Overview

Code Review Skill analyzes PR changes to surface issues across code quality, security, performance, and testing. It helps reviewers quickly identify readability problems, security gaps, and performance pitfalls before merging.

How This Skill Works

Inputs are a PR diff (git diff format) and a set of target file paths. The skill outputs a structured list of review comments, each with filename, line number, issue description, and severity. It analyzes code quality (readability, maintainability), security (injection, auth, sensitive data), performance (N+1, memory), and testing considerations to guide remediation.

When to Use It

• Before merging PRs touching critical modules or security-sensitive code
• During security audits or vulnerability triage on recent changes
• When suspected performance regressions occur in data access or rendering paths
• During refactors aimed at improving readability, DRYness, or test coverage
• As part of CI checks to surface issues automatically from diffs

Quick Start

1. Step 1: Provide the PR diff and the list of target file paths to review.
2. Step 2: Run the skill to generate structured review comments with filename, line, issue, and severity.
3. Step 3: Use the results to drive code-quality, security, and performance remediation in the PR.

Best Practices

• Provide precise target file paths and a brief PR summary to guide reviews
• Prioritize high-severity findings and include concrete remediation steps
• Reference security guidelines (OWASP) and performance best practices in comments
• Keep comments actionable with exact line references and suggested fixes
• Run existing tests and linters locally to validate changes before final review

Example Use Cases

• UserRepository.java, line 128, issue: potential SQL injection due to string concatenation; severity: high
• AuthService.go, line 54, issue: passwords logged in plaintext during error handling; severity: critical
• ProductService.ts, line 210, issue: N+1 database queries in product listing; severity: high
• PaymentController.cs, line 90, issue: hard-coded API key in code; severity: critical
• OrderService.kt, line 77, issue: insufficient input validation on user-supplied data; severity: medium

Frequently Asked Questions