Our review

This skill performs a structured code review of the current branch's changes by diffing against develop (or main/master) and produces a severity-ranked report.

Strengths

Explicit checklist spanning security, architecture, code quality, tests and performance
Always diffs the current branch against develop, falling back to main or master
Report is prioritized into BLOCKING / IMPORTANT / SUGGESTIONS / GOOD with file:line references
Security findings are treated as merge-blocking by default

Limitations

Assumes a git history with an identifiable base branch; of little use where no comparable commits exist
Works from static reading of the diff only — it runs no tests or linters itself
Fixed thresholds (functions < 50 lines, no any types) are opinionated and may not fit every codebase

When to use it

Use it before opening a pull request or when you want a fast, methodical audit of a working branch.

When not to use it

Skip it when you need deep design feedback or dynamic security analysis, which this static checklist does not provide.

Examples

Review before PR

Review the changes on this branch against develop and tell me what must be fixed before I open a pull request.

Security-focused pass

Do a code review of my current branch, focusing on hardcoded secrets, SQL injection and missing authorization checks.

Review a feature branch

Run a full code review of feature/payment-retries versus main — flag blocking issues, missing tests and anything worth improving.

name: code-review description: Review code for bugs, security issues, and quality. Use when asked to review code or before creating a PR.

Perform a thorough code review of the changes in the current branch.

Step 1 — Get the changes

git diff develop...HEAD
git diff --stat develop...HEAD

If there is no develop branch, use main or master as the base.

Step 2 — Review checklist

Security (CRITICAL — block PR if any found)

[ ] No hardcoded secrets, tokens, or credentials in code
[ ] No SQL string interpolation (use parameterized queries / ORM)
[ ] User input validated before processing
[ ] Authentication/authorization enforced on protected routes
[ ] No sensitive data exposed in API responses (passwords, tokens)
[ ] No console.log / print of sensitive data

Architecture & Patterns

[ ] Code follows the project's existing conventions (check CLAUDE.md)
[ ] Business logic separated from HTTP/presentation layer
[ ] No circular dependencies introduced
[ ] Functions do one thing (single responsibility)

Code Quality

[ ] Functions < 50 lines
[ ] No duplicated logic (DRY)
[ ] Meaningful variable and function names
[ ] No commented-out code left behind
[ ] Proper error handling (no silent failures, no bare catch / except)
[ ] No unnecessary any types (TypeScript projects)

Tests

[ ] New features have tests
[ ] Bug fixes have regression tests
[ ] Happy path + main error cases covered

Performance

[ ] No obvious N+1 queries
[ ] No blocking operations in async contexts
[ ] Large lists paginated, not fetched all at once

Step 3 — Report

Format your review as:

BLOCKING — Must fix before merge:

[issue] in file:line

IMPORTANT — Should fix:

[issue] in file:line

SUGGESTIONS — Nice to have:

[suggestion]

GOOD — What was done well

$ARGUMENTS

Thorough code review

Recommended for