Code Review Security

---
name: code-review-security
description: This skill should be used when the user requests a code review, security audit, or pre-merge inspection of a change. Trigger phrases include "review 代码", "代码审查", "安全审计", "审查这个 PR", "review this PR", "security audit", "code review". It applies a five-axis review framework (correctness, readability, architecture, security, performance) with severity classification and a standardized output template.
---

# Code Review & Security

## Overview
Perform thorough, opinionated pre-merge reviews and security audits. Apply a
five-axis framework, classify findings by severity, and produce a consistent
report so issues are actionable.

## When to Use
- "review 代码", "代码审查", "审查这个 PR", "review this PR", "安全审计", "security audit", "code review".
- Before merging a feature, bugfix, or refactor.
- When the user wants a focused security pass.

## Five-Axis Framework
1. **Correctness** — Does it do what the spec says? Edge cases, off-by-one, null/empty, concurrency.
2. **Readability** — Can another engineer understand it without explanation? Naming, structure, comments.
3. **Architecture** — Follows existing patterns? Right abstraction level? No leaky boundaries.
4. **Security** — Input validation, authz checks, secrets, injection, XSS, rate limiting, IDOR.
5. **Performance** — N+1 queries, unbounded loops, missing pagination, needless allocations.

## Severity Classification
- **Critical** — data loss, security vulnerability, broken functionality. Must fix before merge.
- **Important** — missing test, wrong abstraction, poor error handling. Should fix before merge.
- **Suggestion** — naming, style, optional optimization. Consider.

## Procedure
1. Read the diff / changed files fully; do not skim.
2. Run each axis against the change; note `file:line — description + recommended fix`.
3. Always note at least one thing done well.
4. Emit the report using `references/review-template.md`.
5. Include a verification story (tests run? build verified? security checked?).

## Bundled Resources
- `references/review-template.md` — copy-paste report skeleton.
- `references/security-checklist.md` — common vulnerability checks (OWASP-aligned).