Code Reviewer Skill

Overview

This skill provides comprehensive code review capabilities across multiple programming languages including TypeScript, JavaScript, Python, Swift, and Kotlin. Focus areas: code quality, security, performance, and maintainability.

Quick Start

Identify scope - Files or PR to review
Run analysis - Check code quality, security, performance
Document findings - Categorize by severity
Provide recommendations - Actionable improvements
Generate report - Structured review output

When to Use

Pull request reviews
Pre-merge quality gates
Code audit requirements
Security assessments
Performance optimization reviews
Onboarding code familiarization

Review Categories

1. Code Quality

Aspect	Check For
Clarity	Readable, self-documenting code
Naming	Descriptive, consistent conventions
Structure	Single responsibility, appropriate abstraction
DRY	No unnecessary duplication
Complexity	Cyclomatic complexity within limits

2. Security

Aspect	Check For
Input validation	All user inputs validated
SQL injection	Parameterized queries
XSS	Output encoding
Auth/AuthZ	Proper authentication and authorization
Secrets	No hardcoded credentials
Dependencies	Updated, no known vulnerabilities

3. Performance

Aspect	Check For
Algorithms	Appropriate time complexity
Memory	No leaks, efficient usage
Database	Optimized queries, proper indexing
Caching	Appropriate cache usage
Async	Non-blocking operations where needed

4. Testing

Aspect	Check For
Coverage	Critical paths tested
Quality	Meaningful assertions
Isolation	Tests don't depend on each other
Edge cases	Boundary conditions covered
Mocking	Minimal, appropriate mocking

Review Process

Step 1: Context Gathering

## Review Context
- **PR/Files:** [identifier]
- **Author:** [name]
- **Purpose:** [feature/bugfix/refactor]
- **Related:** [issues/tickets]

Step 2: High-Level Analysis

Scan for:

Overall change scope
Architectural impact
Breaking changes
New dependencies

Step 3: Detailed Review

For each file:

### [filename]

**Changes:** [summary]

**Findings:**
- [severity] [category]: [description]
  - Location: line X
  - Recommendation: [action]

Step 4: Security Deep Dive

Special attention to:

Authentication flows
Data handling
API endpoints
Configuration files
Environment variables

Step 5: Test Verification

Run existing tests
Verify new test coverage
Check test quality
Identify missing tests

Severity Levels

Level	Description	Action
Critical	Security vulnerability, data loss risk	Block merge
High	Bugs, significant issues	Must fix
Medium	Code quality, maintainability	Should fix
Low	Style, minor improvements	Consider
Info	Suggestions, observations	Optional

Review Checklist

General

Code compiles/builds without errors
No merge conflicts
Branch is up to date with target
Commit messages are clear

Functionality

Requirements are met
Edge cases handled
Error handling is appropriate
No regression in existing functionality

Code Quality

Follows project coding standards
No code smells or anti-patterns
Appropriate comments (not excessive)
No dead code or debug statements

Security

No hardcoded secrets
Input validation present
Output encoding where needed
Proper error messages (no info leak)

Testing

New code has tests
All tests pass
Test coverage adequate
Tests are meaningful

Documentation

README updated if needed
API docs updated if applicable
Breaking changes documented

Common Anti-Patterns

Code Smells

Pattern	Problem	Solution
God Object	Class does too much	Split responsibilities
Feature Envy	Method uses other class more	Move to appropriate class
Long Method	Hard to understand	Extract smaller methods
Magic Numbers	Unclear meaning	Use named constants
Deep Nesting	Hard to follow	Early returns, extraction

Security Issues

Pattern	Problem	Solution
SQL Concat	Injection risk	Parameterized queries
Eval Usage	Code injection	Safe alternatives
Weak Crypto	Breakable encryption	Strong algorithms
CORS *	Access control bypass	Specific origins
Console Secrets	Credential exposure	Remove before commit

Review Report Template

# Code Review Report

## Summary
- **Reviewed:** [files/PR]
- **Date:** [date]
- **Reviewer:** [name]
- **Overall:** [APPROVE/REQUEST_CHANGES/COMMENT]

## Statistics
- Files reviewed: X
- Lines changed: +Y/-Z
- Critical issues: N
- High issues: N
- Medium issues: N

## Critical/High Findings

### [Finding Title]
- **Severity:** Critical/High
- **Category:** Security/Bug/Performance
- **Location:** file:line
- **Description:** [details]
- **Recommendation:** [action]
- **Code suggestion:**
  \`\`\`language
  // suggested fix
  \`\`\`

## Medium/Low Findings
[Grouped by category]

## Positive Observations
- [Good practices noticed]

## Recommendations
1. [Priority improvement]
2. [Secondary improvement]

## Test Coverage
- Current: X%
- Critical paths: Y%
- Recommendation: [action]

Best Practices

Do

Review in small batches (200-400 lines ideal)
Focus on logic, not style (use linters)
Ask questions rather than demand changes
Acknowledge good code
Provide specific, actionable feedback
Test the changes locally when possible

Don't

Nitpick style issues
Rewrite author's code in comments
Leave vague feedback ("this is wrong")
Review when fatigued
Approve without understanding
Block for preferences, not issues

Error Handling

Situation	Action
Too large PR	Request split into smaller PRs
Missing context	Ask author for explanation
Unclear requirements	Defer to requirements review
Disagreement	Escalate with evidence

Metrics

Metric	Target	Description
Review turnaround	<24h	Time to first review
Defect detection	>80%	Issues caught before merge
False positive rate	<10%	Unnecessary comments
Review thoroughness	100%	All critical areas covered

Technology-Specific Notes

TypeScript/JavaScript

Check for any/unknown abuse
Verify type safety
Review async/await handling
Check for memory leaks in React

Python

PEP 8 compliance
Type hints present
Exception handling
Virtual environment usage

Go

Error handling patterns
Goroutine leaks
Interface usage
Package organization

Related Skills

tdd-obra - Test-first development
systematic-debugging - Debugging methodology
subagent-driven - Development with reviews

Version History

1.0.0 (2026-01-19): Initial release adapted from alirezarezvani/claude-skills

code-reviewer