Skills code-review

📦

code-review

Name: code-review
Author: EricDuMingTong

v1.0.1 Content revision r1 Low Risk ⚙️ External commands📁 Filesystem access🌐 Network access

Review Code for Security, Bugs, and Quality

Manual code review can miss security, correctness, and performance issues. This skill guides structured reviews with focused checklists and prioritized findings.

Supports: Claude Codex Code(CC)

📊 75 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "code-review" from https://skillstore.io/skills/ericdumingtong-code-review.md and its manifest at https://skillstore.io/api/skills/ericdumingtong-code-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/ericdumingtong-code-review.md Signed manifest GET /api/skills/ericdumingtong-code-review/manifest Signed lockfile GET /api/skills/ericdumingtong-code-review/lockfile

Test it

Using "code-review". A web route builds database queries from request parameters and returns HTML.

Expected outcome:

The review flags SQL injection, unsafe HTML output, weak session handling, and missing input validation with critical priority.

Using "code-review". A pull request adds an authentication bypass for debug requests.

Expected outcome:

The review marks the bypass as critical, explains exploitability, and recommends removing debug trust from production paths.

Using "code-review". A batch job loops through orders and fetches related records one item at a time.

Expected outcome:

The review identifies N+1 queries, repeated nested loops, and missing boundary checks, then suggests batching and clearer iteration.

Security Audit

Low Risk

v4 • 7/5/2026 Open versioned report

All static findings were false positives caused by Markdown inline code, sample snippets, checklist text, XML namespace URLs, and identifier fields. No prompt injection or data exfiltration intent was found. One semantic concern is that the skill instructs agents to save review output to a markdown file, a low-risk workspace side effect.

Files scanned

1,744

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Low

SKILL.md:110-118

Unconditional Workspace File Creation

SKILL.md instructs the agent to always save the review to a markdown file. This is a low-risk workspace side effect that should be optional and use sanitized filenames.

The instruction is explicit and cites a real output-file workflow. The risk is limited because it writes markdown review output rather than executing code or exfiltrating data.

Risk Factors

⚙️ External commands (15)

evals/evals.json:6 evals/evals.json:12 evals/evals.json:18 references/Performance-check.md:18-21 references/Performance-check.md:21-22 SKILL.md:24 SKILL.md:38 SKILL.md:44 SKILL.md:56 SKILL.md:60 SKILL.md:72 SKILL.md:95 SKILL.md:114 SKILL.md:115 SKILL.md:116

📁 Filesystem access (1)

references/security-checklist.md:8

🌐 Network access (3)

references/ui-component-check.md:61 references/ui-component-check.md:818 references/ui-component-check.md:819

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/ericdumingtong-code-review/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/ericdumingtong-code-review/security.svg)](https://skillstore.io/skills/ericdumingtong-code-review?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/ericdumingtong-code-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ericdumingtong-code-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/ericdumingtong-code-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

EricDuMingTong. (2026). code-review security audit report (audit version 4) [Author version 1.0.1]. Skillstore. https://skillstore.io/skills/ericdumingtong-code-review/audits/4

BibTeX citation

@techreport{ericdumingtong-ericdumingtong-code-review-2026,
  author = {EricDuMingTong},
  title = {code-review security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/ericdumingtong-code-review/audits/4},
  note = {Author version 1.0.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "code-review security audit report (audit version 4)"
version: "1.0.1"
type: report
authors:
  - name: "EricDuMingTong"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/ericdumingtong-code-review/audits/4"
identifiers:
  - type: other
    value: "skillstore:ericdumingtong-code-review:audit:4"
    description: "Skillstore immutable audit report identifier"

Compare variants

14 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage

Author / source Skillstore Score Evidence Confidence Skillstore usage Updated

21pounder Recommended

21pounder-code-review

Skillstore Score 80

Evidence Confidence High

Skillstore usage 58

Updated

2026-08-21

DavidDworetzky

daviddworetzky-code-review

Skillstore Score 80

Evidence Confidence High

Skillstore usage 18

Updated

2026-08-21

Bind

bind-code-review

Skillstore Score 80

Evidence Confidence High

Skillstore usage 14

Updated

2026-08-21

Claude Assistant

adammanuel-dev-code-review

Skillstore Score 80

Evidence Confidence High

Skillstore usage 9

Updated

2026-08-21

getsentry

getsentry-code-review

Skillstore Score 79

Evidence Confidence High

Skillstore usage 23

Updated

2026-08-21

davila7

davila7-code-review

Skillstore Score 79

Evidence Confidence High

Skillstore usage 11

Updated

2026-08-21

Joseph OBrien

89jobrien-code-review

Skillstore Score 78

Evidence Confidence High

Skillstore usage 46

Updated

2026-08-21

supercent-io

supercent-io-code-review

Skillstore Score 78

Evidence Confidence High

Skillstore usage 28

Updated

2026-08-21

ANcpLua

ancplua-code-review

Skillstore Score 78

Evidence Confidence High

Skillstore usage 12

Updated

2026-08-21

Cain96

cain96-code-review

Skillstore Score 78

Evidence Confidence High

Skillstore usage 10

Updated

2026-08-21

Doyajin174

doyajin174-code-review

Skillstore Score 78

Evidence Confidence High

Skillstore usage 8

Updated

2026-08-21

mattpocock

mattpocock-code-review

Skillstore Score 77

Evidence Confidence Medium

Skillstore usage 5

Updated

2026-08-21

EricDuMingTong Current

ericdumingtong-code-review

Skillstore Score 75

Evidence Confidence High

Skillstore usage 16

Updated

2026-08-21

coderabbitai

coderabbitai-code-review

Skillstore Score 38

Evidence Confidence Medium

Skillstore usage 16

Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a Pull Request

Analyze changed lines for bugs, security risks, performance regressions, and missing tests before merge.

Audit Sensitive Code Paths

Check authentication, data access, file handling, and external calls for exploitable weaknesses.

Improve Maintainability

Find hard-to-change code, unclear structure, duplicate logic, and safe removal candidates.

Try These Prompts

Review a Small Snippet

Review this snippet for bugs, security issues, and simple readability problems. Focus on the three most important findings.

Review a Pull Request Diff

Review this diff as a pull request. Prioritize changed-line risks, regression potential, missing tests, and actionable fixes.

Audit a Security-Sensitive Flow

Review this authentication or data-access flow for exploitability and impact. Include concrete fixes for each security finding.

Perform a Full Engineering Review

Review this module for security, correctness, performance, tests, maintainability, SOLID concerns, and safe removal opportunities.

Best Practices

Provide the relevant diff, file paths, and expected behavior so findings can cite accurate context.
Ask for a specific review focus when security, performance, or architecture matters most.
Validate important findings with tests, linters, or domain experts before large refactors.

Avoid

Do not treat every suggestion as mandatory without considering product context and risk.
Do not ask for broad repository review when only a small risky change needs attention.
Do not skip manual verification for security findings that affect authentication or data access.