Code Review Pro

Deep code analysis covering security, performance, maintainability, and best practices.

When to Use This Skill

Activate when the user:

• Asks for a code review
• Wants security vulnerability scanning
• Needs performance analysis
• Asks to "review this code" or "audit this code"
• Mentions finding bugs or improvements
• Wants refactoring suggestions
• Requests best practice validation

Instructions

1. Security Analysis (Critical Priority)

• SQL injection vulnerabilities
• XSS (cross-site scripting) risks
• Authentication/authorization issues
• Secrets or credentials in code
• Unsafe deserialization
• Path traversal vulnerabilities
• CSRF protection
• Input validation gaps
• Insecure cryptography
• Dependency vulnerabilities

1. Performance Analysis

• N+1 query problems
• Inefficient algorithms (check Big O complexity)
• Memory leaks
• Unnecessary re-renders (React/Vue)
• Missing indexes (database queries)
• Blocking operations
• Resource cleanup (file handles, connections)
• Caching opportunities
• Excessive network calls
• Large bundle sizes

1. Code Quality & Maintainability

• Code duplication (DRY violations)
• Function/method length (should be <50 lines)
• Cyclomatic complexity
• Unclear naming
• Missing error handling
• Inconsistent style
• Missing documentation
• Hard-coded values that should be constants
• God classes/functions
• Tight coupling

1. Best Practices

• Language-specific idioms
• Framework conventions
• SOLID principles
• Design patterns usage
• Testing approach
• Logging and monitoring
• Accessibility (for UI code)
• Type safety
• Null/undefined handling

1. Bugs and Edge Cases

• Logic errors
• Off-by-one errors
• Race conditions
• Null pointer exceptions
• Unhandled edge cases
• Timezone issues
• Encoding problems
• Floating point precision

1. Provide Actionable Fixes

• Show specific code changes
• Explain why change is needed
• Include before/after examples
• Prioritize by severity

Output Format

# Code Review Report

## Critical Issues (Fix Immediately)
### 1. SQL Injection Vulnerability (line X)
**Severity**: Critical
**Issue**: User input directly concatenated into SQL query
**Impact**: Database compromise, data theft

**Current Code:**

const query = SELECT * FROM users WHERE email = '${userEmail}';

**Fixed Code:**

const query = 'SELECT * FROM users WHERE email = ?'; db.query(query, [userEmail]);

**Explanation**: Always use parameterized queries to prevent SQL injection.

## High Priority Issues
### 2. Performance: N+1 Query Problem (line Y)
[Details...]

## Medium Priority Issues
### 3. Code Quality: Function Too Long (line Z)
[Details...]

## Low Priority / Nice to Have
### 4. Consider Using Const Instead of Let
[Details...]

## Summary
- **Total Issues**: 12
  - Critical: 2
  - High: 4
  - Medium: 4
  - Low: 2

## Quick Wins
Changes with high impact and low effort:
1. [Fix 1]
2. [Fix 2]

## Strengths
- Good error handling in X
- Clear naming conventions
- Well-structured modules

## Refactoring Opportunities
1. **Extract Method**: Lines X-Y could be extracted into `calculateDiscount()`
2. **Remove Duplication**: [specific code blocks]

## Resources
- [OWASP SQL Injection Guide](https://...)
- [Performance Best Practices](https://...)

Examples

User: "Review this authentication code" Response: Analyze auth logic → Identify security issues (weak password hashing, no rate limiting) → Check token handling → Note missing CSRF protection → Provide specific fixes with code examples → Prioritize by severity

User: "Can you find performance issues in this React component?" Response: Analyze component → Identify unnecessary re-renders → Find missing useMemo/useCallback → Note large state objects → Check for expensive operations in render → Provide optimized version with explanations

User: "Review this API endpoint" Response: Check input validation → Analyze error handling → Test for SQL injection → Review authentication → Check rate limiting → Examine response structure → Suggest improvements with code samples

Best Practices

• Always prioritize security issues first
• Provide specific line numbers for issues
• Include before/after code examples
• Explain why something is a problem
• Consider the language/framework context
• Don't just criticize—acknowledge good code too
• Suggest gradual improvements for large refactors
• Link to documentation for recommendations
• Consider project constraints (legacy code, deadlines)
• Balance perfectionism with pragmatism
• Focus on impactful changes
• Group similar issues together
• Make recommendations actionable