code-reviewer
AI Code Review Expert
Also available from: 9tykeshav,DennisLiuCk,AutumnsGrove,CuriousLearner,google-gemini,davila7,9tykeshav,alirezarezvani
This skill provides elite code review capabilities powered by AI, helping developers identify security vulnerabilities, performance issues, and code quality problems before production deployment.
Download the skill ZIP
Upload in Claude
Go to Settings → Capabilities → Skills → Upload skill
Toggle on and start using
Test it
Using "code-reviewer". Review this function for security issues: function getUserData(userId) { const query = `SELECT * FROM users WHERE id = ${userId}`; return db.execute(query); }
Expected outcome:
## Security Review Results
### Critical Issues
**SQL Injection Vulnerability** (Severity: Critical)
- Line 2: User input directly concatenated into SQL query
- Risk: An attacker can inject malicious SQL commands
### Recommended Fix
```javascript
// Use parameterized queries
function getUserData(userId) {
const query = 'SELECT * FROM users WHERE id = ?';
return db.execute(query, [userId]);
}
```
### Additional Recommendations
1. Add input validation for userId
2. Implement proper error handling
3. Consider adding rate limiting
Using "code-reviewer". What are the best practices for reviewing authentication code?
Expected outcome:
## Authentication Code Review Best Practices
### Key Areas to Review
1. **Password Handling**
- Verify password hashing (bcrypt, Argon2)
- Check for proper salt usage
- Ensure secure comparison (timing-safe)
2. **Session Management**
- Session ID generation randomness
- Secure cookie flags (HttpOnly, Secure, SameSite)
- Session timeout configuration
3. **Token-Based Auth**
- JWT algorithm verification (avoid 'none')
- Token expiration policies
- Secure token storage
4. **Multi-Factor Authentication**
- Verify MFA enforcement options
- Check backup codes handling
Security Audit
SafeAll 8 static findings evaluated as false positives. The skill is a legitimate code review assistant that provides guidance on AI-powered code analysis, security vulnerability detection, and performance optimization. No actual external commands, cryptographic code, C2 infrastructure, or network reconnaissance activities are present. The detected patterns were markdown formatting (backticks), compliance acronyms (SOC2, PCI DSS, GDPR), and generic technical terms (pattern, CLI).
Medium Risk Issues (4)
Quality Score
What You Can Build
Pre-commit Code Review
Get AI-assisted review of code changes before committing to catch issues early in the development cycle.
Pull Request Security Analysis
Analyze pull requests for security vulnerabilities, performance issues, and code quality problems.
Technical Debt Assessment
Identify and prioritize technical debt in existing codebases with actionable remediation plans.
Try These Prompts
Review this code snippet for security vulnerabilities, performance issues, and code quality improvements: ``` [PASTE YOUR CODE HERE] ``` Focus on the most critical issues first.
Perform a comprehensive security review of this code. Check for: - Input validation and sanitization - Authentication and authorization issues - SQL injection, XSS, and CSRF vulnerabilities - Secrets and credential exposure - API security patterns Code to review: ``` [PASTE YOUR CODE HERE] ```
Analyze this code for performance issues and optimization opportunities: ``` [PASTE YOUR CODE HERE] ``` Look for: - Database query efficiency (N+1 problems) - Memory leaks and resource management - Caching opportunities - Algorithmic complexity improvements
Review this code change for: 1. Architecture and design pattern adherence 2. Error handling and resilience 3. Testability considerations 4. Documentation completeness 5. Configuration security Code: ``` [PASTE YOUR CODE HERE] ``` Provide a structured assessment with severity ratings.
Best Practices
- Provide specific code examples in feedback rather than generic suggestions
- Prioritize security and production reliability issues above all else
- Balance thorough analysis with practical development velocity considerations
- Focus on teaching and knowledge transfer, not just finding problems
Avoid
- Do not skip security reviews for 'small' or 'internal' changes
- Avoid focusing only on style and formatting over substantive issues
- Do not approve code without understanding the business context and requirements