Overview

This skill audits code changes for quality, security, and best practices. It follows a structured review flow to assess security risks (OWASP Top 10), error handling, readability, naming, style, performance, and input validation, then outputs a ready-to-action report.

How This Skill Works

It ingests the full diff or file, runs checks across security, error handling, complexity, readability, naming/style, performance, and input validation, and aggregates findings. The result is a standardized report containing a Review Summary, Findings separated into CRITICAL, WARNING, and SUGGESTION, plus a What's Done Well section.

When to Use It

• Review a pull request diff for a new feature
• Audit changes for OWASP Top 10 vulnerabilities
• Ensure refactors adhere to naming and style conventions
• Evaluate error handling completeness and input validation
• Identify performance bottlenecks in updated code

Quick Start

1. Step 1: Read the full diff or file provided
2. Step 2: Run checks for security, error handling, readability, and performance
3. Step 3: Output a formatted review with a Review Summary, Findings (CRITICAL, WARNING, SUGGESTION), and What's Done Well

Best Practices

• Read the full diff or file before judging changes
• Check for security vulnerabilities (OWASP Top 10) first
• Evaluate error handling and edge-case coverage
• Assess code complexity and readability
• Verify naming conventions, style, and input validation

Example Use Cases

• Reviewing a new payment API changes for insecure handling of user input
• Auditing a REST endpoint for OWASP Top 10 risks like SQL injection or XSS
• Flagging edge-case handling in a batch processing job
• Reinforcing naming conventions after a major refactor
• Spotting performance hotspots in a data transformation module

Frequently Asked Questions