Code Review Workflow

PROSE constraint: Orchestrated Composition — chains multiple analysis steps into a complete review process.

Context Loading Phase

1. •Get the changes to review:
   • •If $ARGUMENTS is provided, review that file or directory
   • •Otherwise, review uncommitted changes via git diff
2. •Read the relevant .claude/rules/ files for applicable standards

Review Process

1. Security Scan

Check for OWASP Top 10 issues:

• •SQL injection (string concatenation in queries)
• •XSS (unescaped output)
• •Hardcoded secrets or credentials
• •Missing input validation
• •Insecure direct object references

2. Code Quality

• •Type safety (no any, proper null checks)
• •Error handling (try-catch at boundaries, custom error types)
• •Naming clarity (functions describe actions, variables describe values)
• •DRY violations (duplicated logic that should be extracted)

3. Performance

• •Render-blocking resources (JS without defer, large CSS)
• •Unoptimized images (missing width/height, wrong format)
• •N+1 query patterns in database code
• •Unbounded list operations

4. Test Coverage

• •Are new code paths tested?
• •Do tests cover both success and error cases?
• •Are edge cases addressed?

Output Format

Organize findings by severity:

## Review: [scope]

### Critical (must fix)
- [finding]

### Warning (should fix)
- [finding]

### Suggestion (nice to have)
- [finding]

### Looks Good
- [positive observation]

Validation Gate

If critical issues are found, clearly state they must be resolved before merging.