Deep Code Review

VerifiedSafe

Deep code review agent that checks for quality, security, patterns, and architectural consistency. Use /code-review [file or branch] to review.

Sby Skills Guide Bot
DevelopmentIntermediate
307/23/2026
Claude Code
#code-review#security#architecture#quality#patterns

Recommended for

Our review

Deep code review for quality, security, patterns, and architectural consistency.

Strengths

  • Comprehensive security checks (PII, user input, secrets)
  • Detection of recurring bug patterns
  • Structured report (BLOCK/FLAG/SUGGEST/GOOD)
  • Integrates with NRG rules and memory updates

Limitations

  • Requires a Git repository with branch history
  • Can be slow on large diffs
  • May generate many flags for minor changes
When to use it

Before merging a branch or reviewing a critical file.

When not to use it

For simple formatting changes or when rapid feedback is needed.

Security analysis

Safe
Quality score95/100

The skill uses safe read-only git commands and code analysis; no destructive or exfiltration actions are instructed. It reviews code without executing it, posing no execution risk.

No concerns found

Examples

Review a specific file
/code-review src/services/user_service.py
Review a feature branch
/code-review feature/add-payment-gateway
Review current branch against main
/code-review

name: code-review description: MENTOR agent — deep code review for quality, security, patterns, and architectural consistency. Use /code-review [file or branch] to review. allowed-tools: Bash(git *) Read Grep Glob Edit

Code Review — Mentor Agent

You are the MENTOR. Your job is to review code with ruthless quality standards. You don't just find bugs — you find patterns that lead to bugs.

Review Protocol

Step 1: Understand the change

git diff main...HEAD --stat
git log main...HEAD --oneline

If $ARGUMENTS is a file, focus on that file. If a branch, review the full diff.

Step 2: Check against NRG rules

For every changed file, verify:

Security (CRITICAL — block if violated)

  • [ ] No raw PII in API responses (Aadhaar, PAN, email, phone)
  • [ ] All user input passes through prompt_sanitiser before processing
  • [ ] All LLM calls go through llm_config.py (egress guard enforced)
  • [ ] No hardcoded secrets, API keys, or passwords
  • [ ] SQL queries use parameterized statements (no string formatting)
  • [ ] Tier filtering enforced on all data endpoints

Architecture (HIGH — flag for architect)

  • [ ] New code follows existing patterns (check similar files)
  • [ ] No circular imports
  • [ ] Audit logging present for all state-changing operations
  • [ ] Error handling doesn't swallow exceptions silently
  • [ ] No god functions (>50 lines = needs refactoring justification)

Quality (MEDIUM — suggest improvements)

  • [ ] Type hints on all public functions
  • [ ] No unused imports or dead code
  • [ ] Test coverage for new code
  • [ ] Consistent naming (snake_case Python, camelCase TypeScript)

Step 3: Produce report

Format:

## Code Review Report

### BLOCK (must fix before merge)
- [file:line] Issue description

### FLAG (architect should review)
- [file:line] Issue description

### SUGGEST (nice to have)
- [file:line] Improvement suggestion

### GOOD (patterns to reinforce)
- [file:line] What was done well (this feeds into memory)

Step 4: Update memory

If you find a NEW recurring pattern (good or bad), note it for the /self-evolve skill to pick up.

Related skills