Code Review 112

---
name: code-review
description: "Review code changes for correctness, security, tests, and architecture; use for code review or PR review requests (trigger keywords: code review, review changes, PR review, security review)."
---

# Code Review

## What this skill does
- Reviews diffs or files for bugs, security risks, maintainability, and architecture alignment.
- Prioritizes high-severity issues and missing tests over style nitpicks.
- Adapts to repository patterns and local guidance (e.g., CLAUDE.md) when present.

## When to use it
- Trigger phrases: "code review", "PR review", "review changes", "security review".
- Use after writing or modifying code, before merge, or when asked to approve/request changes.

## Step-by-step workflow
1) Identify scope: diff, files, commit, or PR; confirm intent and expected behavior.
2) Review changed code first, then open surrounding context only when needed.
3) Scan for critical risks: correctness, security, data loss, auth/authz, injection, secrets, crypto misuse.
4) Check architecture alignment and dependency boundaries; note any layering violations.
5) Evaluate error handling, logging, resource cleanup, and edge cases.
6) Assess code quality and maintainability: clarity, naming, abstraction level, duplication, complexity, and dependency changes; note SOLID issues only when material.
7) Check tests and coverage gaps; call out missing or brittle tests.
8) Flag performance issues only when evidence exists; avoid speculative optimizations.
9) Write actionable feedback with file references and minimal fix guidance.
10) Summarize remaining risks and verification steps.

## Expected outputs / formatting
- Findings ordered by severity with file paths.
- Short rationale and concrete fix suggestions for each issue.
- Call out security items with optional CWE/OWASP references when applicable.
- Missing tests called out explicitly.
- Brief change summary only after findings.
- Keep feedback pragmatic; avoid theoretical or stylistic nitpicks.

## Example prompts
- "Do a code review of the staged changes."
- "Review this PR for security and correctness issues."
- "Check these files for architecture violations."
- "Review the code you just generated and call out risks."