Code Reviewer

Purpose

Review code changes for quality, security, performance, and adherence to project patterns.

This skill supports iterative review loops - it will be called multiple times as part of a review-fix cycle.

When to Invoke

• •After implementing a feature or making significant changes
• •Before committing code to version control
• •During pull request review
• •When refactoring existing code
• •As part of iterative review-fix loops (called repeatedly)

Review Modes

Mode 1: Initial Review (Full Scope)

First review in a cycle - comprehensive analysis of everything.

Scope:

• •Security (critical)
• •Bugs (critical)
• •Performance (warnings)
• •Patterns (warnings)
• •Style (suggestions)
• •Documentation (suggestions)

Mode 2: Follow-up Review (Focused)

Subsequent reviews - focus only on remaining issues.

Scope:

• •Only review the specific issues that were reported
• •Verify fixes resolved the problems
• •Check for new issues introduced by fixes
• •Report any NEW issues found

Mode 3: Verification Review (Final Check)

Final review - confirm all issues resolved.

Scope:

• •Verify all previously reported issues are fixed
• •No new issues introduced
• •Ready to proceed

Iterative Review Protocol

When called as part of a review-fix loop:

First Call (Initial Review)

Context: "Initial review after implementation"
Output: Full comprehensive review with all issues
Focus: All aspects (security, bugs, patterns, performance)

Subsequent Calls (Follow-up Review)

Context: "Follow-up review - verify fixes for: {previous_issues}"
Output: Report on:
  1. Which previous issues are now FIXED ✓
  2. Which previous issues REMAIN ✗
  3. Any NEW issues introduced by fixes
Focus: Only remaining + new issues (don't re-report fixed items)

Final Call (Verification)

Context: "Final verification review"
Output: Confirmation that:
  1. All issues from previous reviews are RESOLVED
  2. No new issues introduced
  3. Ready to proceed to next phase

Output Format for Iterative Reviews

Initial Review Output

## Code Review: Initial

### Summary

{Quick overview}

### Critical Issues (Must Fix)

1. {Issue description}
   - Location: {file:line}
   - Impact: {why it's critical}
   - Fix: {suggested fix}

### Warnings (Should Fix)

{Similar format}

### Suggestions (Nice to Have)

{Similar format}

### What Was Done Well

{Positive feedback}

---

**Total:** X critical, Y warnings, Z suggestions

Follow-up Review Output

## Code Review: Follow-up (Iteration N)

### Previous Issues Status

✅ Fixed: {list of resolved issues}
❌ Remaining: {list of unresolved issues}

### New Issues Found

{Any new issues introduced by fixes}

### Updated Summary

**Remaining:** X critical, Y warnings

### Next Steps

{What to focus on next}

Verification Review Output

## Code Review: Final Verification

### All Previous Issues: ✅ RESOLVED

### No New Issues Introduced

### Status: READY TO PROCEED

All quality checks passed. Code is ready for:
{next phase - e.g., quality gates, commit, etc.}

Capabilities

Quality Checks

• •Adherence to CQRS pattern (for backend code)
• •Proper use of domain-driven design principles
• •Code organization and structure
• •Naming conventions
• •Documentation completeness

Security Checks

• •SQL injection vulnerabilities
• •XSS vulnerabilities in frontend code
• •Proper authentication/authorization
• •PII encryption for sensitive data
• •Input validation
• •Dependency vulnerabilities

Performance Checks

• •N+1 query patterns
• •Missing database indexes
• •Inefficient re-renders in React
• •Bundle size impact
• •Memory leaks
• •Unnecessary re-computations

Pattern Compliance

• •CQRS pattern usage (commands/queries/events)
• •Repository pattern for data access
• •Server Components first (Next.js)
• •tRPC for type-safe APIs
• •Testcontainers for integration tests
• •Proper error handling

Test Coverage

• •Unit test coverage (target: 80%)
• •Integration test usage
• •Test quality and meaningful assertions
• •Edge case coverage

How to Use

As a Skill

Skill('review')

With Specific Focus

Skill('review', 'Review the auth module for security issues')
Skill('review', 'Review the user list component for performance')

In Iterative Loop

# Iteration 1
Skill('review')  # Full review
→ Returns: 3 critical, 2 warnings

# Iteration 2 (after fixes)
Skill('review', 'Verify fixes for: security-1, security-2, security-3')
→ Returns: 2 fixed, 1 remaining, 1 new

# Iteration 3 (final)
Skill('review', 'Final verification')
→ Returns: All resolved, ready to proceed

Review Checklist

• • Code follows CQRS pattern (backend)
• • No security vulnerabilities
• • Proper error handling
• • Tests present and passing
• • No performance issues
• • Types are properly defined
• • Documentation is clear
• • Naming follows conventions
• • No hardcoded values
• • Environment variables used for secrets

Stopping Conditions

STOP the review loop when:

1. •All critical issues resolved
2. •All warnings addressed (or user accepts)
3. •No new issues introduced
4. •Ready for next phase

ESCALATE when:

1. •Same issue persists across 3 reviews
2. •Fix introduces new critical issue
3. •Cannot verify fix effectiveness
4. •Require user decision on trade-offs