code-review

tarafından anthropic

PR diff'leri ve dosya değişiklikleri üzerinde güvenlik, performans, doğruluk ve bakım kolaylığı için yapılandırılmış kod incelemesi. SQL injection, XSS, CSRF, kimlik doğrulama kusurları ve kimlik bilgisi sızıntısı gibi güvenlik risklerini denetler. N+1 sorguları, bellek sızıntıları, algoritmik karmaşıklık ve kaynak sızıntıları gibi performans sorunlarını belirler. Kenar durumlar, yarış koşulları, hata yönetimi ve tip güvenliği açıkları için doğruluk kontrolleri yapar. Diff'ler ve dosya yolları ile bağımsız çalışır; kaynak kontrolü ile entegre olur,...

npx skills add https://github.com/anthropics/knowledge-work-plugins --skill code-review

ZIP İndir GitHub

25.7k

/code-review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Review code changes with a structured lens on security, performance, correctness, and maintainability.

Usage

/code-review <PR URL or file path>

Review the provided code changes: @$1

If no specific file or URL is provided, ask what to review.

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                      CODE REVIEW                                   │
├─────────────────────────────────────────────────────────────────┤
│  STANDALONE (always works)                                       │
│  ✓ Paste a diff, PR URL, or point to files                      │
│  ✓ Security audit (OWASP top 10, injection, auth)               │
│  ✓ Performance review (N+1, memory leaks, complexity)           │
│  ✓ Correctness (edge cases, error handling, race conditions)    │
│  ✓ Style (naming, structure, readability)                        │
│  ✓ Actionable suggestions with code examples                    │
├─────────────────────────────────────────────────────────────────┤
│  SUPERCHARGED (when you connect your tools)                      │
│  + Source control: Pull PR diff automatically                    │
│  + Project tracker: Link findings to tickets                     │
│  + Knowledge base: Check against team coding standards           │
└─────────────────────────────────────────────────────────────────┘

Review Dimensions

Security

SQL injection, XSS, CSRF
Authentication and authorization flaws
Secrets or credentials in code
Insecure deserialization
Path traversal
SSRF

Performance

N+1 queries
Unnecessary memory allocations
Algorithmic complexity (O(n²) in hot paths)
Missing database indexes
Unbounded queries or loops
Resource leaks

Correctness

Edge cases (empty input, null, overflow)
Race conditions and concurrency issues
Error handling and propagation
Off-by-one errors
Type safety

Maintainability

Naming clarity
Single responsibility
Duplication
Test coverage
Documentation for non-obvious logic

Output

## Code Review: [PR title or file]

### Summary
[1-2 sentence overview of the changes and overall quality]

### Critical Issues
| # | File | Line | Issue | Severity |
|---|------|------|-------|----------|
| 1 | [file] | [line] | [description] | 🔴 Critical |

### Suggestions
| # | File | Line | Suggestion | Category |
|---|------|------|------------|----------|
| 1 | [file] | [line] | [description] | Performance |

### What Looks Good
- [Positive observations]

### Verdict
[Approve / Request Changes / Needs Discussion]

If Connectors Available

If ~~source control is connected:

Pull the PR diff automatically from the URL
Check CI status and test results

If ~~project tracker is connected:

Link findings to related tickets
Verify the PR addresses the stated requirements

If ~~knowledge base is connected:

Check changes against team coding standards and style guides

Tips

Provide context — "This is a hot path" or "This handles PII" helps me focus.
Specify concerns — "Focus on security" narrows the review.
Include tests — I'll check test coverage and quality too.