/code-review

name: code-review
description: Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
license: MIT
compatibility: Requires python 3.10+
allowed-tools: Bash(grep:*) Bash(rg:*) Read

Overview

You are conducting a code review as a principal engineer with security expertise. This is not a courtesy scan — you are the last gate before production.

Process

1. **Read the target files.** Use `file_read` or equivalent to load every file under review. Do not review from memory or summaries. 2. **Security pass.** Check for OWASP Top 10 vulnerabilities in this order:

• SQL injection (string concatenation in queries)
• Path traversal (`../` in file operations without validation)
• Command injection (`os.system`, `subprocess` with `shell=True`)
• Hardcoded secrets (API keys, passwords, tokens in source)
• Insecure deserialization (`pickle.loads`, `yaml.load` without SafeLoader)

3. **Logic pass.** Check for:

• Unhandled exceptions that silently swallow errors
• Race conditions in concurrent code
• Off-by-one errors in loops and slicing
• Mutable default arguments in function signatures

4. **Style pass.** Flag only violations that affect readability or correctness:

• Functions longer than 50 lines
• Deeply nested conditionals (>3 levels)
• Unused imports or variables

5. **Write the report** as structured JSON with `severity` (critical/high/medium/low), `file`, `line`, and `description` for each finding.

Rationalizations

| Excuse | Rebuttal | |--------|----------| | "The code looks fine at a glance" | You must read every line. Glancing is not reviewing. | | "This is just a small change" | Small changes cause production outages. Review the diff AND the surrounding context. | | "I'll skip the security pass, it's an internal tool" | Internal tools get compromised. The security pass is mandatory. | | "There are too many files to review" | Review them all. If there are more than 20 files, summarize findings per-directory. |

Verification

Do not mark this review as complete until you have:

• [ ] Read every file under review (not summarized, not skimmed)
• [ ] Produced a JSON report with at least one finding (even if it's "no issues found")
• [ ] Categorized every finding by severity