code-review by supercent-io/skills-template
npx skills add https://github.com/supercent-io/skills-template --skill code-review阅读 PR 描述:
检查范围:
架构与设计:
代码组织:
命名:
函数:
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
类和对象:
错误处理:
代码质量:
输入验证:
认证与授权:
数据保护:
依赖项:
算法:
数据库:
缓存:
资源管理:
测试覆盖率:
测试质量:
测试命名:
# 好
def test_user_creation_with_valid_data_succeeds():
pass
# 不好
def test1():
pass
代码注释:
函数文档:
def calculate_total(items: List[Item], tax_rate: float) -> Decimal:
"""
计算含税总价。
Args:
items: 用于计算总价的物品列表
tax_rate: 税率,以小数表示(例如,0.1 表示 10%)
Returns:
含税总价
Raises:
ValueError: 如果税率为负数
"""
pass
README/文档:
建设性反馈:
✅ 好:
"考虑将此逻辑提取到单独的函数中,以提高可测试性和可重用性:
def validate_email(email: str) -> bool:
return '@' in email and '.' in email.split('@')[1]
这将使其更容易在整个代码库中测试和重用。"
❌ 不好:
"这是错的。重写它。"
具体明确:
✅ 好:
"在第 45 行,此查询可能导致 N+1 问题。考虑使用 .select_related('author') 在单个查询中获取相关对象。"
❌ 不好:
"这里有性能问题。"
问题优先级:
肯定好的工作:
"这里策略模式用得很好!这使得将来添加新的支付方式变得容易。"
上帝类:
# 不好:一个类做所有事情
class UserManager:
def create_user(self): pass
def send_email(self): pass
def process_payment(self): pass
def generate_report(self): pass
魔法数字:
# 不好
if user.age > 18:
pass
# 好
MINIMUM_AGE = 18
if user.age > MINIMUM_AGE:
pass
深度嵌套:
# 不好
if condition1:
if condition2:
if condition3:
if condition4:
# 深度嵌套的代码
# 好(提前返回)
if not condition1:
return
if not condition2:
return
if not condition3:
return
if not condition4:
return
# 扁平化的代码
SQL 注入:
# 不好
query = f"SELECT * FROM users WHERE id = {user_id}"
# 好
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))
XSS:
// 不好
element.innerHTML = userInput;
// 好
element.textContent = userInput;
硬编码的密钥:
# 不好
API_KEY = "sk-1234567890abcdef"
# 好
API_KEY = os.environ.get("API_KEY")
代码检查工具:
安全工具:
代码质量工具:
每周安装量
12.4K
代码仓库
GitHub 星标数
88
首次出现
2026年1月24日
安全审计
安装于
codex12.3K
gemini-cli12.3K
opencode12.2K
github-copilot12.2K
cursor12.2K
amp12.2K
Read the PR description :
Check the scope :
Architecture and design :
Code organization :
Naming :
Functions :
Classes and objects :
Error handling :
Code quality :
Input validation :
Authentication & Authorization:
Data protection :
Dependencies :
Algorithms :
Database :
Caching :
Resource management :
Test coverage :
Test quality :
Test naming :
# Good
def test_user_creation_with_valid_data_succeeds():
pass
# Bad
def test1():
pass
Code comments :
Function documentation :
def calculate_total(items: List[Item], tax_rate: float) -> Decimal:
"""
Calculate the total price including tax.
Args:
items: List of items to calculate total for
tax_rate: Tax rate as decimal (e.g., 0.1 for 10%)
Returns:
Total price including tax
Raises:
ValueError: If tax_rate is negative
"""
pass
README/docs :
Be constructive :
✅ Good:
"Consider extracting this logic into a separate function for better
testability and reusability:
def validate_email(email: str) -> bool:
return '@' in email and '.' in email.split('@')[1]
This would make it easier to test and reuse across the codebase."
❌ Bad:
"This is wrong. Rewrite it."
Be specific :
✅ Good:
"On line 45, this query could cause N+1 problem. Consider using
.select_related('author') to fetch related objects in a single query."
❌ Bad:
"Performance issues here."
Prioritize issues :
Acknowledge good work :
"Nice use of the strategy pattern here! This makes it easy to add
new payment methods in the future."
God class :
# Bad: One class doing everything
class UserManager:
def create_user(self): pass
def send_email(self): pass
def process_payment(self): pass
def generate_report(self): pass
Magic numbers :
# Bad
if user.age > 18:
pass
# Good
MINIMUM_AGE = 18
if user.age > MINIMUM_AGE:
pass
Deep nesting :
# Bad
if condition1:
if condition2:
if condition3:
if condition4:
# deeply nested code
# Good (early returns)
if not condition1:
return
if not condition2:
return
if not condition3:
return
if not condition4:
return
# flat code
SQL Injection :
# Bad
query = f"SELECT * FROM users WHERE id = {user_id}"
# Good
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))
XSS :
// Bad
element.innerHTML = userInput;
// Good
element.textContent = userInput;
Hardcoded secrets :
# Bad
API_KEY = "sk-1234567890abcdef"
# Good
API_KEY = os.environ.get("API_KEY")
Linters :
Security :
Code quality :
Weekly Installs
12.4K
Repository
GitHub Stars
88
First Seen
Jan 24, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
codex12.3K
gemini-cli12.3K
opencode12.2K
github-copilot12.2K
cursor12.2K
amp12.2K
React 组合模式指南:Vercel 组件架构最佳实践,提升代码可维护性
103,800 周安装