code-review-skill

---

English

What is this?

Code Review Skill is a production-ready skill for Claude Code that transforms AI-assisted code review from vague suggestions into a structured, consistent, and expert-level process.

It covers 20+ languages and frameworks with over 21,000 lines of carefully curated review guidelines — loaded progressively to minimize context window usage.

---

✨ Key Features

• Progressive Disclosure — Core skill is ~220 lines; language guides (~200–1,100 lines each) load only when needed.
• Four-Phase Review Process — Structured workflow from understanding scope to delivering clear feedback.
• Severity Labeling — Every finding is categorized: blocking · important · nit · suggestion · learning · praise
• Security-First — Dedicated security checklists per language ecosystem.
• Collaborative Tone — Questions over commands, suggestions over mandates.
• Automation Awareness — Clearly separates what human review should catch vs. what linters handle.

---

🌐 Supported Languages & Frameworks

---

🔄 The Four-Phase Review Process

Phase 1 - Context Gathering
  Understand PR scope, linked issues, and intent
                    |
                    v
Phase 2 - High-Level Review
  Architecture - Performance impact - Test strategy
                    |
                    v
Phase 3 - Line-by-Line Analysis
  Logic - Security - Maintainability - Edge cases
                    |
                    v
Phase 4 - Summary & Decision
  Structured feedback - Approval status - Action items

---

🏷️ Severity Labels

Label	Meaning
🔴 blocking	Must be fixed before merge
🟠 important	Should be fixed; may block depending on context
🟡 nit	Minor style or preference issue
🔵 suggestion	Optional improvement worth considering
📚 learning	Educational note for the author
🌟 praise	Explicitly highlight great work

---

📁 Repository Structure

code-review-skill/
|
+-- SKILL.md                              # Core skill - loaded on activation (~220 lines)
+-- README.md
+-- LICENSE
+-- CONTRIBUTING.md
|
+-- reference/                            # On-demand language guides
|   +-- react.md                          # React 19 / Next.js / TanStack Query v5
|   +-- vue.md                            # Vue 3.5 Composition API
|   +-- angular.md                        # Angular 17+ / Signals / Zoneless
|   +-- svelte.md                         # Svelte 5 / SvelteKit
|   +-- rust.md                           # Rust ownership, async/await, unsafe
|   +-- typescript.md                     # TypeScript strict mode, generics, ESLint
|   +-- nestjs.md                         # NestJS DI, Guards, Interceptors, DTOs
|   +-- java.md                           # Java 17/21 & Spring Boot 3
|   +-- java8.md                          # Java 8 & Spring Boot 2 (legacy)
|   +-- php.md                            # PHP 8.x types, PDO, security, Composer
|   +-- ruby.md                           # Ruby 3.4+/4.0, Rails 8.x, Active Record/Job
|   +-- python.md                         # Python async, typing, pytest
|   +-- django.md                         # Django / DRF security, serializers, async
|   +-- fastapi.md                        # FastAPI Depends, Pydantic v2, async, test-driven verification
|   +-- go.md                             # Go goroutines, channels, context, interfaces
|   +-- kotlin.md                         # Kotlin / Android coroutines, Compose, Flow
|   +-- swift.md                          # Swift 5.9+/6, SwiftUI, concurrency, optionals
|   +-- csharp.md                         # C# 12 / .NET 8, EF Core, ASP.NET Core
|   +-- c.md                              # C memory safety, UB, error handling
|   +-- cpp.md                            # C++ RAII, move semantics, exception safety
|   +-- zig.md                            # Zig allocators, errors, comptime, C interop
|   +-- qt.md                             # Qt object model, signals/slots, GUI perf
|   +-- css-less-sass.md                  # CSS/Less/Sass variables, responsive design
|   +-- architecture-review-guide.md      # SOLID, anti-patterns, coupling/cohesion
|   +-- code-quality-universal.md        # Reuse audit, parameter sprawl, TOCTOU, no-op updates
|   +-- performance-review-guide.md       # Core Web Vitals, N+1, memory leaks
|   +-- security-review-guide.md          # Security checklist (all languages)
|   +-- common-bugs-checklist.md          # Language-specific bug patterns
|   +-- code-review-best-practices.md     # Communication & process guidelines
|
+-- reference/cross-cutting/             # Language-agnostic cross-cutting patterns
|   +-- sql-injection-prevention.md       # Parameterized queries, 6 languages
|   +-- xss-prevention.md                 # Output encoding, CSP, 5 frameworks
|   +-- n-plus-one-queries.md             # N+1 queries, eager loading, 5 languages
|   +-- error-handling-principles.md      # Error handling principles, 7 languages
|   +-- async-concurrency-patterns.md     # Concurrency patterns, 7 languages
|
+-- assets/
|   +-- review-checklist.md               # Quick reference checklist
|   +-- pr-review-template.md             # PR review comment template
|
+-- scripts/
    +-- pr-analyzer.py                    # PR complexity analyzer

---

🚀 Installation

Clone to your Claude Code skills directory:

# macOS / Linux
git clone https://github.com/awesome-skills/code-review-skill.git \
  ~/.claude/skills/code-review-skill

# Windows (PowerShell)
git clone https://github.com/awesome-skills/code-review-skill.git `
  "$env:USERPROFILE\.claude\skills\code-review-skill"

Or add to an existing plugin:

cp -r code-review-skill ~/.claude/plugins/your-plugin/skills/code-review/

---

💡 Usage

Once installed, activate the skill in your Claude Code session:

Use code-review-skill to review this PR

Or create a custom slash command in .claude/commands/:

<!-- .claude/commands/review.md -->
Use code-review-skill to perform a thorough review of the changes in this PR.
Focus on: security, performance, and maintainability.

Example prompts:

Prompt	What happens
Review this React component	Loads react.md - checks hooks, Server Components, Suspense patterns
Review this Java PR	Loads java.md - checks virtual threads, JPA, Spring Boot 3 patterns
Review this Java 8 / Spring Boot 2 PR	Loads java8.md - Stream/Optional, java.time, RestTemplate timeouts, javax.*
Security review of this Go service	Loads go.md + security-review-guide.md
Architecture review	Loads architecture-review-guide.md - SOLID, anti-patterns, coupling
Performance review	Loads performance-review-guide.md - Web Vitals, N+1, complexity

---

🔬 Highlights by Language

• useActionState - Unified form state management
• useFormStatus - Access parent form status without prop drilling
• useOptimistic - Optimistic UI updates with automatic rollback
• Server Components & Server Actions patterns (Next.js 15+)
• Suspense boundary design, Error Boundary integration, streaming SSR
• use() Hook for consuming Promises

• Java 17/21: Records, Pattern Matching for Switch, Text Blocks, Sealed Classes
• Virtual Threads (Project Loom): High-throughput I/O patterns
• Spring Boot 3: Constructor injection, @ConfigurationProperties, ProblemDetail
• JPA Performance: Solving N+1, correct equals/hashCode on Entities

• Java 8: Lambda, Stream/Collectors, Optional, java.time (no Records / virtual threads)
• Concurrency: bounded thread pools, CompletableFuture + explicit executors
• Spring Boot 2: javax.*, constructor injection, RestTemplate timeouts
• JPA / Hibernate 5: N+1, Entity equals/hashCode, UTC time mapping pitfalls

• Ownership patterns and common pitfalls
• unsafe code review requirements (mandatory SAFETY comments)
• Async/await - avoiding blocking in async context, cancellation safety
• Error handling: thiserror for libraries, anyhow for applications

• Goroutine lifecycle management and leak prevention
• Channel patterns, select usage
• context.Context propagation
• Interface design (accept interfaces, return structs)
• Error wrapping with %w

• C: Pointer/buffer safety, undefined behavior, resource cleanup, integer overflow
• C++: RAII ownership, Rule of 0/3/5, move semantics, exception safety, noexcept
• Qt: Object parent/child memory model, thread-safe signal/slot connections, GUI performance

---

🤝 Contributing

Contributions are welcome! See CONTRIBUTING.md for guidelines.

Ideas:

• New language guides (Elixir, Scala, Lua...)
• Framework-specific guides (Laravel, Spring WebFlux...)
• Additional checklists and templates
• Translations of core documentation

---

📄 License

MIT © awesome-skills

---

中文

这是什么？

Code Review Skill 是专为 Claude Code 打造的生产级代码审查技能，将 AI 辅助的代码审查从模糊建议转变为结构化、一致且专业级的流程。

覆盖 20+ 种语言和框架，拥有超过 21,000 行精心整理的代码审查指南——按需加载，最大程度减少上下文占用。

---

✨ 核心特性

• 渐进式加载 — 核心技能仅 ~220 行，各语言指南（每份 200–1,100 行）仅在需要时才加载。
• 四阶段审查流程 — 从理解 PR 范围到输出清晰反馈，每一步都有规可循。
• 严重性标记 — 每条发现均分级：blocking · important · nit · suggestion · learning · praise
• 安全优先 — 每个语言生态均配备专属安全检查清单。
• 协作式语气 — 以提问替代命令，以建议替代指令。
• 自动化感知 — 明确区分人工审查应关注的内容与 linter 自动处理的内容。

---

🌐 支持的语言与框架

分类	技术栈	指南文件	行数
前端	⚛️ React 19 / Next.js / TanStack Query v5	reference/react.md	~870
	💚 Vue 3.5 Composition API	reference/vue.md	~920
	🔮 Angular 17+ / Signals / Zoneless	reference/angular.md	~790
	🔥 Svelte 5 / SvelteKit	reference/svelte.md	~1,060
	🎨 CSS / Less / Sass	reference/css-less-sass.md	~660
	🔷 TypeScript	reference/typescript.md	~1,020
后端	☕ Java 17/21 + Spring Boot 3	reference/java.md	~410
	☕ Java 8 + Spring Boot 2	reference/java8.md	~580
	⚡ FastAPI	reference/fastapi.md	~590
	PHP 8.x	reference/php.md	~700
	💎 Ruby 3.4+/4.0 + Rails 8.x	reference/ruby.md	~960
	📦 NestJS	reference/nestjs.md	~590
	🐍 Django / DRF	reference/django.md	~1,030
	🐍 Python	reference/python.md	~1,070
	🐹 Go	reference/go.md	~990
	🦀 Rust	reference/rust.md	~840
	💻 C# / .NET 8	reference/csharp.md	~520
移动 / 系统	📱 Kotlin / Android	reference/kotlin.md	~1,020
	🍎 Swift / SwiftUI	reference/swift.md	~930
	⚙️ C	reference/c.md	~890
	🔩 C++	reference/cpp.md	~890
	⚡ Zig	reference/zig.md	~440
	🖥️ Qt 框架	reference/qt.md	~760
架构	🏛️ 架构设计审查	reference/architecture-review-guide.md	~470
	⚡ 性能审查	reference/performance-review-guide.md	~820
	🔍 通用质量反模式	reference/code-quality-universal.md	~490
	🛡️ 安全审查	reference/security-review-guide.md	~640
	📈 N+1 查询	reference/cross-cutting/n-plus-one-queries.md	~310
	⚠️ 错误处理原则	reference/cross-cutting/error-handling-principles.md	~490
	⚡ 异步与并发模式	reference/cross-cutting/async-concurrency-patterns.md	~540
	🛡️ SQL 注入防护	reference/cross-cutting/sql-injection-prevention.md	~310
	🛡️ XSS 防护	reference/cross-cutting/xss-prevention.md	~260

---

🔄 四阶段审查流程

阶段一 - 上下文收集
  理解 PR 范围、关联 Issue 和实现意图
                    |
                    v
阶段二 - 高层级审查
  架构设计 - 性能影响 - 测试策略
                    |
                    v
阶段三 - 逐行深度分析
  逻辑正确性 - 安全漏洞 - 可维护性 - 边界情况
                    |
                    v
阶段四 - 总结与决策
  结构化反馈 - 审批状态 - 后续行动项

---

🏷️ 严重性标记说明

标记	含义
🔴 blocking	合并前必须修复
🟠 important	应当修复，视情况可能阻塞合并
🟡 nit	风格或偏好上的小问题
🔵 suggestion	值得考虑的可选优化
📚 learning	给作者的教育性说明
🌟 praise	明确表扬优秀代码

---

📁 仓库结构

code-review-skill/
|
+-- SKILL.md                              # 核心技能，激活时加载（~220 行）
+-- README.md
+-- LICENSE
+-- CONTRIBUTING.md
|
+-- reference/                            # 按需加载的语言指南
|   +-- react.md                          # React 19 / Next.js / TanStack Query v5
|   +-- vue.md                            # Vue 3.5 组合式 API
|   +-- angular.md                        # Angular 17+ / Signals / Zoneless
|   +-- svelte.md                         # Svelte 5 / SvelteKit
|   +-- rust.md                           # Rust 所有权、async/await、unsafe
|   +-- typescript.md                     # TypeScript strict 模式、泛型、ESLint
|   +-- nestjs.md                         # NestJS 依赖注入、Guard、Interceptor、DTO
|   +-- java.md                           # Java 17/21 & Spring Boot 3
|   +-- java8.md                          # Java 8 & Spring Boot 2（遗留栈）
|   +-- php.md                            # PHP 8.x 类型、PDO、安全、Composer
|   +-- ruby.md                           # Ruby 3.4+/4.0、Rails 8.x、Active Record/Job
|   +-- python.md                         # Python async、类型注解、pytest
|   +-- django.md                         # Django / DRF 安全、Serializer、异步视图
|   +-- fastapi.md                        # FastAPI Depends、Pydantic v2、异步、测试驱动验证
|   +-- go.md                             # Go goroutine、channel、context、接口
|   +-- kotlin.md                         # Kotlin / Android 协程、Compose、Flow
|   +-- swift.md                          # Swift 5.9+/6、SwiftUI、并发、可选值
|   +-- csharp.md                         # C# 12 / .NET 8、EF Core、ASP.NET Core
|   +-- c.md                              # C 内存安全、UB、错误处理
|   +-- cpp.md                            # C++ RAII、移动语义、异常安全
|   +-- zig.md                            # Zig allocator、错误处理、comptime、C 互操作
|   +-- qt.md                             # Qt 对象模型、信号/槽、GUI 性能
|   +-- css-less-sass.md                  # CSS/Less/Sass 变量、响应式设计
|   +-- architecture-review-guide.md      # SOLID、反模式、耦合度分析
|   +-- code-quality-universal.md        # 复用审查、参数膨胀、抽象泄漏、TOCTOU
|   +-- performance-review-guide.md       # Core Web Vitals、N+1、内存泄漏
|   +-- security-review-guide.md          # 安全审查清单（全语言通用）
|   +-- common-bugs-checklist.md          # 各语言常见 Bug 模式
|   +-- code-review-best-practices.md     # 沟通与流程最佳实践
|
+-- reference/cross-cutting/             # 语言无关跨领域模式
|   +-- sql-injection-prevention.md       # 参数化查询, 6 语言
|   +-- xss-prevention.md                 # 输出编码, CSP, 5 框架
|   +-- n-plus-one-queries.md             # N+1 查询, 预加载, 5 语言
|   +-- error-handling-principles.md      # 错误处理原则, 7 语言
|   +-- async-concurrency-patterns.md     # 并发模式, 7 语言
|
+-- assets/
|   +-- review-checklist.md               # 快速参考清单
|   +-- pr-review-template.md             # PR 审查评论模板
|
+-- scripts/
    +-- pr-analyzer.py                    # PR 复杂度分析工具

---

🚀 安装方法

克隆到 Claude Code skills 目录：

# macOS / Linux
git clone https://github.com/awesome-skills/code-review-skill.git \
  ~/.claude/skills/code-review-skill

# Windows（PowerShell）
git clone https://github.com/awesome-skills/code-review-skill.git `
  "$env:USERPROFILE\.claude\skills\code-review-skill"

或添加到现有插件：

cp -r code-review-skill ~/.claude/plugins/your-plugin/skills/code-review/

---

💡 使用方式

安装后，在 Claude Code 会话中激活技能：

Use code-review-skill to review this PR

或在 .claude/commands/ 中创建自定义斜杠命令：

<!-- .claude/commands/review.md -->
使用 code-review-skill 对这次 PR 的变更进行全面审查。
重点关注：安全性、性能和可维护性。

示例提示词：

提示词	效果
审查这个 React 组件	加载 react.md，检查 Hooks、Server Components、Suspense
审查这个 Java PR	加载 java.md，检查虚拟线程、JPA、Spring Boot 3
审查这个 Java 8 / Spring Boot 2 PR	加载 java8.md，检查 Stream/Optional、java.time、RestTemplate 超时、javax.*
对这个 Go 服务进行安全审查	加载 go.md + security-review-guide.md
架构审查	加载 architecture-review-guide.md，检查 SOLID 与反模式
性能审查	加载 performance-review-guide.md，分析 Web Vitals、N+1 等

---

🔬 各语言核心内容

• useActionState — 统一的表单状态管理
• useFormStatus — 无需 props 透传即可访问父表单状态
• useOptimistic — 带自动回滚的乐观 UI 更新
• Server Components & Server Actions（Next.js 15+）
• Suspense 边界设计、Error Boundary 集成、流式 SSR
• use() Hook 消费 Promise

• Java 17/21：Records、Switch 模式匹配、文本块、Sealed Classes
• 虚拟线程（Project Loom）：高吞吐量 I/O 模式
• Spring Boot 3：构造器注入、@ConfigurationProperties、ProblemDetail
• JPA 性能：解决 N+1、Entity 正确的 equals/hashCode 实现

• Java 8：Lambda、Stream/Collectors、Optional、java.time（无 Records / 虚拟线程）
• 并发：有界线程池、CompletableFuture + 显式 Executor
• Spring Boot 2：javax.*、构造器注入、RestTemplate 超时
• JPA / Hibernate 5：N+1、Entity equals/hashCode、UTC 时间映射陷阱

• 所有权模式与常见陷阱
• unsafe 代码审查要求（必须有 SAFETY 注释）
• Async/await — 避免在异步上下文中阻塞，取消安全性
• 错误处理：库用 thiserror，应用用 anyhow

• Goroutine 生命周期管理与泄漏预防
• Channel 模式、select 用法
• context.Context 传播规范
• 接口设计原则（接受接口，返回结构体）
• 错误包装：使用 %w

• C：指针/缓冲区安全、未定义行为、资源清理、整数溢出
• C++：RAII 所有权、Rule of 0/3/5、移动语义、异常安全、noexcept
• Qt：父子内存模型、线程安全的信号/槽连接、GUI 性能优化

---

🤝 参与贡献

欢迎贡献！请查阅 CONTRIBUTING.md 了解规范。

可贡献方向：

• 新增语言指南（Elixir、Scala、Lua...）
• 框架专属指南（Laravel、Spring WebFlux...）
• 补充检查清单和审查模板
• 核心文档的多语言翻译

---

📄 开源协议

MIT © awesome-skills

---