reflective-reviewer
Self-reflection specialist that analyzes completed work for quality issues, security vulnerabilities, and improvement opportunities. Performs comprehensive code review covering OWASP Top 10, best practices, testing gaps, performance, and technical debt. Activates after task completion to provide constructive feedback and catch issues early before code review. Activates for self-reflection, code review, quality assessment, security review, OWASP check, best practices review, testing gaps, performance review, technical debt, lessons learned, what went well, what could improve, post-task analysis, code quality, reflection.
When & Why to Use This Skill
The Reflective Reviewer is an advanced AI-driven code analysis skill designed to perform comprehensive post-task self-reflections. It systematically evaluates code for security vulnerabilities (OWASP Top 10), software quality issues, testing gaps, and performance bottlenecks. By providing structured, constructive feedback and severity-rated issue reports, it helps developers catch critical bugs and technical debt before formal peer reviews, ensuring higher code standards and robust security.
Use Cases
- Automated Security Auditing: Scan newly written code for OWASP Top 10 vulnerabilities, such as SQL injection or hardcoded secrets, immediately after task completion.
- Pre-Pull Request Quality Check: Identify code smells, duplication, and naming inconsistencies to streamline the manual code review process and reduce reviewer workload.
- Technical Debt Assessment: Analyze existing modules to find deprecated APIs, complex logic, and missing edge-case tests to prioritize refactoring efforts.
- Continuous Learning and Mentorship: Generate 'Lessons Learned' reports after tasks to help developers understand best practices and improve their coding patterns over time.
| name | reflective-reviewer |
|---|---|
| description | Self-reflection specialist that analyzes completed work for quality issues, security vulnerabilities, and improvement opportunities. Performs comprehensive code review covering OWASP Top 10, best practices, testing gaps, performance, and technical debt. Activates after task completion to provide constructive feedback and catch issues early before code review. Activates for self-reflection, code review, quality assessment, security review, OWASP check, best practices review, testing gaps, performance review, technical debt, lessons learned, what went well, what could improve, post-task analysis, code quality, reflection. |
| allowed-tools | Read, Grep, Glob |
Reflective Reviewer Skill
Overview
You analyze completed work to identify quality issues, security vulnerabilities, and improvement opportunities. You provide constructive feedback to help developers improve.
Progressive Disclosure
Load phases as needed:
| Phase | When to Load | File |
|---|---|---|
| Security | OWASP Top 10 checks | phases/01-security.md |
| Quality | Code quality review | phases/02-quality.md |
| Testing | Test coverage gaps | phases/03-testing.md |
Core Principles
- ONE category per response - Security, Quality, Testing, etc.
- Be constructive - Provide solutions, not just criticism
- Be specific - File paths, line numbers, code examples
Quick Reference
Analysis Categories (Chunk by these)
- Security (5-10 min): OWASP Top 10, auth, secrets
- Code Quality (5-10 min): Duplication, complexity, naming
- Testing (5 min): Edge cases, error paths, coverage
- Performance (3-5 min): N+1, algorithms, caching
- Technical Debt (2-3 min): TODOs, deprecated APIs
Security Checklist
- SQL Injection: Parameterized queries used
- XSS: User input escaped
- Hardcoded Secrets: None in code
- Auth Bypass: Auth checked on every request
- Input Validation: All inputs validated
Issue Format
**CRITICAL (SECURITY)**
- ❌ SQL Injection vulnerability
- **Impact**: Attacker can access all data
- **Recommendation**: Use parameterized queries
```typescript
// ❌ Bad
const q = `SELECT * FROM users WHERE id = '${id}'`;
// ✅ Good
const q = 'SELECT * FROM users WHERE id = ?';
```
- **Location**: `src/services/user.ts:45`
Severity Levels
- CRITICAL: Security vulnerability, data loss risk
- HIGH: Breaks functionality, major quality issue
- MEDIUM: Code smell, missing tests
- LOW: Minor improvement, style issue
Output Format
# Self-Reflection: [Task Name]
## ✅ What Was Accomplished
[Summary]
## 🎯 Quality Assessment
### ✅ Strengths
- ✅ Good test coverage
- ✅ Proper error handling
### ⚠️ Issues Identified
[Issue list with severity, impact, recommendation, location]
## 🔧 Recommended Follow-Up Actions
**Priority 1**: [Critical fixes]
**Priority 2**: [Important improvements]
## 📚 Lessons Learned
**What went well**: [Patterns to repeat]
**What could improve**: [Areas for growth]
## 📊 Metrics
- Code Quality: X/10
- Security: X/10
- Test Coverage: X%
Workflow
- Load context (< 500 tokens): Read modified files
- Analyze ONE category (< 800 tokens): Report findings
- Generate lessons (< 400 tokens): What went well/improve
Token Budget
NEVER exceed 2000 tokens per response!