---
name: review
description: AI-powered code review with security, performance, and maintainability analysis
---

# Code Review Skill

## Description

This skill provides comprehensive code review capabilities combining static analysis, security scanning, and AI-powered suggestions. It analyzes code for bugs, security vulnerabilities, performance issues, and maintainability concerns.

## When to Use

- Before merging pull requests
- After implementing new features
- When reviewing unfamiliar code
- To check for security vulnerabilities
- To ensure code quality standards

## Commands

```
/review                      # Review all changed files
/review <file>               # Review a specific file
/review --security           # Focus on security issues
/review --diff               # Review only changed lines
/review --report             # Generate detailed report
```

## How to Use

### Step 1: Run Review

Execute a review on your code:

```
/review src/auth/login.py
```

### Step 2: Examine Results

Results are categorized by severity:
- **CRITICAL**: Must fix before merge (security vulnerabilities, data loss risk)
- **HIGH**: Should fix (potential bugs, security concerns)
- **MEDIUM**: Consider fixing (code quality issues)
- **LOW**: Nice to have (style, minor improvements)
- **INFO**: Informational (documentation, TODOs)

### Step 3: Address Issues

Review suggestions and apply fixes:
- Security issues should be addressed immediately
- High severity issues should block merges
- Medium/low issues can be tracked for later

## Review Categories

### Security (OWASP Top 10)
- SQL Injection
- Command Injection
- XSS vulnerabilities
- Hardcoded secrets
- Insecure deserialization
- Weak cryptography
- Path traversal
- SSL/TLS issues

### Performance
- Inefficient algorithms (O(n²) in loops)
- Memory leaks
- Unnecessary allocations
- N+1 query patterns
- Blocking operations

### Maintainability
- Complex functions (cyclomatic complexity)
- Long files/functions
- Deep nesting
- Magic numbers
- Missing documentation
- Code duplication

### Bug Risk
- Null/undefined handling
- Error handling gaps
- Race conditions
- Resource leaks
- Type mismatches

## Language Support

| Language | Static Analysis | Security Scan | Best Practices |
|----------|----------------|---------------|----------------|
| Python | Full | Full | Full |
| C++ | Full | Full | Full |
| MFC | Full | Full | MFC-specific |
| JavaScript | Basic | Basic | Basic |
| TypeScript | Basic | Basic | Basic |

## Security Patterns Detected

### Python
- `eval()` / `exec()` usage
- SQL injection (format strings, f-strings, concatenation)
- Command injection (os.system, subprocess shell=True)
- Pickle/YAML deserialization
- Hardcoded credentials

### C++
- Buffer overflows (strcpy, sprintf, gets)
- Format string vulnerabilities
- Memory management issues
- Integer overflow risks

### MFC
- Unsafe string operations
- Handle leaks
- Resource management

## Output Formats

```
/review --format markdown    # Markdown report
/review --format text        # Plain text
/review --format json        # JSON output
/review --format summary     # Brief summary
```

## Best Practices

1. **Review Before Commit**: Run review before committing changes
2. **Address Critical First**: Always fix critical and high severity issues
3. **Security Priority**: Never ignore security warnings
4. **Continuous Review**: Integrate into CI/CD pipeline
5. **Track Issues**: Document deferred issues for later

## Examples

### Example 1: Security Review

**User Request:** "Check my authentication code for security issues"

**Approach:**
1. Run security-focused review on auth module
2. Check for hardcoded credentials
3. Verify password hashing
4. Check for injection vulnerabilities
5. Report findings with severity levels

### Example 2: Pre-Merge Review

**User Request:** "/review --diff"

**Approach:**
1. Get git diff of staged changes
2. Analyze only changed lines
3. Focus on introduced issues
4. Generate PR-ready report

### Example 3: Full Codebase Audit

**User Request:** "Review the entire src/ directory"

**Approach:**
1. Recursively scan all files
2. Run static analysis
3. Run security checks
4. Calculate overall score
5. Generate comprehensive report

## Score Calculation

| Severity | Score Impact |
|----------|-------------|
| Critical | -25 points |
| High | -15 points |
| Medium | -5 points |
| Low | -1 point |
| Info | 0 points |

- **90-100**: Excellent
- **75-89**: Good
- **60-74**: Needs improvement
- **Below 60**: Significant issues

## Integration

The review module can be integrated with:
- Git hooks (pre-commit, pre-push)
- CI/CD pipelines
- IDE extensions
- Pull request automation

## Notes

- Reviews are language-aware
- Security checks are based on OWASP guidelines
- False positives are possible; use judgment
- AI suggestions require LLM model
- Large files may be partially analyzed
