code-reviewer

Files (1)

• SKILL.md

SKILL.md (first lines)

# Code Reviewer

## Overview

Code Reviewer provides a systematic approach to conducting thorough code reviews. It helps identify code quality issues, potential bugs, security vulnerabilities, performance problems, and ensures adherence to best practices and coding standards before merging changes.

## When to Use

Use this skill when:

- Reviewing pull requests or merge requests
- Conducting code reviews
- The user mentions "code review", "PR review", or "review this code"
- Analyzing code quality
- Checking for bugs or security issues
- Validating adherence to coding standards
- Pre-merging code changes

## Review Process

### Phase 1: Understand the Change

Before diving into details, understand the scope and purpose:

1. **Read the PR description**
   - What is the purpose of this change?
   - What problem does it solve?
   - Are there any related issues or tickets?

2. **Identify the scope**
   - What files were changed?
   - How large is the change?
   - Is this a breaking change?

3. **Check the baseline**
   - Review existing code in affected areas
   - Understand the context and architecture
   - Identify any related code that might be affected

### Phase 2: Security Review

Check for security vulnerabilities first:

#### Input Validation

```javascript
// ❌ BAD: Unvalidated input
function queryDatabase(userInput) {
  return db.query(`SELECT * FROM users WHERE id = ${userInput}`);
}

// ✅ GOOD: Parameterized query
function queryDatabase(userId) {
  return db.query("SELECT * FROM users WHERE id = ?", [userId]);
}
```

#### Authentication & Authorization

- Verify user is authenticated before sensitive operations
- Check that authorization checks are properly enforced
- Look for privilege escalation possibilities

#### Data Exposure

- Ensure sensitive data is not logged or exposed
- Check for proper encryption of sensitive information
- Verify secure storage of credentials and secrets

#### Common Security Issues

| Issue          | What to Check                               | Fix                         |
| -------------- | ------------------------------------------- | --------------------------- |
| SQL Injection  | String concatenation in queries             | Use parameterized queries   |
| XSS            | Unescaped user input in HTML                | Sanitize and escape output  |
| CSRF           | Missing CSRF tokens on forms                | Add anti-CSRF tokens        |
| SSRF           | User-provided URLs fetched server-side      | Validate and sanitize URLs  |
| IDOR           | Direct object references without auth check | Verify authorization        |
| Path Traversal | File paths constructed from user input      | Validate and sanitize paths |

### Phase 3: Code Quality Review

#### Code Structure

- **Single Responsibility**: Does each function/class do one thing?
- **DRY (Don't Repeat Yourself)**: Is there code duplication?
- **Clean abstractions**: Are interfaces clean and focused?
- **Modularity**: Is code properly organized into modules?

```python
# ❌ BAD: God function doing multiple things
def process_user(user_data):
    validate(user_data)
    save_to_db(user_data)
    send_email(user_data)
    update_analytics(user_data)
    log_action(user_data)

# ✅ GOOD: Separated concerns
def process_user(user_data):
    validate(user_data)
    save_to_db(user_data)
    notify_user(user_data)
    track_action(user_data)
```

#### Error Handling

- Are errors properly handled?
- Are error messages user-friendly?
- Are errors logged appropriately?
- Are resources cleaned up in finally blocks?

```javascript
// ❌ BAD: Swallowed error
try {
  doSomething();
} catch (e) {
  // Silently ignored

From ntk148v/skills, MIT.

More from ntk148v/skills