software-code-review by vasilyu1983/ai-agents-public
npx skills add https://github.com/vasilyu1983/ai-agents-public --skill software-code-review此技能为跨语言和跨技术栈的结构化代码审查提供操作检查清单和提示。当主要任务是审查现有代码而非设计新系统时使用它。
| 审查类型 | 关注领域 | 关键检查清单 | 使用时机 |
|---|---|---|---|
| 安全审查 | 认证、输入验证、密钥、OWASP Top 10 | software-security-appsec | 安全关键代码、API端点 |
| 供应链审查 | 依赖项、锁文件、许可证、SBOM、CI策略 | dev-dependency-management | 依赖项更新、构建/CI变更 |
| 性能审查 | N+1查询、算法、缓存、热点路径 | 数据库查询、循环、内存分配 | 高流量功能、瓶颈 |
| 正确性审查 | 逻辑、边界情况、错误处理、测试 | 边界条件、空值检查、重试 | 业务逻辑、数据转换 |
| 可维护性审查 |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 命名、复杂度、重复、可读性 |
| 函数长度、命名清晰度、DRY原则 |
| 复杂模块、共享代码 |
| 测试审查 | 覆盖率、边界情况、不稳定性、断言 | 测试质量、缺失场景 | 新功能、重构 |
| 前端审查 | 可访问性、响应式设计、性能 | frontend-review.md | UI/UX变更 |
| 后端审查 | API设计、错误处理、数据库模式 | api-review.md | API端点、服务 |
| 区块链审查 | 重入、访问控制、Gas优化 | crypto-review.md | 智能合约、DeFi协议 |
除非审查使用 Entity Framework Core 的 C#/.NET 加密/金融科技服务,否则请跳过。
对于使用 Entity Framework Core 的 C#/.NET 加密/金融科技服务,请参阅:
关键规则摘要:
decimal,日期使用 UTCCC-SEC-03(代码中无密钥)和 CC-OBS-02(日志中无敏感数据)CancellationToken,避免 .Result/.Wait()(参见 CC-ERR-04、CC-FLOW-03)AsNoTracking,避免 N+1 问题,不使用动态 SQLResult<T> 模式明确表示成功/失败当用户要求以下操作时调用此技能:
Code review task: [What to Focus On?]
├─ Security-critical changes?
│ ├─ Auth/access control → Security Review (OWASP, auth patterns)
│ ├─ User input handling → Input validation, XSS, SQL injection
│ └─ Smart contracts → Blockchain Review (reentrancy, access control)
│
├─ Performance concerns?
│ ├─ Database queries → Check for N+1, missing indexes
│ ├─ Loops/algorithms → Complexity analysis, caching
│ └─ API response times → Profiling, lazy loading
│
├─ Correctness issues?
│ ├─ Business logic → Edge cases, error handling, tests
│ ├─ Data transformations → Boundary conditions, null checks
│ └─ Integration points → Retry logic, timeouts, fallbacks
│
├─ Maintainability problems?
│ ├─ Complex code → Naming, function length, duplication
│ ├─ Hard to understand → Comments, abstractions, clarity
│ └─ Technical debt → Refactoring suggestions
│
├─ Test coverage gaps?
│ ├─ New features → Happy path + error cases
│ ├─ Refactors → Regression tests
│ └─ Bug fixes → Reproduction tests
│
└─ Stack-specific review?
├─ Frontend → [frontend-review.md](assets/web-frontend/frontend-review.md)
├─ Backend → [api-review.md](assets/backend-api/api-review.md)
├─ Mobile → [mobile-review.md](assets/mobile/mobile-review.md)
├─ Infrastructure → [infrastructure-review.md](assets/infrastructure/infrastructure-review.md)
└─ Blockchain → [crypto-review.md](assets/blockchain/crypto-review.md)
多模式审查:
对于复杂的拉取请求,按顺序应用多种审查模式:
| 实践 | 实施方式 |
|---|---|
| 审查窗口 | 定义 4 小时重叠窗口 |
| 审查轮换 | 跨时区分配审查者 |
| 异步沟通 | 使用拉取请求评论,而非私信 |
| 审查服务等级协议 | 24 小时初始响应,48 小时完成 |
PR Submitted -> Auto-checks (CI) -> Async Review -> Merge
| | |
Author continues If green, Reviewer comments
on other work queue for when available
review
反模式:
| 优先级 | 标准 | 服务等级协议 |
|---|---|---|
| P0 | 安全修复、生产事故 | 4 小时 |
| P1 | 错误修复、阻塞性依赖 | 24 小时 |
| P2 | 功能工作、技术债务 | 48 小时 |
| P3 | 文档、重构 | 72 小时 |
注意 :AI辅助审查工具。人工审查仍具有权威性。
| 工具 | 使用场景 | 局限性 |
|---|---|---|
| GitHub Copilot PR | 摘要、建议 | 可能遗漏上下文 |
| CodeRabbit | 自动化拉取请求审查评论 | 需要人工验证 |
| Qodo | 测试生成 + 审查,15+ 工作流 | 企业级定价 |
| OpenAI Codex | 系统级代码库上下文 | 需要 API 集成 |
| AWS Security Agent | OWASP Top 10、策略违规 | 仅预览版(2026) |
| Endor Labs AI SAST | AI辅助的 SAST | 专注于安全 |
| Graphite | 拉取请求堆叠、堆栈感知的合并队列 | 流程,非内容 |
AI 助手规则:
共享基础
CC-*)RULE-01–RULE-13、重构决策树和设计模式代码审查专项
生成审查时,默认采用:
P0/P1/P2/P3 分组的问题发现(标记为必需 vs 可选)请使用 assets/core/review-comment-guidelines.md 了解评论风格和标签。
资源
模板
数据
重要提示:当用户询问有关代码审查工具、实践或自动化的推荐问题时,您必须在回答前使用网络搜索检查当前趋势。
"code review best practices 2026""[specific tool] vs alternatives 2026""AI code review tools January 2026""PR automation trends 2026"搜索后,提供:
每周安装次数
80
代码仓库
GitHub 星标数
49
首次出现
2026年1月23日
安全审计
安装于
opencode65
gemini-cli64
codex63
cursor61
github-copilot60
claude-code56
This skill provides operational checklists and prompts for structured code review across languages and stacks. Use it when the primary task is reviewing existing code rather than designing new systems.
| Review Type | Focus Areas | Key Checklist | When to Use |
|---|---|---|---|
| Security Review | Auth, input validation, secrets, OWASP Top 10 | software-security-appsec | Security-critical code, API endpoints |
| Supply Chain Review | Dependencies, lockfiles, licenses, SBOM, CI policies | dev-dependency-management | Dependency bumps, build/CI changes |
| Performance Review | N+1 queries, algorithms, caching, hot paths | DB queries, loops, memory allocation | High-traffic features, bottlenecks |
| Correctness Review | Logic, edge cases, error handling, tests | Boundary conditions, null checks, retries | Business logic, data transformations |
| Maintainability Review | Naming, complexity, duplication, readability | Function length, naming clarity, DRY | Complex modules, shared code |
| Test Review | Coverage, edge cases, flakiness, assertions | Test quality, missing scenarios | New features, refactors |
| Frontend Review | Accessibility, responsive design, performance | frontend-review.md | UI/UX changes |
| Backend Review | API design, error handling, database patterns | api-review.md | API endpoints, services |
| Blockchain Review | Reentrancy, access control, gas optimization | crypto-review.md | Smart contracts, DeFi protocols |
Skip unless reviewing C#/.NET crypto/fintech services using Entity Framework Core.
For C#/.NET crypto/fintech services using Entity Framework Core, see:
Key rules summary:
decimal for financial values, UTC for datesCC-SEC-03 (no secrets in code) and CC-OBS-02 (no sensitive data in logs)CancellationToken, avoid .Result/.Wait() (see CC-ERR-04, CC-FLOW-03)AsNoTracking for reads, avoid N+1, no dynamic SQLResult<T> pattern for explicit success/failInvoke this skill when the user asks to:
Code review task: [What to Focus On?]
├─ Security-critical changes?
│ ├─ Auth/access control → Security Review (OWASP, auth patterns)
│ ├─ User input handling → Input validation, XSS, SQL injection
│ └─ Smart contracts → Blockchain Review (reentrancy, access control)
│
├─ Performance concerns?
│ ├─ Database queries → Check for N+1, missing indexes
│ ├─ Loops/algorithms → Complexity analysis, caching
│ └─ API response times → Profiling, lazy loading
│
├─ Correctness issues?
│ ├─ Business logic → Edge cases, error handling, tests
│ ├─ Data transformations → Boundary conditions, null checks
│ └─ Integration points → Retry logic, timeouts, fallbacks
│
├─ Maintainability problems?
│ ├─ Complex code → Naming, function length, duplication
│ ├─ Hard to understand → Comments, abstractions, clarity
│ └─ Technical debt → Refactoring suggestions
│
├─ Test coverage gaps?
│ ├─ New features → Happy path + error cases
│ ├─ Refactors → Regression tests
│ └─ Bug fixes → Reproduction tests
│
└─ Stack-specific review?
├─ Frontend → [frontend-review.md](assets/web-frontend/frontend-review.md)
├─ Backend → [api-review.md](assets/backend-api/api-review.md)
├─ Mobile → [mobile-review.md](assets/mobile/mobile-review.md)
├─ Infrastructure → [infrastructure-review.md](assets/infrastructure/infrastructure-review.md)
└─ Blockchain → [crypto-review.md](assets/blockchain/crypto-review.md)
Multi-Mode Reviews:
For complex PRs, apply multiple review modes sequentially:
| Practice | Implementation |
|---|---|
| Review windows | Define 4-hour overlap windows |
| Review rotation | Assign reviewers across timezones |
| Async communication | Use PR comments, not DMs |
| Review SLAs | 24-hour initial response, 48-hour completion |
PR Submitted -> Auto-checks (CI) -> Async Review -> Merge
| | |
Author continues If green, Reviewer comments
on other work queue for when available
review
Anti-patterns:
| Priority | Criteria | SLA |
|---|---|---|
| P0 | Security fix, production incident | 4 hours |
| P1 | Bug fix, blocking dependency | 24 hours |
| P2 | Feature work, tech debt | 48 hours |
| P3 | Documentation, refactoring | 72 hours |
Note : AI-assisted review tools. Human review remains authoritative.
| Tool | Use Case | Limitation |
|---|---|---|
| GitHub Copilot PR | Summary, suggestions | May miss context |
| CodeRabbit | Automated PR review comments | Requires human validation |
| Qodo | Test generation + review, 15+ workflows | Enterprise pricing |
| OpenAI Codex | System-level codebase context | API integration required |
| AWS Security Agent | OWASP Top 10, policy violations | Preview only (2026) |
| Endor Labs AI SAST | AI-assisted SAST | Security-focused |
| Graphite | PR stacking, stack-aware merge queue | Process, not content |
AI assistant rules:
Shared Foundation
CC-*) for citation in reviewsRULE-01–RULE-13, refactoring decision trees, and design patternsCode Review Specific
When producing a review, default to:
P0/P1/P2/P3 (mark REQUIRED vs OPTIONAL)Use assets/core/review-comment-guidelines.md for comment style and labeling.
Resources
Templates
Data
IMPORTANT : When users ask recommendation questions about code review tools, practices, or automation, you MUST use WebSearch to check current trends before answering.
"code review best practices 2026""[specific tool] vs alternatives 2026""AI code review tools January 2026""PR automation trends 2026"After searching, provide:
Weekly Installs
80
Repository
GitHub Stars
49
First Seen
Jan 23, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
opencode65
gemini-cli64
codex63
cursor61
github-copilot60
claude-code56
Perl安全编程指南:输入验证、注入防护与安全编码实践
1,200 周安装