# Run Comprehensive Code Reviews

Large pull requests are hard to review consistently across security, performance, tests, and documentation. This skill coordinates specialized review agents and produces merge readiness feedback.

## Install

```bash
npx skillstore add dnyoussef/when-reviewing-code-comprehensively-use-code-review-assistant
```

## Metadata

- Status: approved
- Slug: dnyoussef-when-reviewing-code-comprehensively-use-code-review-assistant
- Version: 1.0.0
- Author version: 1.0.0
- Skillstore revision: r1
- Version status: valid
- Tree hash: e428b78eee51141db3e0b44d809e12ac941fd93c692771530766fdff78e490be
- Author: DNYoussef
- GitHub username: DNYoussef
- License: MIT
- Repository: https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/testing-quality/when-reviewing-code-comprehensively-use-code-review-assistant
- Ref: 0519034dad657fb1f7706e0550e962beeda73fdf
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/dnyoussef-when-reviewing-code-comprehensively-use-code-review-assistant
- Manifest: https://skillstore.pages.dev/api/skills/dnyoussef-when-reviewing-code-comprehensively-use-code-review-assistant/manifest

## Capabilities

- Orchestrates specialized review tracks for security, performance, style, tests, and documentation.
- Runs or describes checks such as ESLint, npm audit, gitleaks, coverage, and bundle analysis.
- Produces merge readiness scoring across review dimensions.
- Defines expected reports for security, performance, style, coverage, documentation, and summary results.
- Suggests auto-fixes and follow-up actions for common review failures.

## Use Cases

- Review a Feature Pull Request: Run a broad review before requesting approval from maintainers.
- Check Security and Dependency Risk: Focus review effort on OWASP issues, secrets, authentication, and vulnerable dependencies.
- Set Merge Readiness Gates: Use scoring thresholds to decide whether a pull request should proceed.

## Prompt Templates

### Basic Pull Request Review

```
Review pull request 123 across security, performance, style, tests, and documentation. Summarize blockers and recommended next actions.
```

### Focused Security and Tests Review

```
Review this pull request for authentication, authorization, secrets, dependency risk, and missing tests. Report only issues that should block merge.
```

### Merge Readiness Assessment

```
Assess merge readiness for this pull request. Score each review dimension and explain the changes required to reach approval.
```

### Review Workflow Hardening

```
Audit the review workflow and auto-fix process. Identify unsafe commands, missing validation, weak thresholds, and CI improvements.
```

## Limitations

- Requires project scripts, configuration, and dependencies to exist before use.
- May run external commands that need user approval and a trusted environment.
- Generated findings still need human review before merge decisions.
- Auto-fix examples can modify files and should be used with source control.

## Best Practices

- Run the review in a clean branch with source control enabled.
- Review command execution and generated scripts before allowing file changes.
- Tune thresholds to project risk, compliance needs, and CI requirements.

## Anti Patterns

- Running auto-fix scripts against production branches without review.
- Treating the score as final approval without human judgment.
- Using the skill without required security, test, and lint tools installed.

## Security Audit

- Audited at: 2026-07-09T12:28:45.521\+00:00
- Summary: Most static findings were false positives caused by Markdown fences, example tables, and review criteria. I confirmed the generated auto-fix shell script risk and added semantic findings for npx-based package execution and repository-modifying auto-fixes. No prompt injection text was found.

## Stats

- Views: 191
- Downloads: 8
- Favorites: 0
- Popularity score: 0