code-review
Review code changes for quality, bugs, security, and performance issues. Use when the user asks to review code, check a PR, do a code quality check, security review, find bugs, or requests code inspection.
When & Why to Use This Skill
This Claude skill automates the code review process by systematically analyzing changes for quality, security vulnerabilities, and performance bottlenecks. It integrates with Git repositories and developer tools to provide actionable feedback on pull requests, ensuring high standards of readability, consistency, and reliability across multiple programming languages including JavaScript, Python, Java, and Go.
Use Cases
- Pull Request Auditing: Automatically checking new code submissions for logic errors, edge cases, and style consistency before merging into the main branch.
- Security Vulnerability Scanning: Identifying potential security risks such as injection flaws, XSS, improper authentication, or accidental secret exposure in the codebase.
- Performance Optimization: Detecting inefficient algorithms, memory leaks, unnecessary loops, or N+1 query problems to ensure optimal resource usage.
- Technical Debt Reduction: Suggesting refactoring opportunities to improve code maintainability, reduce complexity (cyclomatic complexity), and enhance readability.
- Language-Specific Best Practices: Ensuring code adheres to industry standards like PEP 8 for Python, strict mode for TypeScript, or effective error handling in Go.
| name | code-review |
|---|---|
| description | 'Review code changes for quality, bugs, security, and performance issues. Use when the user asks to review code, check a PR, do a code quality check, security review, find bugs, or requests code inspection.' |
| compatibility | Requires Git repository and code reading tools |
| - Bash(git | *, node:*, npm:*, npx:*, pnpm:*, yarn:*, python:*, pip:*, pytest:*, go:*, cargo:*, mvn:*, ./mvnw:*, gradle:*, ./gradlew:*, make:*, cmake:*, g++:*, gcc:*, clang:*) |
Code Review Skill
Systematically review code changes to identify quality, security, and performance issues.
Review Process
- Gather context:
git status --short,git diff --name-only [--cached]; deep dive withmcp__git__git_diff,mcp__serena__find_referencing_symbols,mcp__jetbrains__get_symbol_info. - Analyze:
- Code quality: readability, consistency, abstraction, duplication, complexity(≤15 lines/func 권장)
- Bugs: logic/edge cases, null/undefined, error handling, resource cleanup
- Security: injection, XSS, authz/authn, secret exposure
- Performance: extra loops, N+1, memory leaks, inefficient algo
- Tests: present? edge cases? mocking 적절성?
- Output format:
## Code Review Summary
[2-3 sentence overview of changes]
## Critical Issues (Must Fix)
- `file:line` - [Issue description] - [Fix approach]
## Major Issues (Should Fix)
- `file:line` - [Issue description] - [Improvement suggestion]
## Minor Suggestions (Optional)
- `file:line` - [Suggestion]
## Positive Observations
- [Good practices noted]
## Overall Assessment
[Final recommendations]
Language-Specific Checkpoints
- JavaScript/TypeScript: strict mode, async/await error handling, type definitions, ESLint rules
- Python: PEP 8, type hints,
withfor resources, specific exceptions - Java/Kotlin: null safety, immutability, try-with-resources, thread safety
- Go: error handling,
defer, goroutine leak 예방, context 전달
Edge Cases
- No changes: Notify that there is nothing to review
- More than 20 issues: Group by type, show top 10 by severity first
- Unclear intent: Specify ambiguous parts and request clarification
- Config files only: Analyze impact scope of configuration changes
Notes
- MCP tools are optional; omit if unavailable or add others as needed