code-review
Automated code review for pull requests using specialized review patterns. Analyzes code for quality, security, performance, and best practices. Use when reviewing code changes, PRs, or doing code audits.
When & Why to Use This Skill
This Claude skill automates the code review process for pull requests by systematically analyzing code for security vulnerabilities, performance bottlenecks, and adherence to software engineering best practices. It generates structured feedback that categorizes issues into critical fixes, suggestions, and minor nits, helping teams maintain high code quality and security standards while accelerating the development lifecycle.
Use Cases
- Pull Request Auditing: Automatically scan incoming PRs for common security flaws like SQL injection, XSS, and hardcoded credentials before manual review.
- Performance Optimization: Identify inefficient patterns such as N+1 queries, memory leaks, or unnecessary re-renders in frontend frameworks like React.
- Maintainability & Refactoring: Detect violations of DRY (Don't Repeat Yourself) and SRP (Single Responsibility Principle) to reduce technical debt.
- Security Compliance: Ensure all code changes adhere to security protocols, including proper input validation and secure authentication patterns.
- Test Coverage Verification: Verify that new code changes are accompanied by adequate unit tests and that edge cases are properly handled.
| name | code-review |
|---|---|
| description | Automated code review for pull requests using specialized review patterns. Analyzes code for quality, security, performance, and best practices. Use when reviewing code changes, PRs, or doing code audits. |
| source | anthropics/claude-code |
| license | Apache-2.0 |
Code Review
Review Categories
1. Security Review
Check for:
- SQL injection vulnerabilities
- XSS (Cross-Site Scripting)
- Command injection
- Insecure deserialization
- Hardcoded secrets/credentials
- Improper authentication/authorization
- Insecure direct object references
2. Performance Review
Check for:
- N+1 queries
- Missing database indexes
- Unnecessary re-renders (React)
- Memory leaks
- Blocking operations in async code
- Missing caching opportunities
- Large bundle sizes
3. Code Quality Review
Check for:
- Code duplication (DRY violations)
- Functions doing too much (SRP violations)
- Deep nesting / complex conditionals
- Magic numbers/strings
- Poor naming
- Missing error handling
- Incomplete type coverage
4. Testing Review
Check for:
- Missing test coverage for new code
- Tests that don't test behavior
- Flaky test patterns
- Missing edge cases
- Mocked external dependencies
Review Output Format
## Code Review Summary
### 🔴 Critical (Must Fix)
- **[File:Line]** [Issue description]
- **Why:** [Explanation]
- **Fix:** [Suggested fix]
### 🟡 Suggestions (Should Consider)
- **[File:Line]** [Issue description]
- **Why:** [Explanation]
- **Fix:** [Suggested fix]
### 🟢 Nits (Optional)
- **[File:Line]** [Minor suggestion]
### ✅ What's Good
- [Positive feedback on good patterns]
Common Patterns to Flag
Security
// BAD: SQL injection
const query = `SELECT * FROM users WHERE id = ${userId}`;
// GOOD: Parameterized query
const query = 'SELECT * FROM users WHERE id = $1';
await db.query(query, [userId]);
Performance
// BAD: N+1 query
users.forEach(async user => {
const posts = await getPosts(user.id);
});
// GOOD: Batch query
const userIds = users.map(u => u.id);
const posts = await getPostsForUsers(userIds);
Error Handling
// BAD: Swallowing errors
try {
await riskyOperation();
} catch (e) {}
// GOOD: Handle or propagate
try {
await riskyOperation();
} catch (e) {
logger.error('Operation failed', { error: e });
throw new AppError('Operation failed', { cause: e });
}
Review Checklist
- No hardcoded secrets
- Input validation present
- Error handling complete
- Types/interfaces defined
- Tests added for new code
- No obvious performance issues
- Code is readable and documented
- Breaking changes documented