code-review-skill

name code-review-skill description Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, Java 8, PHP, Ruby, Rails, Python, Django, FastAPI, Go, C#/.NET, Kotlin, Swift, Dart, Flutter, NestJS, C/C++, Zig, CSS/Less/Sass, Qt, and more. Covers architecture review, performance review, security audit, code quality anti-patterns, and common bugs across all ecosystems. Use when: reviewing pull requests, conducting PR reviews, code review, reviewing code changes, establishing review standards, mentoring developers, architecture reviews, security audits, performance reviews, checking code quality, finding bugs, giving feedback on code. allowed-tools ["Read","Grep","Glob","Bash","WebFetch"] Code Review Skill Transform code reviews from gatekeeping to knowledge sharing through constructive feedback, systematic analysis, and collaborative improvement. When to Use This Skill Reviewing pull requests and code changes Establishing code review standards for teams Mentoring junior developers through reviews Conducting architecture reviews Creating review checklists and guidelines Improving team collaboration Reducing code review cycle time Maintaining code quality standards Core Principles 1. The Review Mindset Goals of Code Review: Catch bugs and edge cases Ensure code maintainability Share knowledge across team Enforce coding standards Improve design and architecture Build team culture Not the Goals: Show off knowledge Nitpick formatting (use linters) Block progress unnecessarily Rewrite to your preference 2. Effective Feedback Good Feedback is: Specific and actionable Educational, not judgmental Focused on the code, not the person Balanced (praise good work too) Prioritized (critical vs nice-to-have) ❌ Bad: "This is wrong." ✅ Good: "This could cause a race condition when multiple users access simultaneously. Consider using a mutex here." ❌ Bad: "Why didn't you use X pattern?" ✅ Good: "Have you considered the Repository pattern? It would make this easier to test. Here's an example: [link]" ❌ Bad: "Rename this variable." ✅ Good: "[nit] Consider `userCount` instead of `uc` for clarity. Not blocking if you prefer to keep it." 3. Review Scope What to Review: Logic correctness and edge cases Security vulnerabilities Performance implications Test coverage and quality Error handling Documentation and comments API design and naming Architectural fit What Not to Review Manually: Code formatting (use Prettier, Black, etc.) Import organization Linting violations Simple typos Review Process Phase 1: Context Gathering (2-3 minutes) Before diving into code, understand: Read PR description and linked issue Check PR size (>400 lines? Ask to split) Review CI/CD status (tests passing?) Understand the business requirement Note any relevant architectural decisions For large diffs, pipe the diff through scripts/pr-analyzer.py ( git diff main...HEAD | python scripts/pr-analyzer.py ) to triage complexity and get a suggested review approach before reading. Phase 2: High-Level Review (5-10 minutes) Architecture & Design - Does the solution fit the problem? For significant changes, consult Architecture Review Guide Check: SOLID principles, coupling/cohesion, anti-patterns Performance Assessment - Are there performance concerns? For performance-critical code, consult Performance Review Guide Check: Algorithm complexity, N+1 queries, memory usage File Organization - Are new files in the right places? Testing Strategy - Are there tests covering edge cases? Phase 3: Line-by-Line Review (10-20 minutes) For each file, check: Logic & Correctness - Edge cases, off-by-one, null checks, race conditions Security - Input validation, injection risks, XSS, sensitive data Performance - N+1 queries, unnecessary loops, memory leaks Maintainability - Clear names, single responsibility, comments Reuse - Before accepting new code, search for existing utilities/helpers that could replace it. Check adjacent files and shared modules for similar patterns. See Universal Quality Guide for anti-patterns like parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, and no-op updates. Phase 4: Summary & Decision (2-3 minutes) Summarize key concerns Highlight what you liked Make clear decision: ✅ Approve 💬 Comment (minor suggestions) 🔄 Request Changes (must address) Offer to pair if complex Review Techniques Technique 1: The Checklist Method Use checklists for consistent reviews. See Security Review Guide for comprehensive security checklist. Technique 2: The Question Approach Instead of stating problems, ask questions: ❌ "This will fail if the list is empty." ✅ "What happens if `items` is an empty array?" ❌ "You need error handling here." ✅ "How should this behave if the API call fails?" Technique 3: Suggest, Don't Command Use collaborative language: ❌ "You must change this to use async/await" ✅ "Suggestion: async/await might make this more readable. What do you think?" ❌ "Extract this into a function" ✅ "This logic appears in 3 places. Would it make sense to extract it?" Technique 4: Differentiate Severity Use labels to indicate priority: 🔴 [blocking] - Must fix before merge 🟡 [important] - Should fix, discuss if disagree 🟢 [nit] - Nice to have, not blocking 💡 [suggestion] - Alternative approach to consider 📚 [learning] - Educational comment, no action needed 🎉 [praise] - Good work, keep it up! Severity levels: 🔴 / 🟡 / 🟢 are the three severity tiers used as the standard across all guides in this skill — 🔴 blocks the merge, 🟡 should be addressed, 🟢 is optional. The remaining markers (💡 / 📚 / 🎉) are non-blocking annotations. Language-Specific Guides 根据审查的代码语言，查阅对应的详细指南： Language/Framework Reference File Key Topics React React Guide Hooks, useEffect, React 19 Actions, RSC, Suspense, TanStack Query v5 Vue 3 Vue Guide Composition API, 响应性系统, Props/Emits, Watchers, Composables Angular 17+ Angular Guide Signals, Standalone, RxJS, Zoneless, 模板优化, 测试, 路由守卫, HttpInterceptor Rust Rust Guide 所有权/借用, Unsafe 审查, 异步代码, 取消安全性, 错误处理 TypeScript TypeScript Guide 类型安全, async/await, 不可变性, 测试, 模块解析, TS 5.x Python Python Guide 可变默认参数, 异常处理, 类属性 Django / DRF Django Guide 安全审查, N+1 查询, Serializer 反模式, ViewSet, 异步视图 FastAPI FastAPI Guide Depends, Pydantic v2 validation, async correctness, sessions/N+1, auth vs authorization, test-driven verification Java Java Guide Java 17/21 新特性, Spring Boot 3, 虚拟线程, Stream/Optional Java 8 / Legacy Java 8 Guide Java 8, Spring Boot 2, javax.*, Stream/Optional, java.time, CompletableFuture PHP PHP Guide PHP 8.x type system, PDO, security review, Composer, PHPUnit/PHPStan Ruby / Rails Ruby Guide Ruby semantics, Rails 8, Active Record, Active Job, security, testing C# / .NET C# Guide C# 12 特性, 异步编程, EF Core 性能, ASP.NET Core, LINQ Go Go Guide 错误处理, goroutine/channel, context, 接口设计 Kotlin / Android Kotlin Guide 协程, Flow, Jetpack Compose, 空安全, 内存泄漏, 架构模式 Swift / SwiftUI Swift Guide Optionals, Swift Concurrency, Sendable/actors, SwiftUI property wrappers, value vs reference types, API design Dart / Flutter Dart Guide Widget rebuilds, const constructors, null safety, isolates, async in build, Riverpod/Bloc, platform channels, keys, disposal NestJS NestJS Guide 依赖注入, 分层架构, DTO 验证, Guard/Interceptor, 循环依赖 Svelte / SvelteKit Svelte Guide Runes, Load 函数, Form Actions, Store 迁移, SSR/CSR 边界 C C Guide 指针/缓冲区, 内存安全, UB, 安全编码, 可移植性, 测试 C++ C++ Guide RAII, 智能指针, C++20/23, constexpr, 测试 Zig Zig Guide Allocators, error unions, defer/errdefer, comptime, C interop CSS/Less/Sass CSS Guide 变量规范, !important, 性能优化, 响应式, 兼容性 Qt Qt Guide 对象模型, 信号/槽, Model/View, QML, Qt6 迁移, 测试 Cross-Cutting Guides Language-agnostic patterns applicable to all code reviews: Topic Reference File Key Topics Architecture Review Architecture Review Guide SOLID, anti-patterns, coupling/cohesion, dependency direction Performance Review Performance Review Guide Web Vitals, N+1, algorithm complexity, memory leaks, caching Security Review Security Review Guide SQLi, XSS, CSRF, SSRF, IDOR, 命令注入, 跨语言示例 Universal Quality Universal Quality Guide Reuse audit, parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, no-op updates, redundant state Common Bugs Common Bugs Checklist Language-specific bug patterns, common pitfalls SQL Injection Prevention SQL Injection Guide Parameterized queries, ORM safety, 6 languages, dynamic identifiers, detection XSS Prevention XSS Prevention Guide Output encoding, CSP, 5 frameworks, input validation vs encoding, detection N+1 Queries N+1 Queries Guide Eager loading, batch fetching, DataLoader, 5 languages, detection Error Handling Error Handling Guide Fail fast, error hierarchy, 7 languages, anti-patterns, logging Async & Concurrency Concurrency Guide Goroutines, async/await, actors, structured concurrency, 7 languages Review Best Practices Code Review Best Practices Communication, reviewer mindset, giving feedback, severity labels Additional Resources PR Review Template - PR 审查评论模板 Review Checklist - 快速参考清单