‹ 首页

code-review

@developersglobal · 收录于 1 周前

Structured code review focusing on correctness, security, and maintainability. Correctness before style. Every reviewer comment must be actionable.

场景代码评审质量把关

适合你，如果你需要结构化地审查代码并给出可操作建议

/ 下载安装
code-review.skill双击,或拖进 Claude 桌面版 / Cowork,即完成安装↓ .skill↓ .zip
用别的 agent?下载 .zip 解压,把文件夹放进它的技能目录
Claude Code~/.claude/skills/(项目级 .claude/skills/)
Codex CLI~/.codex/skills/
Cursor自动读取上面两处目录
其他工具见其文档的「skills」目录;两个下载是同一份文件,只是名字不同
/ 通过 npx 安装 校验哈希
npx oh-my-skill add developersglobal/ai-agent-skills/code-review
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- developersglobal/ai-agent-skills/code-review
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify developersglobal/ai-agent-skills/code-review
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
64GitHub stars
~651上下文体积 · 单文件
镜像托管

怎么用

技能原文 SKILL.md作者撰写 · MIT · f47f948
Overview

Code review is the last line of defense before code reaches production. This skill structures the review process to catch real issues — not just style preferences — and ensures every comment is actionable and proportionate.

When to Use
  • Before merging any pull request
  • When reviewing AI-generated code
  • When auditing existing code for quality
Process
Step 1: Understand the Change
  1. Read the PR description fully — understand the intent before reading code.
  2. Check: Does the implementation match the stated intent?
  3. Identify the risk level: data mutation? auth changes? public API?

Verify: You understand what the PR is trying to accomplish.

Step 2: Correctness Review
  1. Does the code do what it claims to do?
  2. Are there off-by-one errors, null dereferences, or race conditions?
  3. Are all error cases handled?
  4. Do tests cover the happy path AND key failure paths?

Verify: You can trace the execution path for the primary use case and 2 failure cases.

Step 3: Security Review
  1. Apply [security-hardening skill](../security-hardening/SKILL.md) to any auth/input/data changes.
  2. Does this change open any OWASP Top 10 vulnerabilities?
  3. Are any secrets or PII handled correctly?
Step 4: Maintainability Review
  1. Will the next developer understand this code without the author present?
  2. Are functions doing one thing?
  3. Are names descriptive and accurate?
  4. Is complexity proportionate to the problem?
Step 5: Provide Actionable Feedback
  1. Every comment must be one of:
  2. Blocker: Must be fixed before merge
  3. Suggestion: Optional improvement
  4. Question: Needs clarification (not necessarily a problem)
  5. Blockers must be specific: "This SQL query is vulnerable to injection via {username} — use parameterized queries."
  6. Never leave vague comments like "this doesn't look right" without explaining why.
Common Rationalizations (and Rebuttals)

| Excuse | Rebuttal | |--------|----------| | "I'll review it quickly" | A rushed review is not a review. Take the time or ask someone who can. | | "The tests pass so it's fine" | Tests prove the code works for tested inputs, not that it's secure or maintainable. | | "I'll comment on style later" | Style comments without blocker separation waste everyone's time. Label them. |

Verification
  • [ ] Correctness verified for primary and failure paths
  • [ ] Security review applied to sensitive changes
  • [ ] All comments labeled (blocker/suggestion/question)
  • [ ] Tests reviewed for meaningful coverage
  • [ ] No vague or unactionable comments
References
  • [security-hardening skill](../security-hardening/SKILL.md)
  • [references/security-checklist.md](../../references/security-checklist.md)
按 MIT 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…