SuperAPI AI Directory
Partner中文AI newsFavorites
Skillscode-reviewer

code-reviewer

Testing & quality

View repository

Updated 10-15 20:04

About this skill

Code Reviewer

A comprehensive automated code review SKILL that systematically analyzes security issues, quality metrics, performance problems, and best practice compliance.

Purpose

This SKILL combines automated analysis tools and expert guides to provide a structured code review workflow that identifies issues in terms of security, quality, performance, and maintainability.

When to Use This Skill

Use this SKILL in the following cases:

  • When reviewing a pull request or code submission
  • When performing a security audit on an existing codebase
  • When evaluating code quality before deployment
  • When identifying technical debt and refactoring opportunities
  • When establishing code review standards for a team
  • When learning what to look for in a code review

Core Review Workflow

Phase 1: Initial Analysis

1.1 Understanding the Context

  • Read the PR description or change summary.
  • Identify the type of change (feature, bug fix, refactoring, security patch).
  • Determine the scope and affected components.
  • Check whether there are related issues or tickets.

1.2 Understanding the Code Overview

  • Review file changes and additions/deletions.
  • Identify changed modules and their relationships.
  • Look for unexpected changes or scope creep.
  • Check whether there are breaking changes.

Phase 2: Security Review

2.1 Common Vulnerability Patterns

Check for the following critical security issues:

Input Validation

  • Check whether unvalidated user input reaches sensitive operations
  • SQL injection vulnerabilities
  • Command injection possibilities
  • Path traversal attacks
  • XML/XXE injection points

Authentication & Authorization

  • Missing authentication checks
  • Broken access control
  • Insecure password storage
  • Weak session management
  • Missing CSRF protection

Data Exposure

  • Hardcoded credentials or API keys
  • Whether sensitive data is included in logs
  • Improper encryption
  • Information exposure through error messages
  • Exposed configuration files

Code Injection

  • Insecure deserialization
  • Template injection
  • Code evaluation caused by user input
  • Insecure use of reflection

2.2 Automated Security Scanning

Use security analysis tools:

Python:

# 보안 이슈를 위해 bandit 실행
python scripts/review_helper.py --security-scan path/to/code

# 알려진 취약점에 대해 종속성 체크
safety check
pip-audit

JavaScript/Node.js:

# 취약점 체크
npm audit
yarn audit

# ESLint 보안 플러그인 사용
eslint --plugin security path/to/code

Go:

# 보안 스캐닝
gosec ./...

For detailed vulnerability patterns, see references/security_patterns.md.

Phase 3: Code Quality Analysis

3.1 Code Structure

Modularity & Organization

  • Compliance with the Single Responsibility Principle
  • Appropriate separation of concerns
  • Appropriate level of abstraction
  • Clear module boundaries
  • Logical file organization

Complexity Metrics

  • Cyclomatic complexity (Goal: < 10 per function)
  • Function length (Goal: < 50 lines)
  • Class size (Goal: < 300 lines)
  • Nesting depth (Goal: < 4 levels)
  • Number of parameters (Goal: < 5)

Code Smells

  • Duplicate code
  • Methods that are too long or God class
  • Feature envy (a method uses another class more)
  • Data clumps (repeated parameter groups)
  • Primitive obsession
  • Inappropriate intimacy between classes

3.2 Naming and Readability

Naming Conventions

  • Descriptive names that reveal intent
  • Consistent naming patterns
  • Appropriate length (not too short or too long)
  • Avoid abbreviations unless standard
  • Boolean names start with is/has/should/can

Code Clarity

  • Clear control flow
  • Minimize cognitive load
  • Self-documenting code
  • Appropriate comments (focus on Why, not What)
  • Consistent formatting

3.3 Error Handling

Robustness

  • Appropriate exception handling
  • Avoid empty except/catch blocks
  • Appropriate error messages
  • Resource cleanup (File handles, connections)
  • Graceful degradation

Edge Cases

  • Null/None checks
  • Handling empty collections
  • Boundary conditions
  • Concurrent access issues
  • Preventing race conditions

Phase 4: Performance Review

4.1 Common performance issues

Algorithm Efficiency

  • Using algorithms of O(n²) or worse when better alternatives exist
  • Unnecessary loops or iterations
  • Using inefficient data structures
  • Missing memoization/caching opportunities

Resource Management

  • Memory leaks
  • Unclosed file handles or connections
  • Excessive memory allocation
  • Thread/process pool exhaustion

Database Operations

  • N+1 query problem
  • Missing indexes
  • Using SELECT *
  • Inefficient JOIN operations
  • Missing query optimization

Network Calls

  • Synchronous blocking calls
  • Missing timeout settings
  • Absence of retry logic
  • Excessive API calls
  • Missing connection pooling

For optimization strategies, refer to references/performance_guide.md.

Phase 5: Testing Assessment

5.1 Test Coverage

Coverage Metrics

  • Line coverage (Goal: > 80%)
  • Branch coverage (Goal: > 75%)
  • Function coverage (Goal: > 90%)
  • Critical path coverage (Goal: 100%)

Test Quality

  • Verify that tests actually assert meaningful behavior
  • Verify that tests are independent and isolated
  • Verify that test names clearly describe what is being tested
  • Appropriate use of Mocks and Stubs
  • Absence of interdependencies between tests

5.2 Test Completeness

Required test types

  • Unit tests for business logic
  • Integration tests for component interactions
  • Edge case and boundary tests
  • Error condition tests
  • Security-related tests

Missing tests

  • Untested error paths
  • Missing negative test cases
  • Uncovered edge conditions
  • Absence of regression tests for bug fixes

Phase 6: Documentation Review

6.1 Code documentation

Document functions/methods

  • Describe purpose and behavior
  • Describe parameters including types
  • Document return values
  • Document exceptions
  • Usage examples for complex APIs

Document modules/classes

  • High-level purpose
  • Architecture overview
  • Design decisions
  • Dependencies
  • Public API contracts

6.2 External documentation

Update README

  • Installation instructions
  • Configuration changes
  • Document new features
  • Announce breaking changes
  • Migration guide

API Documentation

  • Endpoint descriptions
  • Request/response formats
  • Authentication requirements
  • Error responses
  • Rate limiting

Review Checklist

Use this checklist for a comprehensive review:

Security

  • No hardcoded credentials or secrets
  • Perform input validation on all user input
  • Proper authentication and authorization
  • No SQL/command injection vulnerabilities
  • Secure password handling
  • Use HTTPS/TLS for sensitive data
  • Security scanning tools have been run
  • Dependency vulnerability check completed

Code Quality

  • Functions follow the Single Responsibility Principle
  • Cyclomatic complexity is less than 10
  • No code duplication
  • Consistent naming conventions followed
  • Appropriate error handling
  • No TODO/FIXME without a ticket number
  • Code is self-documenting

Performance

  • No obvious performance bottlenecks
  • Use efficient algorithms and data structures
  • Proper resource cleanup
  • Database queries optimized
  • No N+1 query issues
  • Appropriate caching strategy used

Testing

  • Tests included for new features
  • Edge cases covered
  • Test coverage meets standards
  • Tests are independent and repeatable
  • No flaky tests introduced

Documentation

  • Public API is documented
  • Complex logic is explained
  • README updated when necessary
  • Breaking changes documented
  • Migration guide provided when necessary

Using the Review Helper Script

scripts/review_helper.pyprovides automated analysis:

# 전체 코드 리뷰 분석
python scripts/review_helper.py --file path/to/file.py --report full

# 보안 중심 스캔
python scripts/review_helper.py --security-scan path/to/directory

# 복잡도 분석
python scripts/review_helper.py --complexity path/to/file.py

# 리뷰 보고서 생성
python scripts/review_helper.py --file path/to/file.py --output report.md

Best Practices

Advice for reviewers (For Reviewers)

Be constructive

  • Focus on improvement, not criticism.
  • Explain the "Why" behind the suggestion.
  • Suggest alternatives or solutions.
  • Praise good code and patterns.

Be Thorough but Efficient

  • Use automated tools for repetitive checks.
  • Focus human review on logic and design.
  • Don't obsess over style (use a Linter).
  • Prioritize security and correctness over style.

Be Consistent

  • Apply the same standards to all code.
  • Refer to team coding standards.
  • Create reusable review templates.
  • Document common feedback patterns.

For Code Authors

Preparing for Review

  • Self-review before requesting a review.
  • Run the Linter and formatter.
  • Run the test suite.
  • Add context to the PR description.
  • Keep changes small and focused.

Responding to Feedback

  • Respond to every comment.
  • Ask questions when unclear.
  • Don't take feedback personally.
  • Mark completed conversations as Resolved.

Common Review Feedback Patterns

Security Issues

❌ Security: 하드코딩된 API key 발견
→ 환경 변수 또는 secret management로 이동하세요.
→ 참고: references/security_patterns.md#secrets-management

❌ Security: SQL injection 취약점
→ 문자열 연결 대신 파라미터화된 쿼리를 사용하세요.
→ 예시: cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

Quality Issues

❌ Quality: 함수의 복잡도가 너무 높음 (complexity: 15)
→ 더 작고 집중된 기능의 함수들로 나누세요.
→ 목표: < 10 cyclomatic complexity

❌ Quality: 3개 위치에서 중복 코드 발견
→ 공통 로직을 공유 함수로 추출하세요.
→ DRY 원칙 위반

Performance Issues

❌ Performance: N+1 query 문제 탐지됨
→ JOIN 또는 eager loading을 사용하세요.
→ 참고: references/performance_guide.md#database-optimization

❌ Performance: 비효율적인 O(n²) 알고리즘
→ O(1) 조회를 위해 set/hash 사용을 고려하세요.
→ 현재: 중첩 루프, 권장: set intersection

Additional Resources

  • Security Patterns: references/security_patterns.md - Common vulnerabilities and how to fix them
  • Performance Guide: references/performance_guide.md - Optimization strategies
  • Review Checklist: examples/review_checklist.md - Comprehensive review templates
  • Helper Scripts: scripts/review_helper.py - Automated analysis tools

Language-Specific Considerations

Python

  • Check for proper use of Context managers (with statement)
  • Check that List comprehension is not overly complex
  • Explore opportunities to use Generators
  • Check for Mutable default arguments

JavaScript/TypeScript

  • Check for proper use of async/await
  • Check for Callback hell
  • Check for memory leaks in Event listeners
  • Check for proper Typing in TypeScript

Java

  • Check for proper Exception handling
  • Check for resource cleanup (try-with-resources)
  • Check for proper use of Immutability
  • Check for Thread safety issues

Go

  • Check for proper Error handling (do not ignore errors)
  • Check whether Goroutine leaks are prevented
  • Check for Race conditions
  • Check for proper Context usage

Conclusion

Effective code review is achieved when automated tools and human expertise are combined. Use automated tools for mechanical checks (security, style, complexity), and focus human review on logic, design, and maintainability. Always aim for constructive, thorough, and consistent reviews.