kotlin. Focus areas: code quality, security, performance, and maintainability.
Quick Start
- Identify scope - Files or PR to review
- Run analysis - Check code quality, security, performance
- Document findings - Categorize by severity
- Provide recommendations - Actionable improvements
- Generate report - Structured review output
When to Use
- Pull request reviews
- Pre-merge quality gates
- Code audit requirements
- Security assessments
- Performance optimization reviews
- Onboarding code familiarization
Review Categories
1. Code Quality
| Aspect | Check For |
|---|
| Clarity | Readable, self-documenting code |
| Naming | Descriptive, consistent conventions |
| Structure | Single responsibility, appropriate abstraction |
| DRY | No unnecessary duplication |
| Complexity | Cyclomatic complexity within limits |
2. Security
| Aspect | Check For |
|---|
| Input validation | All user inputs validated |
| SQL injection | Parameterized queries |
| XSS | Output encoding |
| Auth/AuthZ | Proper authentication and authorization |
| Secrets | No hardcoded credentials |
| Dependencies | Updated, no known vulnerabilities |
3. Performance
| Aspect | Check For |
|---|
| Algorithms | Appropriate time complexity |
| Memory | No leaks, efficient usage |
| Database | Optimized queries, proper indexing |
| Caching | Appropriate cache usage |
| Async | Non-blocking operations where needed |
4. Testing
| Aspect | Check For |
|---|
| Coverage | Critical paths tested |
| Quality | Meaningful assertions |
| Isolation | Tests don't depend on each other |
| Edge cases | Boundary conditions covered |
| Mocking | Minimal, appropriate mocking |
Review Process
Step 1: Context Gathering
## Review Context
- **PR/Files:** [identifier]
- **Author:** [name]
- **Purpose:** [feature/bugfix/refactor]
- **Related:** [issues/tickets]
Step 2: High-Level Analysis
Scan for:
- Overall change scope
- Architectural impact
- Breaking changes
- New dependencies
Step 3: Detailed Review
For each file:
### [filename]
**Changes:** [summary]
**Findings:**
- [severity] [category]: [description]
- Location: line X
- Recommendation: [action]
Step 4: Security Deep Dive
Special attention to:
- Authentication flows
- Data handling
- API endpoints
- Configuration files
- Environment variables
Step 5: Test Verification
- Run existing tests
- Verify new test coverage
- Check test quality
- Identify missing tests
Severity Levels
| Level | Description | Action |
|---|
| Critical | Security vulnerability, data loss risk | Block merge |
| High | Bugs, significant issues | Must fix |
| Medium | Code quality, maintainability | Should fix |
| Low | Style, minor improvements | Consider |
| Info | Suggestions, observations | Optional |
Review Checklist
General
- Code compiles/builds without errors
- No merge conflicts
- Branch is up to date with target
- Commit messages are clear
Functionality
- Requirements are met
- Edge cases handled
- Error handling is appropriate
- No regression in existing functionality
Code Quality
- Follows project coding standards
- No code smells or anti-patterns
- Appropriate comments (not excessive)
- No dead code or debug statements
Security
- No hardcoded secrets
- Input validation present
- Output encoding where needed
- Proper error messages (no info leak)
Testing
- New code has tests
- All tests pass
- Test coverage adequate
- Tests are meaningful
Documentation
- README updated if needed
- API docs updated if applicable
- Breaking changes documented
Common Anti-Patterns
Code Smells
| Pattern | Problem | Solution |
|---|
| God Object | Class does too much | Split responsibilities |
| Feature Envy | Method uses other class more | Move to appropriate class |
| Long Method | Hard to understand | Extract smaller methods |
| Magic Numbers | Unclear meaning | Use named constants |
| Deep Nesting | Hard to follow | Early returns, extraction |
Security Issues
| Pattern | Problem | Solution |
|---|
| SQL Concat | Injection risk | Parameterized queries |
| Eval Usage | Code injection | Safe alternatives |
| Weak Crypto | Breakable encryption | Strong algorithms |
| CORS * | Access control bypass | Specific origins |
| Console Secrets | Credential exposure | Remove before commit |
Review Report Template
# Code Review Report
## Summary
- **Reviewed:** [files/PR]
- **Date:** [date]
- **Reviewer:** [name]
- **Overall:** [APPROVE/REQUEST_CHANGES/COMMENT]
## Statistics
- Files reviewed: X
- Lines changed: +Y/-Z
- Critical issues: N
- High issues: N
- Medium issues: N
## Critical/High Findings
### [Finding Title]
- **Severity:** Critical/High
- **Category:** Security/Bug/Performance
- **Location:** file:line
- **Description:** [details]
- **Recommendation:** [action]
- **Code suggestion:**
\`\`\`language
// suggested fix
\`\`\`
## Medium/Low Findings
[Grouped by category]
## Positive Observations
- [Good practices noticed]
## Recommendations
1. [Priority improvement]
2. [Secondary improvement]
## Test Coverage
- Current: X%
- Critical paths: Y%
- Recommendation: [action]
Best Practices
Do
- Review in small batches (200-400 lines ideal)
- Focus on logic, not style (use linters)
- Ask questions rather than demand changes
- Acknowledge good code
- Provide specific, actionable feedback
- Test the changes locally when possible
Don't
- Nitpick style issues
- Rewrite author's code in comments
- Leave vague feedback ("this is wrong")
- Review when fatigued
- Approve without understanding
- Block for preferences, not issues
Error Handling
| Situation | Action |
|---|
| Too large PR | Request split into smaller PRs |
| Missing context | Ask author for explanation |
| Unclear requirements | Defer to requirements review |
| Disagreement | Escalate with evidence |
Metrics
| Metric | Target | Description |
|---|
| Review turnaround | <24h | Time to first review |
| Defect detection | >80% | Issues caught before merge |
| False positive rate | <10% | Unnecessary comments |
| Review thoroughness | 100% | All critical areas covered |
Technology-Specific Notes
TypeScript/JavaScript
- Check for any/unknown abuse
- Verify type safety
- Review async/await handling
- Check for memory leaks in React
Python
- PEP 8 compliance
- Type hints present
- Exception handling
- Virtual environment usage
Go
- Error handling patterns
- Goroutine leaks
- Interface usage
- Package organization
Related Skills
Version History
- 1.0.0 (2026-01-19): Initial release adapted from alirezarezvani/claude-skills
