code-review-pro by onewave-ai/claude-skills
npx skills add https://github.com/onewave-ai/claude-skills --skill code-review-pro深度代码分析,涵盖安全性、性能、可维护性和最佳实践。
当用户出现以下情况时激活:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
# 代码审查报告
## 🚨 关键问题(立即修复)
### 1. SQL 注入漏洞(第 X 行)
**严重性**:关键
**问题**:用户输入直接拼接到 SQL 查询中
**影响**:数据库被攻破,数据被盗
**当前代码:**
```javascript
const query = `SELECT * FROM users WHERE email = '${userEmail}'`;
修复后的代码:
const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [userEmail]);
解释:始终使用参数化查询以防止 SQL 注入。
[详情...]
[详情...]
[详情...]
高影响、低成本的更改:
calculateDiscount()
## 示例
**用户**:"审查这段身份验证代码"
**响应**:分析认证逻辑 → 识别安全问题(弱密码哈希、无速率限制)→ 检查令牌处理 → 指出缺少 CSRF 防护 → 提供带有代码示例的具体修复方案 → 按严重性排序
**用户**:"你能在这个 React 组件中找到性能问题吗?"
**响应**:分析组件 → 识别不必要的重新渲染 → 查找缺失的 useMemo/useCallback → 指出过大的状态对象 → 检查渲染中的昂贵操作 → 提供带有解释的优化版本
**用户**:"审查这个 API 端点"
**响应**:检查输入验证 → 分析错误处理 → 测试 SQL 注入 → 审查身份验证 → 检查速率限制 → 检查响应结构 → 提供带有代码示例的改进建议
## 最佳实践
* 始终优先处理安全问题
* 为问题提供具体的行号
* 包含修改前/后的代码示例
* 解释*为什么*某件事是个问题
* 考虑语言/框架的上下文
* 不要只批评——也要肯定好的代码
* 对于大型重构,建议渐进式改进
* 为建议链接到相关文档
* 考虑项目约束(遗留代码、截止日期)
* 在完美主义与实用主义之间取得平衡
* 专注于有影响力的更改
* 将类似问题分组
* 使建议具有可操作性
每周安装
1.7K
仓库
[onewave-ai/claude-skills](https://github.com/onewave-ai/claude-skills "onewave-ai/claude-skills")
GitHub 星标
67
首次出现
Jan 24, 2026
安全审计
[Gen Agent Trust HubPass](/onewave-ai/claude-skills/code-review-pro/security/agent-trust-hub)[SocketPass](/onewave-ai/claude-skills/code-review-pro/security/socket)[SnykFail](/onewave-ai/claude-skills/code-review-pro/security/snyk)
安装于
opencode1.4K
codex1.4K
gemini-cli1.4K
github-copilot1.4K
kimi-cli1.4K
amp1.4K
Deep code analysis covering security, performance, maintainability, and best practices.
Activate when the user:
Security Analysis (Critical Priority)
Performance Analysis
Code Quality & Maintainability
Best Practices
Bugs and Edge Cases
Provide Actionable Fixes
# Code Review Report
## 🚨 Critical Issues (Fix Immediately)
### 1. SQL Injection Vulnerability (line X)
**Severity**: Critical
**Issue**: User input directly concatenated into SQL query
**Impact**: Database compromise, data theft
**Current Code:**
```javascript
const query = `SELECT * FROM users WHERE email = '${userEmail}'`;
Fixed Code:
const query = 'SELECT * FROM users WHERE email = ?';
db.query(query, [userEmail]);
Explanation : Always use parameterized queries to prevent SQL injection.
[Details...]
[Details...]
[Details...]
Changes with high impact and low effort:
calculateDiscount()User: "Review this authentication code" Response: Analyze auth logic → Identify security issues (weak password hashing, no rate limiting) → Check token handling → Note missing CSRF protection → Provide specific fixes with code examples → Prioritize by severity
User: "Can you find performance issues in this React component?" Response: Analyze component → Identify unnecessary re-renders → Find missing useMemo/useCallback → Note large state objects → Check for expensive operations in render → Provide optimized version with explanations
User: "Review this API endpoint" Response: Check input validation → Analyze error handling → Test for SQL injection → Review authentication → Check rate limiting → Examine response structure → Suggest improvements with code samples
Weekly Installs
1.7K
Repository
GitHub Stars
67
First Seen
Jan 24, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
opencode1.4K
codex1.4K
gemini-cli1.4K
github-copilot1.4K
kimi-cli1.4K
amp1.4K
React 组合模式指南:Vercel 组件架构最佳实践,提升代码可维护性
102,200 周安装