Code Reviewer Skill

Purpose

This skill provides comprehensive code review guidance covering quality, security, performance, and style. It helps identify issues, suggest improvements, and ensure code meets project standards before committing.

Activation

On-demand via command: /review-code <file-path>

Example:

/review-code src/tools/example/core.py

When to Use

• Self-review before committing
• Refactoring existing code
• Security concerns arise
• Performance optimization needed
• Ensuring style guide compliance
• Code quality improvement
• Pre-pull request review

Resources

review-checklist.md

Comprehensive code review checklist covering:

• Code Quality: File organization, naming, type hints, docstrings, error handling
• Testing: Coverage, quality, edge cases
• Performance: Algorithm efficiency, memory usage, I/O optimization
• Security: Input validation, authentication, authorization, data protection
• Style: PEP 8 compliance, import organization, formatting

security-patterns.md

Security best practices including:

• OWASP Top 10: Injection, authentication, XSS, etc.
• Python-Specific Security: eval() usage, pickle security, SQL injection
• Best Practices: Input validation patterns, secure authentication, data protection

Provides

Code Quality Feedback

• File size enforcement (500-line limit)
• Single responsibility principle adherence
• Type hint completeness
• Docstring quality (Google-style)
• Error handling patterns
• Naming convention compliance

Security Vulnerability Detection

• Input validation issues
• SQL injection vulnerabilities
• XSS vulnerabilities
• Authentication/authorization flaws
• Sensitive data exposure
• Insecure dependencies

Performance Optimization Suggestions

• Algorithm efficiency improvements
• Memory usage optimization
• I/O operation optimization
• Caching opportunities
• Database query optimization

Refactoring Recommendations

• Code duplication removal
• Complexity reduction
• Design pattern applications
• Dependency injection improvements
• Interface clarity

Style Guide Compliance Checks

• PEP 8 for Python
• Import organization
• Code formatting
• Comment quality
• Documentation completeness

Usage Examples

Example 1: Review Python Module

/review-code src/tools/doc_fetcher/core.py

Provides feedback on:

• Function complexity and size
• Type hints and docstrings
• Error handling
• Security concerns (if any)
• Performance bottlenecks
• Style violations

Example 2: Security-Focused Review

/review-code src/api/authentication.py

Focuses on:

• Authentication patterns
• Password handling
• Session management
• Input validation
• Authorization checks
• Token security

Example 3: Performance Review

/review-code src/processors/data_processor.py

Analyzes:

• Algorithm complexity
• Memory allocation
• I/O operations
• Caching strategy
• Database queries
• Batch processing opportunities

Review Categories

1. Code Quality (⭐⭐⭐⭐⭐ Essential)

File Organization

• ✓ File size ≤ 500 lines
• ✓ Logical module structure
• ✓ Clear separation of concerns
• ✓ Appropriate file naming

Naming Conventions

• ✓ Descriptive variable names
• ✓ Clear function names (verb_noun pattern)
• ✓ Class names (PascalCase)
• ✓ Constants (UPPER_CASE)
• ✓ Private members (_prefix)

Type Hints

• ✓ All function parameters typed
• ✓ All return types specified
• ✓ Complex types properly annotated
• ✓ Optional types used correctly

Docstrings

• ✓ Google-style format
• ✓ Clear description
• ✓ Args documented
• ✓ Returns documented
• ✓ Raises documented

Error Handling

• ✓ Appropriate exception types
• ✓ Error messages clear
• ✓ No bare except clauses
• ✓ Cleanup in finally blocks

2. Testing (⭐⭐⭐⭐ Important)

Test Coverage

• ✓ 80%+ code coverage
• ✓ All public functions tested
• ✓ Edge cases covered
• ✓ Error paths tested

Test Quality

• ✓ Clear test names
• ✓ Arrange-Act-Assert pattern
• ✓ Independent tests
• ✓ Appropriate fixtures

3. Performance (⭐⭐⭐ Moderate)

Efficiency

• ✓ Optimal algorithm complexity
• ✓ No unnecessary loops
• ✓ Efficient data structures
• ✓ Batch operations where possible

Resource Usage

• ✓ Memory-efficient
• ✓ File handles closed
• ✓ Database connections managed
• ✓ No resource leaks

Optimization

• ✓ Caching implemented
• ✓ Lazy loading used
• ✓ Async for I/O operations
• ✓ Query optimization

4. Security (⭐⭐⭐⭐⭐ Critical)

Input Validation

• ✓ All inputs validated
• ✓ Type checking
• ✓ Range checking
• ✓ Sanitization

Authentication & Authorization

• ✓ Strong authentication
• ✓ Proper authorization
• ✓ Session management
• ✓ Token validation

Data Protection

• ✓ No secrets in code
• ✓ Sensitive data encrypted
• ✓ SQL parameterized
• ✓ Output encoding

OWASP Top 10

• ✓ Injection prevention
• ✓ Broken auth prevention
• ✓ XSS prevention
• ✓ Access control
• ✓ Security misconfiguration

5. Style (⭐⭐⭐ Moderate)

PEP 8 Compliance

• ✓ Line length ≤ 88 characters
• ✓ Indentation (4 spaces)
• ✓ Blank line usage
• ✓ Whitespace around operators

Import Organization

• ✓ Grouped (stdlib, third-party, local)
• ✓ Alphabetically sorted
• ✓ No unused imports
• ✓ Absolute imports preferred

Code Formatting

• ✓ Black-formatted
• ✓ Consistent style
• ✓ Readable layout
• ✓ Appropriate comments

Review Output Format

# Code Review: <file-path>

## Summary
[Brief overview of file purpose and key findings]

## Quality Score: X/10
[Overall quality score with justification]

## Critical Issues (Must Fix)
- [Issue 1 with location and recommendation]
- [Issue 2 with location and recommendation]

## Important Issues (Should Fix)
- [Issue 1 with location and recommendation]
- [Issue 2 with location and recommendation]

## Suggestions (Consider)
- [Suggestion 1 with rationale]
- [Suggestion 2 with rationale]

## Strengths
- [Positive aspect 1]
- [Positive aspect 2]

## Detailed Analysis

### Code Quality
[Detailed quality assessment]

### Security
[Security assessment and concerns]

### Performance
[Performance analysis]

### Testing
[Test coverage and quality]

### Style
[Style guide compliance]

## Recommendations
1. [Priority 1 recommendation]
2. [Priority 2 recommendation]
3. [Priority 3 recommendation]

## Next Steps
[Suggested actions for improvement]

Best Practices

Constructive Feedback

• Focus on code, not person
• Explain "why" behind suggestions
• Provide specific examples
• Offer alternative solutions
• Acknowledge good practices

Priority Levels

• Critical: Security vulnerabilities, bugs, data loss
• Important: Poor performance, missing tests, unclear code
• Suggestions: Style improvements, refactoring opportunities

Context Awareness

• Consider project stage (prototype vs. production)
• Respect project conventions
• Balance perfection with pragmatism
• Focus on impactful improvements

Common Issues to Check

Python-Specific

• Using eval() or exec() unsafely
• Mutable default arguments
• Catching Exception too broadly
• Not using context managers for resources
• String concatenation in loops
• Missing init.py in packages
• Incorrect use of class variables
• Not using generators for large datasets

General Issues

• Magic numbers (use constants)
• Deeply nested code (>3 levels)
• Long functions (>50 lines)
• Duplicate code
• Unclear variable names
• Missing error handling
• No input validation
• Hard-coded credentials

Integration with Development Workflow

Pre-Commit Review

Use this skill before committing:

/review-code <file-you-modified>

Pre-Pull Request Review

Review all changed files:

git diff --name-only main | xargs -I {} /review-code {}

Refactoring Review

After refactoring, verify improvements:

/review-code <refactored-file>

Notes

• Guidance Only: This skill provides review feedback and guidance. It does not automatically fix issues.
• Comprehensive: Reviews cover multiple dimensions (quality, security, performance, style).
• Actionable: Feedback includes specific recommendations and examples.
• Project-Aware: Considers project-specific standards and conventions.

Used When

• Before committing changes
• During code refactoring
• When security review is needed
• For performance optimization
• To ensure style compliance
• Pre-pull request submission
• Learning best practices
• Mentoring code quality