Code Review

# Skill: Code Review (Cross-Cutting)

## Purpose

Review code changes for security vulnerabilities, performance bottlenecks, correctness, and maintainability.

## When to Use

- When reviewing a pull request or code diff
- When checking a code change before merging
- When verifying security practices (OWASP Top 10, SQL injection, secrets in code)
- When auditing code performance (N+1 queries, complexity, memory leaks)

## Step-by-Step Process

### Step 1: Security Audit
- Check for OWASP Top 10 vulnerabilities (SQL injection, XSS, CSRF, etc.)
- Look for secrets, API keys, or hardcoded credentials
- Verify authentication and authorization checks

### Step 2: Performance Evaluation
- Identify N+1 query problems in database interactions
- Look for memory leaks or high memory allocation loops
- Verify algorithmic complexity in critical code paths

### Step 3: Correctness Check
- Review edge cases (null values, empty strings, boundary conditions)
- Verify error handling and propagation patterns
- Identify race conditions or concurrency issues

### Step 4: Maintainability Review
- Check variable/function naming for clarity
- Ensure single-responsibility principle is followed
- Check for code duplication and readability

## Required Input

- Code diff, PR URL, or source files
- Context on performance constraints or security requirements

## Expected Output

- Code review report containing:
  - Overall summary
  - Critical security/correctness issues with severity levels
  - Actionable improvement suggestions
  - Praise for well-written code

## Tone & Rules

- Be constructive and focus on the code, not the developer.
- Provide concrete code examples when suggesting improvements.
- Explicitly state trade-offs (e.g. readability vs. performance).

## Available Templates

- None

## Available Scripts

- None

## Examples

See `examples/` directory.

## Links to Other Skills

- **unit-test**: Use to write test cases for edge cases identified during review.
- **sourcecode-analyzer**: Use for automated static code analysis.