skills.rest
zhizhunbao
zhizhunbaoCOMMUNITY
Explore all skills by this author →
GitHub

code-reviewer

Review code changes for security vulnerabilities, quality issues, and best practice violations.

1|2|Updated Mar 5, 2026
Search Tags:#code quality#static analysis#code review#best practices#pull request#security#python
One-click install
npx skills add https://github.com/zhizhunbao/textbook-rag --skill code-reviewer-zhizhunbao
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-reviewer
Source: https://github.com/zhizhunbao/textbook-rag/tree/main/.agent/skills/dev-code_reviewer
Command: npx skills add https://github.com/zhizhunbao/textbook-rag --skill code-reviewer-zhizhunbao

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Reviewing pull requests and uncommitted changes manually is time-consuming and inconsistent, often missing security vulnerabilities, performance issues, and code quality problems across TypeScript, JavaScript, Python, Go, Swift, and Kotlin codebases. ## Core Features & Use Cases - Automated Code Analysis: Run PR analysis, code quality checks, and review report generation through dedicated Python scripts. - Security & Quality Checklists: Apply structured review criteria covering hardcoded secrets, SQL injection, XSS, function size, nesting depth, and immutability patterns. - Reference Guides: Consult detailed documentation on coding standards, design patterns, performance optimization, and security guidelines during reviews. - Use Case: Before merging a pull request, run the quality checker against the changed files, then follow the review checklist to classify findings by severity (CRITICAL, HIGH, MEDIUM, LOW) and generate a structured review report. ## Quick Start Review my uncommitted changes for security vulnerabilities and code quality issues, then generate a severity-classified report.

Frequently Asked Questions about code-reviewer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request for security vulnerabilities?▼

Run the PR analyzer script against the target path, then apply the security checklist covering hardcoded credentials, SQL injection, XSS, missing input validation, and insecure dependencies. Findings are classified as CRITICAL, HIGH, MEDIUM, or LOW severity.

What code quality checks should run before merging code?▼

Check for functions over 50 lines, files over 800 lines, nesting deeper than 4 levels, missing error handling, console.log statements, and unresolved TODO comments. Use ruff and mypy for Python, and lint plus type-check commands for TypeScript.

Which programming languages does this code review support?▼

The review guidelines cover TypeScript, JavaScript, Python, Go, Swift, and Kotlin. Reference documentation includes code examples primarily in Python and TypeScript, with standards applicable across the supported languages.

How do I prevent SQL injection in Python code?▼

Use parameterized queries instead of string concatenation or f-strings in SQL statements. Pass user values as query parameters, for example cursor.execute with a placeholder and tuple, so the database driver handles escaping safely.

When should a code review block a merge?▼

Block the merge when CRITICAL or HIGH severity issues are found, such as hardcoded secrets, injection vulnerabilities, or missing error handling. MEDIUM-only findings allow merging with caution, and clean reviews are approved.

Related Skills

Explore More Software Engineering Skills→
CivicActionsCivicActions
2

organize-commits

Group unstaged changes into atomic git commits using project conventions.

Official
Intermediate
yersonargotevyersonargotev
1

code-review-and-quality

Reviews code changes across correctness, readability, architecture, security, and performance axes before merge.

Community
Intermediate
genlayerlabsgenlayerlabs
10

verify

Run lint, typecheck, tests, build, and npm audits for the intelligent-oracle project.

Official
Intermediate
EngineerWithAIEngineerWithAI
4

sast-configuration

Configure Semgrep, SonarQube, and CodeQL for automated vulnerability detection.

Official
Intermediate