Super Reviewer - AI Senior Code Review Engine

> The most comprehensive AI code review skill. One skill replaces 10+ specialized review tools.

Why This Skill?

Most code review skills only check one dimension (style or security). Super Reviewer performs a 7-dimensional holistic review that mimics how a senior staff engineer reviews code in production:

1. Correctness - Logic bugs, null/undefined handling, edge cases, race conditions
2. Security - OWASP Top 10, injection attacks, auth bypasses, data exposure
3. Performance - N+1 queries, unnecessary re-renders, memory leaks, algorithm complexity
4. Code Style - Naming conventions, consistency, readability, DRY principle
5. Architecture - SOLID principles, coupling/cohesion, design patterns
6. Testing - Test coverage gaps, missing edge case tests, test quality
7. Accessibility - WCAG 2.1 AA compliance, keyboard navigation, screen reader support

Quick Start

No setup needed. Simply say any of:

• "Review this code/PR"
• "Check this file for issues"
• "Do a security audit on..."
• "Review this code for performance"

The skill auto-detects language and framework.

Review Process

Phase 1: Context Analysis

1. Read all changed files in the PR/diff
2. Detect programming languages and frameworks used
3. Identify affected modules, APIs, and data flows
4. Check for existing tests related to changes

Phase 2: Multi-Dimensional Scan

For each changed file, run ALL of the following checks:

2.1 Correctness Check

• Null/undefined dereferences and missing null checks
• Off-by-one errors in loops and array indexing
• Unhandled promise rejections and async/await errors
• Incorrect boolean comparisons (== vs ===, assignment in conditions)
• Missing return statements in conditional branches
• Floating point precision issues
• String encoding problems
• Date/time zone handling errors
• Integer overflow in mathematical operations

2.2 Security Check (OWASP-aligned)

• Injection: SQL injection, NoSQL injection, command injection, XSS, template injection
• Auth: Hardcoded credentials, missing auth checks, insecure token handling
• Data: Sensitive data in logs, PII exposure, insecure data storage
• Crypto: Weak hash algorithms, missing salt, predictable random values
• Network: Missing rate limiting, CORS misconfiguration, open redirects
• Dependencies: Known vulnerable packages, outdated dependencies
• File ops: Path traversal, insecure file uploads, directory listing

2.3 Performance Check

• Database: N+1 queries, missing indexes hints, unnecessary JOINs
• Frontend: Unnecessary re-renders, missing memoization, large bundle imports
• Memory: Memory leaks in closures, event listeners, large object retention
• Algorithm: O(n^2) where O(n) possible, unnecessary sorting, redundant iterations
• I/O: Missing pagination, no streaming for large files, synchronous blocking calls
• Caching: Missing cache for expensive operations, stale cache, cache stampede

2.4 Code Style Check

• Naming conventions per language ecosystem (camelCase, snake_case, PascalCase)
• File and folder organization consistency
• Import ordering and unused imports
• Function/method length (flag > 50 lines)
• Cyclomatic complexity (flag > 10)
• Magic numbers and strings (suggest constants/enums)
• TODO/FIXME/HACK comments tracking

2.5 Architecture Check

• SOLID principle violations
• God objects/classes (flag > 500 lines, > 20 methods)
• Circular dependencies
• Leaky abstractions
• Missing dependency injection
• Tight coupling between modules
• Violation of separation of concerns

2.6 Testing Check

• Changed code without corresponding test changes
• Missing edge case tests identified in correctness check
• Test assertions that are too broad (e.g., expect(true).toBe(true))
• Missing negative test cases
• Test coverage gaps in critical paths

2.7 Accessibility Check (for UI code only)

• Missing alt text on images
• Inadequate color contrast ratios
• Missing ARIA labels on interactive elements
• Keyboard navigation gaps
• Improper heading hierarchy
• Missing form labels and error messages
• Screen reader compatibility issues

Phase 3: Report Generation

Generate a structured review report using the following format:

## Code Review Report

### Summary
- Files reviewed: X
- Critical issues: X | Warnings: X | Suggestions: X
- Overall assessment: [APPROVE / REQUEST_CHANGES / COMMENT]

### Critical Issues (Must Fix)

#### [SEC-001] SQL Injection Vulnerability (Line 42)
**File**: `src/api/users.ts`
**Severity**: CRITICAL
**Description**: User input `req.body.name` is directly interpolated into SQL query without sanitization.
**Impact**: An attacker could read, modify, or delete any data in the database.
**Fix**:

// Before (vulnerable) const query = SELECT * FROM users WHERE name = '${req.body.name}'; // After (safe) const query = 'SELECT FROM users WHERE name = ?'; db.query(query, req.body.name]);

#### [PERF-001] N+1 Query Problem (Line 78-85)
**File**: `src/services/order.ts`
**Severity**: WARNING
**Description**: Inside a loop, individual queries fetch user data for each order.
**Impact**: With 1000 orders, this generates 1000+ database queries instead of 1.
**Fix**: Use JOIN or batch loading with `IN` clause.

### Warnings (Should Fix)
...

### Suggestions (Nice to Have)
...

### Positive Highlights
- Good error handling in `src/utils/validation.ts`
- Proper use of TypeScript generics in repository pattern
- Comprehensive test coverage for payment module (95%)

Phase 4: Severity Classification

Use these strict severity levels:

| Level | Color | Meaning | Action Required | |-------|-------|---------|----------------| | CRITICAL | Red | Security vulnerability, data loss risk, crash bug | MUST fix before merge | | WARNING | Yellow | Performance issue, potential bug, bad practice | SHOULD fix before merge | | INFO | Blue | Style improvement, readability suggestion | Consider fixing |

Phase 5: Quick Fix Suggestions

For each issue, always provide:

1. The problematic code (exact line reference)
2. Why it's a problem (clear explanation)
3. The fixed code (copy-paste ready)
4. Prevention tip (how to avoid in the future)

Framework-Specific Rules

React / Next.js

• Check for missing key props in lists
• Detect stale closure bugs in useEffect
• Flag missing dependency array entries
• Check for prop drilling (suggest Context or Zustand)
• Verify useMemo/useCallback usage for expensive operations
• Check Server Component vs Client Component boundaries

Vue / Nuxt

• Check reactive data declaration (ref vs reactive vs computed)
• Detect v-if + v-for on same element (anti-pattern)
• Check for proper cleanup of watchers and event listeners
• Verify composables follow naming convention (use*)
• Check Pinia store mutations pattern

Node.js / Express

• Check for proper error middleware usage
• Detect missing input validation
• Check for proper async error handling
• Verify rate limiting on sensitive endpoints
• Check for helmet, cors security headers

Python / Django / FastAPI

• Check for SQL injection in ORM raw queries
• Detect missing migration files
• Check for proper serializer validation
• Verify middleware ordering
• Check for proper virtual environment usage

Go

• Check for proper error handling (no bare err ignores)
• Detect goroutine leaks
• Check for context propagation
• Verify mutex usage patterns
• Check for proper defer/panic/recover usage

Anti-Patterns Database

The skill maintains an internal database of 200+ known anti-patterns across languages, including:

• JavaScript: Callback hell, implicit type coercion, prototype pollution
• TypeScript: Any abuse, type assertion overuse, missing return types
• Python: Mutable default arguments, global state, bare except
• Java: God class, feature envy, data class without equals/hashCode
• Go: Global mutable state, goroutine leak, interface pollution
• Rust: Unnecessary unwrap, unsafe block abuse, cloning large types

Output Control

By default, generate a full report. User can request:

• "brief review" - Only critical and warning issues
• "security only" - Only security dimension
• "performance only" - Only performance dimension
• "explain like I'm junior" - Simpler explanations with more context

Integration Notes

This skill works with any AI coding agent that supports the SKILL.md standard:

• Claude Code, Codex CLI, Cursor, Windsurf, GitHub Copilot
• CodeBuddy, OpenClaw, and any compatible agent
• No external dependencies required - all rules are embedded in this skill