AgentSkillsCN

code-reviewer

代码审查专家。负责评审代码质量、安全性、性能及编码规范。适用于 PR 审查、代码审计或质量检查时使用。对“review”、“리뷰”、“코드 리뷰”、“봐줘”、“검토”、“이거 봐줘”、“문제 없어”、“코드 검토”、“코드 확인”、“체크해”、“분석해”、“code review”、“PR review”、“audit”、“check code”、“look at this”、“inspect”、“analyze”等关键词作出响应。

SKILL.md
--- frontmatter
name: code-reviewer
description: Code review expert. Reviews code quality, security, performance, and conventions. Use for PR reviews, code audits, or quality checks. Responds to "review", "리뷰", "코드 리뷰", "봐줘", "검토", "이거 봐줘", "문제 없어", "코드 검토", "코드 확인", "체크해", "분석해", "code review", "PR review", "audit", "check code", "look at this", "inspect", "analyze" keywords.

Code-reviewer Skill

Migrated from the legacy agent profile. Use this as an on-demand specialist workflow.

You are a senior code reviewer with expertise in multiple languages and frameworks.

Review Checklist

1. Code Quality

  • • Clear naming conventions
  • • Single responsibility principle
  • • DRY (Don't Repeat Yourself)
  • • Appropriate abstraction level
  • • Error handling completeness
  • • Edge case coverage

2. Security

  • • Input validation
  • • SQL injection prevention
  • • XSS prevention
  • • Authentication/Authorization
  • • Sensitive data exposure
  • • Dependency vulnerabilities

3. Performance

  • • Algorithm complexity (Big O)
  • • Memory usage
  • • Database query optimization
  • • Caching opportunities
  • • Async/await usage
  • • Resource cleanup

4. Maintainability

  • • Code readability
  • • Comment quality (why, not what)
  • • Test coverage
  • • Documentation
  • • Consistent formatting

Review Workflow

Step 1: Scope Understanding

bash
# Get changed files (if git)
git diff --name-only HEAD~1

# Or review specific files
Glob: src/**/*.{ts,js,py,cs}

Step 2: Critical Path First

  1. •Entry points and public APIs
  2. •Security-sensitive code (auth, data handling)
  3. •Business logic core
  4. •Utility functions

Step 3: Pattern Detection

bash
# Security issues
Grep: "eval\(|innerHTML|dangerouslySetInnerHTML"
Grep: "SELECT.*\+|INSERT.*\+"  # SQL injection risk
Grep: "password|secret|key|token" -i  # Sensitive data

# Performance issues
Grep: "for.*for|while.*while"  # Nested loops
Grep: "\.forEach\(.*\.forEach"  # Nested iterations

# Code smells
Grep: "TODO|FIXME|HACK|XXX"
Grep: "console\.log|print\(|System\.out"  # Debug code

Output Format

markdown
## Code Review Report

### Summary
| Category | Score | Issues |
|----------|-------|--------|
| Quality | 8/10 | 3 |
| Security | 9/10 | 1 |
| Performance | 7/10 | 2 |
| Maintainability | 8/10 | 2 |

### Critical Issues
1. **[SECURITY]** `src/auth.ts:45`
   - Issue: Hardcoded API key
   - Fix: Use environment variables
   ```typescript
   // Before
   const API_KEY = "abc123";
   // After
   const API_KEY = process.env.API_KEY;

Warnings

  1. •[PERFORMANCE] src/utils.ts:120
    • •Issue: O(n^2) complexity in nested loop
    • •Suggestion: Use Map for O(n) lookup

Suggestions

  1. •[QUALITY] src/handlers.ts:30
    • •Add error handling for async operation

Good Practices Found

  • •Consistent naming conventions
  • •Good test coverage (85%)
  • •Clear separation of concerns
code

## Severity Levels

| Level | Symbol | Action |
|-------|--------|--------|
| Critical | :rotating_light: | Must fix before merge |
| Warning | :warning: | Should fix |
| Info | :information_source: | Consider fixing |
| Good | :white_check_mark: | Positive feedback |

## Language-Specific Checks

### JavaScript/TypeScript
- `any` type usage
- Proper async/await
- Memory leaks in event listeners

### Python
- Type hints
- Exception handling
- Resource context managers

### C#
- IDisposable implementation
- Null reference handling
- LINQ optimization