--- name: code-review-skill description: "A comprehensive multi-language code review skill for AI agents covering React 19, Vue 3, Rust, TypeScript, Python, Go, and 20+ ecosystems." license: MIT metadata: author: awesome-skills repo: awesome-skills/code-review-skill version: "1.0.0" ---

Multi-Language Code Review Skill

A production-ready skill for AI coding assistants that transforms code review from vague suggestions into a structured, consistent, and expert-level process. Covers 20+ languages and frameworks with progressive disclosure, severity labeling, and security-first checklists.

Subgroups Included

1. Review Mindset & 4-Phase Review Process — Execute structured 4-phase reviews (Context Gathering -> High-Level Design -> Line-by-Line Inspection -> Summary & Decision) with constructive feedback tone. 2. Severity Labeling Protocol — Classify review findings across standardized severity tags: [blocking] must-fix issues, [important] non-blocking fixes, [nit], [suggestion], and [praise]. 3. Frontend Frameworks Review (React 19, Vue 3, Angular, Svelte 5) — Inspect modern frontend changes for React 19 Actions/RSC, Vue 3 Composition API, Angular 17+ Signals, Svelte 5 Runes, and TanStack Query v5 state cache. 4. Backend & Systems Review (Rust, Go, C#/.NET, Java, Python, C++) — Audit systems and backend code for borrow checker/unsafe in Rust, goroutine leak/channels in Go, EF Core N+1 queries, async await, and Pydantic validation. 5. Cross-Cutting Security Checklist (SQLi, XSS, CSRF, SSRF, IDOR) — Detect OWASP vulnerabilities, unsafe parameterized SQL queries, XSS injection paths, missing tenant authorization checks, and sensitive data leakage. 6. Universal Code Quality & Anti-Patterns Checklist — Catch parameter sprawl, leaky abstractions, deeply nested conditionals, stringly-typed inputs, TOCTOU race conditions, and unreferenced dead code.

Installation Quick Start

Any Agent (Skills CLI)

bash npx skills add awesome-skills/code-review-skill

Common Example Prompts

- "Use code-review-skill to review this PR" - "Perform a security and performance code review on my recent changes" - "Audit my React 19 / TypeScript codebase" - "Review this Go service for race conditions and goroutine leaks"

Subgroup 1: Review Mindset & 4-Phase Review Process

Code Review Skill

Transform code reviews from gatekeeping to knowledge sharing through constructive feedback, systematic analysis, and collaborative improvement.

When to Use This Skill

Reviewing pull requests and code changes
Establishing code review standards for teams
Mentoring junior developers through reviews
Conducting architecture reviews
Creating review checklists and guidelines
Improving team collaboration
Reducing code review cycle time
Maintaining code quality standards

Core Principles

1. The Review Mindset

Goals of Code Review:

Catch bugs and edge cases
Ensure code maintainability
Share knowledge across team
Enforce coding standards
Improve design and architecture
Build team culture

Not the Goals:

Show off knowledge
Nitpick formatting (use linters)
Block progress unnecessarily
Rewrite to your preference

2. Effective Feedback

Good Feedback is:

Specific and actionable
Educational, not judgmental
Focused on the code, not the person
Balanced (praise good work too)
Prioritized (critical vs nice-to-have)

markdown

❌ Bad: "This is wrong."
✅ Good: "This could cause a race condition when multiple users
access simultaneously. Consider using a mutex here."

❌ Bad: "Why didn't you use X pattern?" ✅ Good: "Have you considered the Repository pattern? It would make this easier to test. Here's an example: [link]"

❌ Bad: "Rename this variable." ✅ Good: "[nit] Consider userCount instead of uc for clarity. Not blocking if you prefer to keep it." ```

3. Review Scope

What to Review:

Logic correctness and edge cases
Security vulnerabilities
Performance implications
Test coverage and quality
Error handling
Documentation and comments
API design and naming
Architectural fit

What Not to Review Manually:

Code formatting (use Prettier, Black, etc.)
Import organization
Linting violations
Simple typos

Review Process

Phase 1: Context Gathering (2-3 minutes)

Before diving into code, understand:

Read PR description and linked issue
Check PR size (>400 lines? Ask to split)
Review CI/CD status (tests passing?)
Understand the business requirement
Note any relevant architectural decisions

For large diffs, pipe the diff through `scripts/pr-analyzer.py` (git diff main...HEAD | python scripts/pr-analyzer.py) to triage complexity and get a suggested review approach before reading.

Phase 2: High-Level Review (5-10 minutes)

Architecture & Design - Does the solution fit the problem?
- For significant changes, consult Architecture Review Guide
- Check: SOLID principles, coupling/cohesion, anti-patterns
Performance Assessment - Are there performance concerns?
- For performance-critical code, consult Performance Review Guide
- Check: Algorithm complexity, N+1 queries, memory usage
File Organization - Are new files in the right places?
Testing Strategy - Are there tests covering edge cases?

Phase 3: Line-by-Line Review (10-20 minutes)

For each file, check:

Logic & Correctness - Edge cases, off-by-one, null checks, race conditions
Security - Input validation, injection risks, XSS, sensitive data
Performance - N+1 queries, unnecessary loops, memory leaks
Maintainability - Clear names, single responsibility, comments
Reuse - Before accepting new code, search for existing utilities/helpers that could replace it. Check adjacent files and shared modules for similar patterns. See Universal Quality Guide for anti-patterns like parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, and no-op updates.

Phase 4: Summary & Decision (2-3 minutes)

Summarize key concerns
Highlight what you liked
Make clear decision:
- ✅ Approve
- 💬 Comment (minor suggestions)
- 🔄 Request Changes (must address)
Offer to pair if complex

Review Techniques

Technique 1: The Checklist Method

Use checklists for consistent reviews. See Security Review Guide for comprehensive security checklist.

Technique 2: The Question Approach

Instead of stating problems, ask questions:

markdown

❌ "This will fail if the list is empty."
✅ "What happens if `items` is an empty array?"

❌ "You need error handling here." ✅ "How should this behave if the API call fails?" ```

Technique 3: Suggest, Don't Command

Use collaborative language:

markdown

❌ "You must change this to use async/await"
✅ "Suggestion: async/await might make this more readable. What do you think?"

❌ "Extract this into a function" ✅ "This logic appears in 3 places. Would it make sense to extract it?" ```

Technique 4: Differentiate Severity

Use labels to indicate priority:

🔴 [blocking] - Must fix before merge
🟡 [important] - Should fix, discuss if disagree
🟢 [nit] - Nice to have, not blocking
💡 [suggestion] - Alternative approach to consider
📚 [learning] - Educational comment, no action needed
🎉 [praise] - Good work, keep it up!

Severity levels: 🔴 / 🟡 / 🟢 are the three severity tiers used as the standard across all guides in this skill — 🔴 blocks the merge, 🟡 should be addressed, 🟢 is optional. The remaining markers (💡 / 📚 / 🎉) are non-blocking annotations.

Language-Specific Guides

根据审查的代码语言，查阅对应的详细指南：

Language/Framework	Reference File	Key Topics
React	React Guide	Hooks, useEffect, React 19 Actions, RSC, Suspense, TanStack Query v5
Vue 3	Vue Guide	Composition API, 响应性系统, Props/Emits, Watchers, Composables
Angular 17+	Angular Guide	Signals, Standalone, RxJS, Zoneless, 模板优化, 测试, 路由守卫, HttpInterceptor
Rust	Rust Guide	所有权/借用, Unsafe 审查, 异步代码, 取消安全性, 错误处理
TypeScript	TypeScript Guide	类型安全, async/await, 不可变性, 测试, 模块解析, TS 5.x
Python	Python Guide	可变默认参数, 异常处理, 类属性
Django / DRF	Django Guide	安全审查, N+1 查询, Serializer 反模式, ViewSet, 异步视图
FastAPI	FastAPI Guide	Depends, Pydantic v2 validation, async correctness, sessions/N+1, auth vs authorization, test-driven verification
Java	Java Guide	Java 17/21 新特性, Spring Boot 3, 虚拟线程, Stream/Optional
Java 8 / Legacy	Java 8 Guide	Java 8, Spring Boot 2, javax.\*, Stream/Optional, java.time, CompletableFuture
PHP	PHP Guide	PHP 8.x type system, PDO, security review, Composer, PHPUnit/PHPStan
Ruby / Rails	Ruby Guide	Ruby semantics, Rails 8, Active Record, Active Job, security, testing
C# / .NET	C# Guide	C# 12 特性, 异步编程, EF Core 性能, ASP.NET Core, LINQ
Go	Go Guide	错误处理, goroutine/channel, context, 接口设计
Kotlin / Android	Kotlin Guide	协程, Flow, Jetpack Compose, 空安全, 内存泄漏, 架构模式
Swift / SwiftUI	Swift Guide	Optionals, Swift Concurrency, Sendable/actors, SwiftUI property wrappers, value vs reference types, API design
Dart / Flutter	Dart Guide	Widget rebuilds, const constructors, null safety, isolates, async in build, Riverpod/Bloc, platform channels, keys, disposal
NestJS	NestJS Guide	依赖注入, 分层架构, DTO 验证, Guard/Interceptor, 循环依赖
Svelte / SvelteKit	Svelte Guide	Runes, Load 函数, Form Actions, Store 迁移, SSR/CSR 边界
C	C Guide	指针/缓冲区, 内存安全, UB, 安全编码, 可移植性, 测试
C++	C++ Guide	RAII, 智能指针, C++20/23, constexpr, 测试
Zig	Zig Guide	Allocators, error unions, defer/errdefer, comptime, C interop
CSS/Less/Sass	CSS Guide	变量规范, !important, 性能优化, 响应式, 兼容性
Qt	Qt Guide	对象模型, 信号/槽, Model/View, QML, Qt6 迁移, 测试

Cross-Cutting Guides

Language-agnostic patterns applicable to all code reviews:

Topic	Reference File	Key Topics
Architecture Review	Architecture Review Guide	SOLID, anti-patterns, coupling/cohesion, dependency direction
Performance Review	Performance Review Guide	Web Vitals, N+1, algorithm complexity, memory leaks, caching
Security Review	Security Review Guide	SQLi, XSS, CSRF, SSRF, IDOR, 命令注入, 跨语言示例
Universal Quality	Universal Quality Guide	Reuse audit, parameter sprawl, leaky abstractions, nested conditionals, stringly-typed code, TOCTOU, no-op updates, redundant state
Common Bugs	Common Bugs Checklist	Language-specific bug patterns, common pitfalls
SQL Injection Prevention	SQL Injection Guide	Parameterized queries, ORM safety, 6 languages, dynamic identifiers, detection
XSS Prevention	XSS Prevention Guide	Output encoding, CSP, 5 frameworks, input validation vs encoding, detection
N+1 Queries	N+1 Queries Guide	Eager loading, batch fetching, DataLoader, 5 languages, detection
Error Handling	Error Handling Guide	Fail fast, error hierarchy, 7 languages, anti-patterns, logging
Async & Concurrency	Concurrency Guide	Goroutines, async/await, actors, structured concurrency, 7 languages
Review Best Practices	Code Review Best Practices	Communication, reviewer mindset, giving feedback, severity labels

Additional Resources

PR Review Template - PR 审查评论模板
Review Checklist - 快速参考清单

Subgroup 2: Severity Labeling Protocol

Standardized Severity Markers

- 🔴 [blocking] — Must fix before merge (critical logic errors, security vulnerabilities, crash risks) - 🟡 [important] — Should fix, discuss if disagree (missing edge case handling, performance degradation) - 🟢 [nit] — Nice to have, not blocking (naming clarity, minor formatting) - 💡 [suggestion] — Alternative architectural or algorithmic approach to consider - 📚 [learning] — Educational comment explaining language semantics or best practice - 🎉 [praise] — Highlights elegant solutions, thorough tests, or clean abstractions

Subgroup 3: Frontend Frameworks Review (React 19, Vue 3, Angular, Svelte 5)

Key Frontend Checks

- React 19 & Next.js: Server Actions validation, React Server Components (RSC) boundary leaks, useActionState, useOptimistic, TanStack Query v5 cache invalidation, and useEffect cleanup. - Vue 3: Composition API reactive state leaks, Props/Emits typing, computed property side effects, and composable lifecycles. - Angular 17+: Signal-based reactivity, Standalone components, Zoneless change detection, and RxJS unsubscribe hygiene. - Svelte 5: Runes ($state, $derived, $effect) correctness, Form Actions, and SSR/CSR boundary separation.

Subgroup 4: Backend & Systems Review (Rust, Go, C#/.NET, Java, Python, C++)

Key Backend Checks

- Rust: Ownership & borrowing ergonomics, unsafe audit, async cancellation safety, and explicit error propagation. - Go: Goroutine leaks, unbuffered channel deadlocks, context propagation, and interface pollution. - Python / FastAPI / Django: Mutable default arguments, Pydantic v2 validator correctness, async DB sessions, and N+1 ORM queries. - C# / .NET: EF Core query evaluation, LINQ performance, async/await synchronization context, and ASP.NET Core middleware order. - Java: Java 21 virtual thread pinning with synchronized, Spring Boot 3 security filters, and Stream/Optional anti-patterns.

Subgroup 5: Cross-Cutting Security Checklist (SQLi, XSS, CSRF, SSRF, IDOR)

Universal Security Checklist

- SQL Injection (SQLi): Ensure 100% parameterized query or ORM usage; never concatenate user inputs into SQL strings. - XSS & Output Encoding: Verify proper HTML escaping, Content Security Policy (CSP), and framework-level sanitization. - CSRF & SSRF: Validate origin headers, SameSite cookies, and restrict outbound URL fetchers from hitting internal IP metadata (169.254.169.254, localhost). - Broken Object Level Authorization (BOLA / IDOR): Verify that every database query checks ownership (user_id or organization_id) rather than trusting path IDs.

Subgroup 6: Universal Code Quality & Anti-Patterns Checklist

Universal Anti-Patterns

- Parameter Sprawl: Avoid functions with >4 positional arguments; group into configuration objects or DTOs. - Leaky Abstractions: Keep internal database entities separate from external API presentation layers. - TOCTOU Race Conditions: Avoid "check-then-act" logic without transactional atomicity or row-level locking. - Dead Code & No-Op Updates: Detect unused exports, unreachable conditionals, and database updates that write unchanged values.

Multi-Language Code Review Skill

Installation