review-python

Skill: Review Python

Purpose

Only review the code in Python for the language and runtime conventions. Do not define scope (diff vs codebase) or perform security/architecture analysis; these are handled by the scope and cognitive skills. Emit in the standard formatresult listfor aggregation. Focus on type hints, exception handling, async/await patterns, context managers, dependency management, and testability.

Core Objective

Primary objective: Generate a Python language/runtime result list covering type hints, exception handling, async/await patterns, context managers, dependency management, naming conventions, and testability for the given code scope.

Success criteria(all requirements must be met):

✅ Python-only scope: Only review Python language and runtime conventions; no scope selection, security, or architecture analysis performed
✅ Covers all eight Python dimensions: type hints, exception handling, async/await, context managers, dependency management, mutable defaults, naming conventions (PEP8), and testability are evaluated (if relevant)
✅ Result format compatible: each result includes location, category (language-python), severity, title, description, and optional recommendation
✅ File:line references: all findings reference specific file locations with line numbers
✅ Exclude non-Python code: Python-specific rules are not analyzed for non-Python files unless explicitly in scope

Acceptance test: Does the output contain a Python-centric result list with file:line references covering all relevant language/runtime dimensions without performing security, architecture, or scope analysis?

Scope boundaries (Scope boundaries)

This skill is responsible for：

Type hints (typing module,Optional、Union, generics)
Exception handling (specific exceptions, "raise ... from", no bare "except:", "try/finally")
Async/await patterns (async functions, blocking calls in async contexts,asyncio.gather）
Context managers (withstatements,__enter__/__exit__、@contextmanager）
Dependency management (pinned dependencies, avoid "import *", virtual environments)
Mutable default arguments (avoiddef foo(a=[]):）
PEP8 naming conventions (snake_case, PascalCase, SCREAMING_SNAKE_CASE)
Testability (global state avoidance, DI, mock-friendly design)

This skill is not responsible for：

Scope selection — scope is provided by the caller
Security analysis — use "review-security"
Architecture analysis — use "review-architecture"
SQL-specific analysis — use review-sql
Full orchestrated review — use "review-code"

Handoff point: When all Python findings are published, hand them to orchestrate-code-review for aggregation. For security issues (injection, authentication), note them and recommend "review-security".

Use cases (Use cases)

Orchestrated review: when orchestrate-code-review When running a Python project's scope -> language -> framework -> library -> cognitive, used as the language step.
Python-only review: when the user only wants to check language/runtime conventions (for example, after adding a new Python file).
Pre-PR Python checklist: ensure type hints, exception handling, and async patterns are correct.

When to use: when the code being reviewed is Python and the task includes language/runtime quality. The scope (diff vs path) is determined by the caller or user.

Behavior (behavior)

The scope of this skill

Analyze：Given code scopePython language and runtime conventions in (files or diff provided by the caller). Does not decide scope; accepts code scope as input.
Do not: perform scope selection (diff vs codebase), security review, or architecture review; unless explicitly in scope, do not check Python-specific rules in non-Python files.

Review checklist (Python-only dimensions)

Type hints: for complex types use the typing module, avoid Anyas much as possible, use Optional[T] instead of T |对于 Python <3.10，无, correctly use Union、List、Dict、Callable and generic type hints.
Exception handling: catch specific exceptions, avoid bare except:, useraise ... fromfor exception chaining, avoid swallowing exceptions without logging, correctly usetry/finally。
Async/await: correctly useasync defandawait, avoid blocking calls in async functions, correct exception handling in async contexts, useasyncio.gather，asyncio.create_taskto achieve concurrency.
Context managers: usewithstatements for resource management, implement__enter__/__exit__or use@contextmanager, avoid manual open/close.
Dependency management: pin dependencies in需求.txtorpyproject.toml, avoidimport *, use virtual environments, correctly usesys.pathoperations.
Mutable default values: avoid mutable default arguments (for example def foo(a=[]):), use None and initialize inside the function.
Naming conventions: follow PEP8 (snake_case for functions/variables, PascalCase for classes, SCREAMING_SNAKE_CASE for constants).
Testability: avoid global state, use dependency injection, mock external services, avoid tight coupling.

Tone and references

Professional and technical: reference specific locations (file:line). Emit findings containing location, category, severity, title, description, recommendation.

Input & Output (Input & Output)

Input (input)

Code scope: the file or directory (or diff) already selected by the user or scope skill. This skill does not decide scope; it only checks the language conventions of the provided Python code.

Output (output)

inAppendix: Output contractemit zero or more in the format defined infindings。
The category of this skill islanguage-python。

Limits (Restrictions)

Hard Boundaries

Do notperform security, architecture, or scope selection. Follow Python language and runtime conventions.
Do notgive conclusions without specific locations or actionable advice.
Do notcheck Python-specific rules for non-Python code unless the user explicitly includes it (for example, embedded code snippets).

Skill Boundaries

Do not do these(other skills can handle them):

Do not select or define code scope - scope is determined by the caller or "review code"
Do not perform security analysis - use "review-security"
Do not perform architecture analysis - use "review-architecture"
Do not perform comprehensive SQL analysis — use review-sql

When to stop and hand off：

When all Python findings are published, hand them off to "orchestrate-code-review" for aggregation
When the user needs a comprehensive review (scope + language + cognitive), redirect to "review code"
When security issues are found (for example SQL injection, command injection), note them and suggest review-security

Self-Check

Core success criteria

Python-only scope: only review Python language and runtime conventions; scope selection, security, or architecture analysis is not performed
Covers all eight Python dimensions: type hints, exception handling, async/await, context managers, dependency management, mutable defaults, naming conventions (PEP8), and testability (if relevant) are evaluated
Result format compatible: each result includes location, category (language-python), severity, title, description, and optional recommendation
file:line references: all results reference a specific file location with a line number
Exclude non-Python code: Python-specific rules are not analyzed for non-Python files unless explicitly in scope

Process quality checks

Were only Python language/runtime dimensions reviewed (no scope/security/architecture)?
Were relevant type hints, exception handling, async patterns, context managers, and testability covered?
Does each finding include location, category=language-python, severity, title, description, and optional recommendation?
Does file:line reference the issue?

Acceptance tests

Does the output contain a Python-focused findings list with file:line references covering all relevant language/runtime dimensions, without performing security, architecture, or scope analysis?

Examples

Example 1: Mutable default argument

Input：def foo(items=[]):
Expected: emit a finding for a mutable default argument; recommend using "None" and initializing internally. Category = language-python.

Example 2: except

Input：除了：通过
Expected: the output finding requires catching a specific exception type; reference the bare except clause. Category = language-python.

Example 3: Async blocking call

Input: Inside async functionsasync def fetch(): requests.get(url)。
Expected: Emit findings using "aiohttp" or "httpx"; cite blocking calls. Category = language-python.

Edge case: Python and SQL mixed

Input: A Python file with embedded SQL strings used for database queries.
Expected: Only look at Python conventions (type hints, exception handling). Do not emit SQL injection findings; that is for review-security or review-sql.