Code Review Pro
Deep code analysis covering security, performance, maintainability, and best practices.
When to Use This Skill
Activate when the user:
- Asks for a code review
- Wants security vulnerability scanning
- Needs performance analysis
- Asks to "review this code" or "audit this code"
- Mentions finding bugs or improvements
- Wants refactoring suggestions
- Requests best practice validation
Instructions
- Security Analysis (Critical Priority)
- SQL injection vulnerabilities - XSS (cross-site scripting) risks - Authentication/authorization issues - Secrets or credentials in code - Unsafe deserialization - Path traversal vulnerabilities - CSRF protection - Input validation gaps - Insecure cryptography - Dependency vulnerabilities
- Performance Analysis
- N+1 query problems - Inefficient algorithms (check Big O complexity) - Memory leaks - Unnecessary re-renders (React/Vue) - Missing indexes (database queries) - Blocking operations - Resource cleanup (file handles, connections) - Caching opportunities - Excessive network calls - Large bundle sizes
- Code Quality & Maintainability
- Code duplication (DRY violations) - Function/method length (should be <50 lines) - Cyclomatic complexity - Unclear naming - Missing error handling - Inconsistent style - Missing documentation - Hard-coded values that should be constants - God classes/functions - Tight coupling
- Best Practices
- Language-specific idioms - Framework conventions - SOLID principles - Design patterns usage - Testing approach - Logging and monitoring - Accessibility (for UI code) - Type safety - Null/undefined handling
- Bugs and Edge Cases
- Logic errors - Off-by-one errors - Race conditions - Null pointer exceptions - Unhandled edge cases - Timezone issues - Encoding problems - Floating point precision
- Provide Actionable Fixes
- Show specific code changes - Explain why change is needed - Include before/after examples - Prioritize by severity
Output Format
# Code Review Report
## 🚨 Critical Issues (Fix Immediately)
### 1. SQL Injection Vulnerability (line X)
**Severity**: Critical
**Issue**: User input directly concatenated into SQL query
**Impact**: Database compromise, data theft
**Current Code:**const query = SELECT * FROM users WHERE email = '${userEmail}';
**Fixed Code:**
const query = 'SELECT * FROM users WHERE email = ?'; db.query(query, [userEmail]);
**Explanation**: Always use parameterized queries to prevent SQL injection.
## ⚠️ High Priority Issues
### 2. Performance: N+1 Query Problem (line Y)
[Details...]
## 💡 Medium Priority Issues
### 3. Code Quality: Function Too Long (line Z)
[Details...]
## ✅ Low Priority / Nice to Have
### 4. Consider Using Const Instead of Let
[Details...]
## 📊 Summary
- **Total Issues**: 12
- Critical: 2
- High: 4
- Medium: 4
- Low: 2
## 🎯 Quick Wins
Changes with high impact and low effort:
1. [Fix 1]
2. [Fix 2]
## 🏆 Strengths
- Good error handling in X
- Clear naming conventions
- Well-structured modules
## 🔄 Refactoring Opportunities
1. **Extract Method**: Lines X-Y could be extracted into `calculateDiscount()`
2. **Remove Duplication**: [specific code blocks]
## 📚 Resources
- [OWASP SQL Injection Guide](https://...)
- [Performance Best Practices](https://...)
Examples
User: "Review this authentication code" Response: Analyze auth logic → Identify security issues (weak password hashing, no rate limiting) → Check token handling → Note missing CSRF protection → Provide specific fixes with code examples → Prioritize by severity
User: "Can you find performance issues in this React component?" Response: Analyze component → Identify unnecessary re-renders → Find missing useMemo/useCallback → Note large state objects → Check for expensive operations in render → Provide optimized version with explanations
User: "Review this API endpoint" Response: Check input validation → Analyze error handling → Test for SQL injection → Review authentication → Check rate limiting → Examine response structure → Suggest improvements with code samples
Best Practices
- Always prioritize security issues first
- Provide specific line numbers for issues
- Include before/after code examples
- Explain *why* something is a problem
- Consider the language/framework context
- Don't just criticize—acknowledge good code too
- Suggest gradual improvements for large refactors
- Link to documentation for recommendations
- Consider project constraints (legacy code, deadlines)
- Balance perfectionism with pragmatism
- Focus on impactful changes
- Group similar issues together
- Make recommendations actionable