# Review Code for Security, Bugs, and Quality

Manual code review can miss security, correctness, and performance issues. This skill guides structured reviews with focused checklists and prioritized findings.

## Install

```bash
npx skillstore add ericdumingtong/code-review
```

## Metadata

- Status: approved
- Slug: ericdumingtong-code-review
- Version: 1.0.1
- Author version: 1.0.1
- Skillstore revision: r1
- Version status: valid
- Tree hash: 33ec63a32224bc29108ca2519504280f5255115e65428f10a4f6f17841fb895d
- Author: EricDuMingTong
- GitHub username: EricDuMingTong
- License: MIT
- Repository: https://github.com/EricDuMingTong/SkillsRepo/tree/main/skills/nothing-code-review/
- Ref: 30c73eac2afe762f6aa9c4553158769369d47351
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: allowed
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, filesystem, network
- Quality score: 75
- Public page: https://skillstore.pages.dev/skills/ericdumingtong-code-review
- Manifest: https://skillstore.pages.dev/api/skills/ericdumingtong-code-review/manifest

## Capabilities

- Reviews code for security issues such as injection, SSRF, weak authentication, and secret exposure.
- Checks correctness risks including error handling, null values, boundary cases, and race conditions.
- Identifies performance issues such as N\+1 queries, missing caching, memory growth, and blocking work.
- Evaluates maintainability through readability, SOLID principles, architecture smells, and removal candidates.
- Produces structured findings with severity, location, problem, suggestion, and recommended actions.

## Use Cases

- Review a Pull Request: Analyze changed lines for bugs, security risks, performance regressions, and missing tests before merge.
- Audit Sensitive Code Paths: Check authentication, data access, file handling, and external calls for exploitable weaknesses.
- Improve Maintainability: Find hard-to-change code, unclear structure, duplicate logic, and safe removal candidates.

## Prompt Templates

### Review a Small Snippet

```
Review this snippet for bugs, security issues, and simple readability problems. Focus on the three most important findings.
```

### Review a Pull Request Diff

```
Review this diff as a pull request. Prioritize changed-line risks, regression potential, missing tests, and actionable fixes.
```

### Audit a Security-Sensitive Flow

```
Review this authentication or data-access flow for exploitability and impact. Include concrete fixes for each security finding.
```

### Perform a Full Engineering Review

```
Review this module for security, correctness, performance, tests, maintainability, SOLID concerns, and safe removal opportunities.
```

## Limitations

- Does not run tests or static analyzers unless the host agent performs those actions separately.
- Can only review code that is provided in the prompt or available in the workspace.
- May miss project-specific rules without repository context, threat models, or product requirements.
- The Android UI reference path in SKILL.md appears misspelled, which may reduce UI guidance quality.

## Best Practices

- Provide the relevant diff, file paths, and expected behavior so findings can cite accurate context.
- Ask for a specific review focus when security, performance, or architecture matters most.
- Validate important findings with tests, linters, or domain experts before large refactors.

## Anti Patterns

- Do not treat every suggestion as mandatory without considering product context and risk.
- Do not ask for broad repository review when only a small risky change needs attention.
- Do not skip manual verification for security findings that affect authentication or data access.

## Security Audit

- Audited at: 2026-07-05T14:44:30.286\+00:00
- Summary: All static findings were false positives caused by Markdown inline code, sample snippets, checklist text, XML namespace URLs, and identifier fields. No prompt injection or data exfiltration intent was found. One semantic concern is that the skill instructs agents to save review output to a markdown file, a low-risk workspace side effect.

## Stats

- Views: 88
- Downloads: 16
- Favorites: 0
- Popularity score: 0