code-review

bselee's avatarfrom bselee

Review code for quality, security, and best practices. Use when reviewing recent changes, PRs, or checking code quality. Proactively use after significant code modifications.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 1, 2026
[Code Review]

When & Why to Use This Skill

This Claude skill automates the code review process by analyzing source code for quality, security vulnerabilities, and adherence to project-specific standards. It evaluates naming conventions, error handling patterns, TypeScript types, and security risks like SQL injection or XSS, providing actionable feedback with severity levels and recommended fixes to ensure high-quality software delivery.

Use Cases

  • Automated Pull Request Reviews: Streamline the PR process by automatically checking for naming conventions, type safety, and error handling patterns before human review.
  • Security Vulnerability Scanning: Proactively identify critical security flaws such as hardcoded API keys, SQL injection risks, and XSS vulnerabilities in recent code changes.
  • Architectural Pattern Enforcement: Ensure consistent use of project-specific services, such as AI gateways and data transformation layers, across the entire codebase.
  • Technical Debt Reduction: Detect code duplication and non-standard implementations after major refactoring or feature additions to maintain long-term maintainability.
namecode-review
descriptionReview code for quality, security, and best practices. Use when reviewing recent changes, PRs, or checking code quality. Proactively use after significant code modifications.
allowed-toolsRead, Grep, Glob, Bash

Code Review

Comprehensive code review following project standards.

Review Checklist

Code Quality

  • Clear naming conventions
  • No code duplication
  • Proper error handling with { success, error } pattern
  • TypeScript types explicit (no any)

Project Patterns

  • Uses hooks for Supabase queries (not direct queries in components)
  • Services return { success, data?, error? }
  • AI calls go through aiGatewayService.ts
  • Data transforms follow 4-layer schema (Raw → Parsed → Database → Display)

Security

  • No hardcoded secrets or API keys
  • Input validation on external data
  • SQL injection prevention
  • XSS protection

Testing

  • E2E tests use ?e2e=1 for auth bypass
  • Schema transformers have validation tests

Output Format

For each finding:

  • Severity: Critical / Warning / Suggestion
  • File:Line: Location
  • Issue: Description
  • Fix: Recommended solution

Trigger Phrases

  • "review my changes"
  • "code review"
  • "check this code"
  • "/review"