code-review-expert

Reviews code diffs for logic errors, design quality, security smells, and requirement fidelity with structured verdicts.

Updated Jun 24, 2026
One-click install
npx skills add https://github.com/psmfd/pi-config --skill code-review-expert-psmfd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review-expert
Source: https://github.com/psmfd/pi-config/tree/main/agent/skills/code-review-expert
Command: npx skills add https://github.com/psmfd/pi-config --skill code-review-expert-psmfd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Static analysis tools miss semantic defects like logic errors, race conditions, and requirement mismatches. This Skill provides a read-only review protocol that catches those issues and classifies every finding by severity before merge. ## Core Features & Use Cases - Four review dimensions: logic and correctness, design quality, security patterns (injection, credential exposure, path traversal), and requirement fidelity. - Severity classification: every finding is labeled Critical, Error, Warning, or Info, with a final verdict of PASS, PASS_WITH_WARNINGS, NEEDS_CHANGES, or PRECONDITION_FAILURE. - Ground-truth enforcement: refuses to review from memory; emits PRECONDITION_FAILURE when the cited source path is missing or unreadable. - Use Case: A subagent receives a pull request diff, verifies the source path exists, reads every changed file plus surrounding context, and returns a findings table with file:line references and a merge verdict. ## Quick Start Ask the code-review-expert subagent to review the diff in the current branch against main and return a structured findings table with a verdict.

Frequently Asked Questions about code-review-expert

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for logic errors beyond linting?▼

Use a semantic code review that reads the full diff plus surrounding context, checking off-by-one errors, race conditions, null access, and wrong API usage. Findings are classified by severity with file:line references and a final merge verdict.

What security issues does a code review check for?▼

The review checks injection risks (SQL, command, XSS), hardcoded credentials, path traversal, and authentication or authorization gaps matching OWASP Top 10 patterns. Deep threat modeling and CVE assessment are escalated to a dedicated security review.

Can this review run without access to the actual source files?▼

No. The protocol requires a cited source path that exists and is readable before any review begins. If the path is missing, it emits a PRECONDITION_FAILURE verdict instead of reviewing from memory.

What is the difference between Critical and Warning severity findings?▼

Critical findings involve data loss, security vulnerabilities, or outage risk and must be fixed before merge. Warning findings are code smells or design concerns that should be addressed but do not block merging.

When should findings be escalated to a security review expert?▼

Escalate when a finding warrants full threat modeling, trust-boundary analysis across files outside the diff, cryptographic evaluation, or dependency CVE assessment. The reviewer flags the severity and notes the escalation explicitly.