Code Review

Code Review

Use this skill when the user asks to review a pull request, branch diff, commit, patch, staged changes, unstaged changes, untracked local work, or any code change before merge, commit, deploy, or promotion.

This skill reviews changed code. For whole-repository architecture and quality debt, use a codebase quality audit. For a dedicated threat model or full security scan, use a security review.

Getting Started

First understand what changed and why.

When available, inspect:

• the user's request, PR description, linked issue, ticket, or acceptance criteria
• the current branch, base branch, and whether the workspace is staged, unstaged, or untracked
• the changed files and the relevant unchanged code around them
• tests, migrations, generated files, config, docs, and package or lockfile changes touched by the diff

Prefer existing diff artifacts when the user supplies them. Otherwise compute the smallest truthful diff for the situation, such as staged changes, unstaged changes, a branch against its merge base, or the pasted patch. If there are no git changes, review the files the user named or the files changed earlier in the conversation.

Review Stance

Lead with findings. A review is useful when it catches real risk, not when it proves the reviewer read every line.

Prioritize:

• bugs and behavioral regressions
• user-visible failures
• data loss or data corruption
• missing authorization or privacy leaks
• unsafe handling of secrets, credentials, files, network calls, or external services
• concurrency, ordering, caching, and state bugs
• migration, rollback, deploy, or compatibility hazards
• missing or weak tests for changed behavior
• CI, lint, typecheck, coverage, or workflow weakening
• duplicated or reimplemented logic that should use an existing local abstraction
• complexity that will likely cause future bugs

Do not block on taste, formatting, naming, or broad refactors unless they create real maintainability or correctness risk. If a point is optional, mark it as a nit or mention it after findings.

High-Signal Bug Patterns