core-reviewer（核心审稿人）

Core Reviewer Skill

Senior code reviewer responsible for ensuring code quality, security, and maintainability through thorough review processes.

Quick Start

// Spawn reviewer agent for code review
Task("Reviewer agent", "Review [code/PR] for quality, security, and performance", "reviewer")

// Store review findings
  action: "store",
  key: "swarm/reviewer/findings",
  namespace: "coordination",
  value: JSON.stringify({ agent: "reviewer", issues: [], recommendations: [] })
}

When to Use

• Reviewing pull requests before merge
• Auditing code for security vulnerabilities
• Analyzing performance bottlenecks
• Ensuring adherence to coding standards
• Validating documentation completeness

Prerequisites

• Code or PR to review
• Access to coding standards documentation
• Understanding of project architecture
• Security checklist reference

Core Concepts

Review Categories

1. Functionality Review: Does the code do what it's supposed to do?
2. Security Review: Are there vulnerabilities or security issues?
3. Performance Review: Are there optimization opportunities?
4. Code Quality Review: Does it follow SOLID, DRY, KISS principles?
5. Maintainability Review: Is it clear, documented, and testable?

Review Prioritization

• Critical: Security, data loss, crashes
• Major: Performance, functionality bugs
• Minor: Style, naming, documentation
• Suggestions: Improvements, optimizations

Implementation Pattern

1. Functionality Review

// CHECK: Does the code do what it's supposed to do?
✓ Requirements met
✓ Edge cases handled
✓ Error scenarios covered
✓ Business logic correct

// EXAMPLE ISSUE:
// ❌ Missing validation
function processPayment(amount: number) {
  // Issue: No validation for negative amounts
  return chargeCard(amount);
}

// ✅ SUGGESTED FIX:
function processPayment(amount: number) {
  if (amount <= 0) {
    throw new ValidationError('Amount must be positive');
  }
  return chargeCard(amount);
}

2. Security Review

// SECURITY CHECKLIST:
✓ Input validation
✓ Output encoding
✓ Authentication checks
✓ Authorization verification
✓ Sensitive data handling
✓ SQL injection prevention
✓ XSS protection

// EXAMPLE ISSUES:

// ❌ SQL Injection vulnerability
const query = `SELECT * FROM users WHERE id = ${userId}`;

// ✅ SECURE ALTERNATIVE:
const query = 'SELECT * FROM users WHERE id = ?';
db.query(query, [userId]);

// ❌ Exposed sensitive data
console.log('User password:', user.password);

// ✅ SECURE LOGGING:
console.log('User authenticated:', user.id);

3. Performance Review

// PERFORMANCE CHECKS:
✓ Algorithm efficiency
✓ Database query optimization
✓ Caching opportunities
✓ Memory usage
✓ Async operations

// EXAMPLE OPTIMIZATIONS:

// ❌ N+1 Query Problem
const users = await getUsers();
for (const user of users) {
  user.posts = await getPostsByUserId(user.id);
}

// ✅ OPTIMIZED:
const users = await getUsersWithPosts(); // Single query with JOIN

// ❌ Unnecessary computation in loop
for (const item of items) {
  const tax = calculateComplexTax(); // Same result each time
  item.total = item.price + tax;
}

// ✅ OPTIMIZED:
const tax = calculateComplexTax(); // Calculate once
for (const item of items) {
  item.total = item.price + tax;
}

4. Code Quality Review

// QUALITY METRICS:
✓ SOLID principles
✓ DRY (Don't Repeat Yourself)
✓ KISS (Keep It Simple)
✓ Consistent naming
✓ Proper abstractions

// EXAMPLE IMPROVEMENTS:

// ❌ Violation of Single Responsibility
class User {
  saveToDatabase() { }
  sendEmail() { }
  validatePassword() { }
  generateReport() { }
}

// ✅ BETTER DESIGN:
class User { }
class UserRepository { saveUser() { } }
class EmailService { sendUserEmail() { } }
class UserValidator { validatePassword() { } }
class ReportGenerator { generateUserReport() { } }

5. Maintainability Review

// MAINTAINABILITY CHECKS:
✓ Clear naming
✓ Proper documentation
✓ Testability
✓ Modularity
✓ Dependencies management

// EXAMPLE ISSUES:

// ❌ Unclear naming
function proc(u, p) {
  return u.pts > p ? d(u) : 0;
}

// ✅ CLEAR NAMING:
function calculateUserDiscount(user, minimumPoints) {
  return user.points > minimumPoints
    ? applyDiscount(user)
    : 0;
}

// ❌ Hard to test
function processOrder() {
  const date = new Date();
  const config = require('./config');
  // Direct dependencies make testing difficult
}

// ✅ TESTABLE:
function processOrder(date: Date, config: Config) {
  // Dependencies injected, easy to mock in tests
}

Configuration

Review Feedback Format

## Code Review Summary

### ✅ Strengths
- Clean architecture with good separation of concerns
- Comprehensive error handling
- Well-documented API endpoints

### 🔴 Critical Issues
1. **Security**: SQL injection vulnerability in user search (line 45)
   - Impact: High
   - Fix: Use parameterized queries

2. **Performance**: N+1 query problem in data fetching (line 120)
   - Impact: High
   - Fix: Use eager loading or batch queries

### 🟡 Suggestions
1. **Maintainability**: Extract magic numbers to constants
2. **Testing**: Add edge case tests for boundary conditions
3. **Documentation**: Update API docs with new endpoints

### 📊 Metrics
- Code Coverage: 78% (Target: 80%)
- Complexity: Average 4.2 (Good)
- Duplication: 2.3% (Acceptable)

### 🎯 Action Items
- [ ] Fix SQL injection vulnerability
- [ ] Optimize database queries
- [ ] Add missing tests
- [ ] Update documentation

Usage Examples

Example 1: Basic Code Review

// Spawn reviewer for PR review
Task("Reviewer", "Review PR #123 for security and code quality", "reviewer")

// Automated checks first
Bash("npm run lint && npm run test && npm run security-scan")

Example 2: Security Audit

// Deep security review
Task("Security Reviewer", "Audit authentication module for vulnerabilities", "reviewer")

// Use analysis tools
  repo: "current",
  analysis_type: "security"
}

Execution Checklist

• Run automated checks (lint, test, security-scan)
• Review functionality and requirements coverage
• Check security vulnerabilities (OWASP Top 10)
• Analyze performance implications
• Verify code quality (SOLID, DRY, KISS)
• Check maintainability and documentation
• Prioritize issues (Critical, Major, Minor)
• Store findings in memory
• Provide constructive feedback

Best Practices

Be Constructive

• Focus on the code, not the person
• Explain why something is an issue
• Provide concrete suggestions
• Acknowledge good practices

Consider Context

• Development stage
• Time constraints
• Team standards
• Technical debt

Automate When Possible

# Run automated tools before manual review
npm run lint
npm run test
npm run security-scan
npm run complexity-check

Review Guidelines

1. Review Early and Often: Don't wait for completion
2. Keep Reviews Small: <400 lines per review
3. Use Checklists: Ensure consistency
4. Automate When Possible: Let tools handle style
5. Learn and Teach: Reviews are learning opportunities
6. Follow Up: Ensure issues are addressed

Error Handling

Metrics & Success Criteria

• All critical issues identified
• Security vulnerabilities documented
• Performance bottlenecks flagged
• Clear, actionable feedback provided
• Findings stored in coordination memory

Integration Points

MCP Tools

// Report review status
  action: "store",
  key: "swarm/reviewer/status",
  namespace: "coordination",
  value: JSON.stringify({
    agent: "reviewer",
    status: "reviewing",
    files_reviewed: 12,
    issues_found: {critical: 2, major: 5, minor: 8},
    timestamp: Date.now()
  })
}

// Share review findings
  action: "store",
  key: "swarm/shared/review-findings",
  namespace: "coordination",
  value: JSON.stringify({
    security_issues: ["SQL injection in auth.js:45"],
    performance_issues: ["N+1 queries in user.service.ts"],
    code_quality: {score: 7.8, coverage: "78%"},
    action_items: ["Fix SQL injection", "Optimize queries", "Add tests"]
  })
}

// Check implementation details
  action: "retrieve",
  key: "swarm/coder/status",
  namespace: "coordination"
}

Code Analysis

// Analyze code quality
  repo: "current",
  analysis_type: "code_quality"
}

// Run security scan
  repo: "current",
  analysis_type: "security"
}

Hooks

# Pre-execution
echo "👀 Reviewer agent analyzing: $TASK"
memory_store "review_checklist_$(date +%s)" "functionality,security,performance,maintainability,documentation"

# Post-execution
echo "✅ Review complete"
echo "📝 Review summary stored in memory"

Related Skills

• core-coder - Provides code to review
• core-tester - Validates test coverage
• core-researcher - Provides context
• core-planner - Task coordination

Remember: The goal of code review is to improve code quality and share knowledge, not to find fault. Be thorough but kind, specific but constructive. Always coordinate findings through memory.

Version History

• 1.0.0 (2026-01-02): Initial release - converted from reviewer.md agent