Skills: Code Review Skills
Last updated: 2026-08-31
Code review is the first line of defense for quality — an excellent review Skill is like having a tireless senior reviewer on the team.
1. Review Dimension Design
(1) Core Review Dimensions
| Dimension | Check Items | Severity |
|---|---|---|
| Security | SQL injection, XSS, hardcoded keys, insecure dependencies | 🔴 Critical |
| Performance | N+1 queries, memory leaks, unnecessary loops | 🟡 Important |
| Readability | Naming conventions, function length, comment sufficiency | 🟢 Suggestion |
| Best Practices | Error handling, SOLID principles, DRY | 🟡 Important |
| Test Coverage | Unit tests, boundary conditions, exception paths | 🟡 Important |
(2) Language-Specific Dimensions
MARKDOWN
## Python Additional Checks
- Type hints completeness
- Docstring format (Google/NumPy style)
- f-string vs format/concat
- Exception catch scope (avoid bare except)
## TypeScript Additional Checks
- any type usage
- Type assertion reasonableness
- Interface definition completeness
- Optional property annotations
2. Review Process Design
(1) Standard Process
TEXT
📖 Display only
Code Review Process
├── 1. Collect Changes
│ ├── Read git diff (changed file list)
│ └── Determine review scope
├── 2. File-by-File Review
│ ├── Read file contents
│ ├── Grep for related context
│ └── Check across dimensions
├── 3. Output Report
│ ├── Sort by severity
│ ├── Provide specific fix suggestions
│ └── Include code examples
└── 4. Summary Assessment
├── Overall score
└── Merge recommendation
(2) Incremental vs Full Review
| Type | Scope | Use Case |
|---|---|---|
| Incremental Review | Only review changed parts | PR/MR review |
| Full Review | Review entire module | New developer code review, post-refactor verification |
3. Review Report Format
(1) Standard Output Template
MARKDOWN
## Code Review Report
### 📊 Overview
- Files reviewed: 3
- Issues found: 5 (🔴 1 / 🟡 2 / 🟢 2)
- Overall score: 7/10
- Recommendation: ⚠️ Merge after fixing critical issues
### 🔴 Critical Issues
**[SEC-001] SQL Injection Risk**
📍 Location: src/auth/login.py:42
📝 Using string concatenation to build SQL query
✅ Suggestion:
```python
query = "SELECT * FROM users WHERE name = ?"
cursor.execute(query, (username,))
🟡 Important Issues
...
🟢 Improvement Suggestions
...
### (2) Scoring System
```text
Scoring rules:
- 🔴 Critical issue: -3 points each
- 🟡 Important issue: -1 point each
- 🟢 Suggestion: -0.5 points each
- Base score: 10 points
- Minimum score: 0 points
Merge recommendation:
- ≥ 8 points: ✅ Recommend merge
- 5-7 points: ⚠️ Merge after fixes
- < 5 points: ❌ Do not recommend merge
4. Review Skill Practice
▶ Example: Full-Dimension Review Skill
Alice created a standardized review Skill for the team:
YAML
---
name: full-review
description: "Full-dimension code review"
triggers:
- keyword: "full-review"
tools:
- Read
- Grep
- Glob
- Bash
---
MARKDOWN
## Review Process
1. Glob to determine file scope for review
2. For each file, check by dimension:
- Security: Grep for dangerous patterns
- Performance: Read to analyze algorithm complexity
- Readability: Check naming and structure
- Tests: Confirm test coverage
3. Aggregate and output review report
Bob commented: "Standardized reports make review results clear at a glance — red must be fixed, yellow depends, green is nice-to-have."
❓ FAQ
Q Will overly strict reviews slow down development?
A Yes. We recommend two tiers — PR reviews only check security and critical logic; periodic full reviews cover all dimensions.
Q Can AI review replace manual review?
A Not entirely. AI excels at pattern matching and security scanning; humans excel at architecture review and business logic judgment. The two complement each other best.
Q How to avoid overly long review reports?
A Set severity filtering; default output only 🟡 and above issues. 🟢 suggestions are optional output.
📖 Summary
- Five review dimensions: Security, Performance, Readability, Best Practices, Test Coverage
- Standard process: Collect changes → File-by-file review → Output report → Summary assessment
- Report format: Overview + graded issues + score + merge recommendation
- Scoring system: 10-point scale, deductions by issue severity
📝 Exercises
- Basic (⭐): Create a security review Skill that only checks SQL injection, XSS, and hardcoded keys.
- Intermediate (⭐⭐): Create a full-dimension review Skill that outputs a standard review report with scoring and merge recommendation.
- Advanced (⭐⭐⭐): Create an incremental review Skill that only reviews changes in git diff, and automatically adjusts review dimensions by language.
