code-review-pro

Deep code analysis covering security, performance, maintainability, and best practices.

When to Use This Skill

Activate when the user:

• Asks for a code review
• Wants security vulnerability scanning
• Needs performance analysis
• Asks to "review this code" or "audit this code"
• Mentions finding bugs or improvements
• Wants refactoring suggestions
• Requests best practice validation

Instructions

1. Security Analysis (Critical Priority)

   • SQL injection vulnerabilities
   • XSS (cross-site scripting) risks
   • Authentication/authorization issues
   • Secrets or credentials in code
   • Unsafe deserialization
   • Path traversal vulnerabilities
   • CSRF protection
   • Input validation gaps
   • Insecure cryptography
   • Dependency vulnerabilities

2. Performance Analysis

   • N+1 query problems
   • Inefficient algorithms (check Big O complexity)
   • Memory leaks
   • Unnecessary re-renders (React/Vue)
   • Missing indexes (database queries)
   • Blocking operations
   • Resource cleanup (file handles, connections)
   • Caching opportunities
   • Excessive network calls
   • Large bundle sizes

3. Code Quality & Maintainability

   • Code duplication (DRY violations)
   • Function/method length (should be <50 lines)
   • Cyclomatic complexity
   • Unclear naming
   • Missing error handling
   • Inconsistent style
   • Missing documentation
   • Hard-coded values that should be constants
   • God classes/functions
   • Tight coupling

4. Best Practices

   • Language-specific idioms
   • Framework conventions
   • SOLID principles
   • Design patterns usage
   • Testing approach
   • Logging and monitoring
   • Accessibility (for UI code)
   • Type safety
   • Null/undefined handling

5. Bugs and Edge Cases

   • Logic errors
   • Off-by-one errors
   • Race conditions
   • Null pointer exceptions
   • Unhandled edge cases
   • Timezone issues
   • Encoding problems
   • Floating point precision

6. Provide Actionable Fixes

   • Show specific code changes
   • Explain why change is needed
   • Include before/after examples
   • Prioritize by severity

Output Format

# Code Review Report

## Critical Issues (Fix Immediately)
### 1. SQL Injection Vulnerability (line X)
**Severity**: Critical
**Issue**: User input directly concatenated into SQL query
**Impact**: Database compromise, data theft

**Current Code:**
```javascript
const query = `SELECT * FROM users WHERE email = '${userEmail}'`;

Fixed Code:

const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [userEmail]);

Explanation: Always use parameterized queries to prevent SQL injection.

High Priority Issues

2. Performance: N+1 Query Problem (line Y)

[Details...]

Medium Priority Issues

3. Code Quality: Function Too Long (line Z)

[Details...]

Low Priority / Nice to Have

4. Consider Using Const Instead of Let

[Details...]

Summary

• Total Issues: 12
  • Critical: 2
  • High: 4
  • Medium: 4
  • Low: 2

Quick Wins

Changes with high impact and low effort:

1. [Fix 1]
2. [Fix 2]

Strengths

• Good error handling in X
• Clear naming conventions
• Well-structured modules

Refactoring Opportunities

1. Extract Method: Lines X-Y could be extracted into calculateDiscount()
2. Remove Duplication: [specific code blocks]

Resources

• OWASP SQL Injection Guide
• Performance Best Practices

## Examples

**User**: "Review this authentication code"
**Response**: Analyze auth logic → Identify security issues (weak password hashing, no rate limiting) → Check token handling → Note missing CSRF protection → Provide specific fixes with code examples → Prioritize by severity

**User**: "Can you find performance issues in this React component?"
**Response**: Analyze component → Identify unnecessary re-renders → Find missing useMemo/useCallback → Note large state objects → Check for expensive operations in render → Provide optimized version with explanations

**User**: "Review this API endpoint"
**Response**: Check input validation → Analyze error handling → Test for SQL injection → Review authentication → Check rate limiting → Examine response structure → Suggest improvements with code samples

## Best Practices

- Always prioritize security issues first
- Provide specific line numbers for issues
- Include before/after code examples
- Explain *why* something is a problem
- Consider the language/framework context
- Don't just criticize—acknowledge good code too
- Suggest gradual improvements for large refactors
- Link to documentation for recommendations
- Consider project constraints (legacy code, deadlines)
- Balance perfectionism with pragmatism
- Focus on impactful changes
- Group similar issues together
- Make recommendations actionable