code-review by llama-farm/llamafarm
npx skills add https://github.com/llama-farm/llamafarm --skill code-review你正在对一份差异文件进行全面的代码审查。你的任务是分析变更代码中的安全漏洞、反模式和质量问题。
此技能期望在调用前,上下文中已提供一份差异文件。调用方负责生成差异文件。
调用示例:
/code-reviewgit diff HEAD~1,然后调用此技能如果上下文中没有差异文件,请要求用户提供或主动生成一个(例如,git diff、git diff main..HEAD)。
根据差异文件中的目录路径自动检测应应用哪些检查清单:
| 目录 | 领域 | 检查清单 |
|---|---|---|
designer/ |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
| 前端 |
读取 frontend.md |
server/ | 后端 | 读取 backend.md |
rag/ | 后端 | 读取 backend.md |
runtimes/universal/ | 后端 | 读取 backend.md |
cli/ | CLI/Go | 仅通用检查 |
config/ | 配置 | 仅通用检查 |
如果差异文件涉及多个领域,则加载所有相关的检查清单。
从差异文件中提取:
使用临时文件模式创建审查文档:
SANITIZED_PATH=$(echo "$PWD" | tr '/' '-')
REPORT_DIR="/tmp/claude/${SANITIZED_PATH}/reviews"
mkdir -p "$REPORT_DIR"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
FILEPATH="${REPORT_DIR}/code-review-${TIMESTAMP}.md"
使用以下模式初始化:
# 代码审查报告
**日期**: {当前日期}
**审查者**: 代码审查代理
**来源**: {例如,"PR 差异文件"、"未暂存的更改"、"main..HEAD"}
**变更文件**: {数量}
**检测到的领域**: {列表}
**状态**: 进行中
## 摘要
| 类别 | 检查项 | 通过 | 失败 | 发现 |
| :--- | :--- | :--- | :--- | :--- |
| 安全 | 0 | 0 | 0 | 0 |
| 代码质量 | 0 | 0 | 0 | 0 |
| LLM 代码异味 | 0 | 0 | 0 | 0 |
| 影响分析 | 0 | 0 | 0 | 0 |
| 简化 | 0 | 0 | 0 | 0 |
{基于检测到的领域添加的领域特定类别}
## 详细发现
{随着审查进展,将发现的问题添加至此}
针对每个检查清单项:
关键原则:审查的对象是差异文件。文件的其余部分提供上下文以使审查更准确。
检查差异文件是否可能影响代码库的其他部分:
将任何未考虑的影响作为发现项报告,严重性基于风险。
对于发现的每个问题,添加一个条目:
### [{类别}] {项目名称}
**状态**: 失败
**严重性**: 严重 | 高 | 中 | 低
**范围**: 变更代码 | 影响分析
#### 违规
- **文件**: `path/to/file.ext`
- **行号**: 42-48 (来自差异文件)
- **代码**:
// 来自差异文件的问题代码片段
- **问题**: {解释错误所在}
- **建议**: {如何修复}
完成所有检查后:
这些检查适用于所有变更代码,无论其所属领域。
检查差异文件中的:
api_key、apiKey、password、secret、token、credential通过标准:差异文件中没有硬编码密钥(应使用环境变量) 严重性:严重
检查差异文件中的:
eval(、new Function(、setTimeout("、setInterval("eval(、exec(、compile(通过标准:变更行中没有动态代码执行 严重性:严重
检查差异文件中的:
shell=True 的 subprocess、os.system(exec.Command(通过标准:shell 命令中没有未验证的用户输入 严重性:严重
检查差异文件中的:
console.log、console.debug、console.infoprint( 语句通过标准:生产代码变更中没有调试语句 严重性:低
检查差异文件中的:
TODO:、FIXME:、HACK:、XXX: 注释通过标准:新的 TODO 应在问题跟踪系统中记录 严重性:低
检查差异文件中的:
catch { } 或 catch(e) { }except: pass 或空的 except 块通过标准:所有错误处理程序都应记录或重新抛出错误 严重性:高
检查差异文件中的:
TODO、PLACEHOLDER、IMPLEMENT、NotImplementedreturn None、return []、return {} 的函数通过标准:生产代码中没有占位符实现 严重性:高
检查差异文件中的:
GenericHandler、BaseManager、AbstractFactory 的新类/函数通过标准:抽象应基于实际的复用需求 严重性:低
检查差异文件是否修改了:
通过标准:所有受影响的代码都已识别并考虑在内 严重性:高(如果发现未考虑的影响)
检查差异文件中的:
通过标准:变更代码中没有明显的重复 严重性:中 建议:将共享逻辑提取到可重用函数中
检查差异文件中的:
通过标准:代码结构合理扁平且专注 严重性:中 建议:使用提前返回、提取辅助函数
检查差异文件中的:
通过标准:代码使用惯用模式 严重性:低 建议:使用语言内置功能进行简化
基于检测到的领域,读取并应用相应的检查清单:
designer/): 读取 frontend.md 并将这些检查应用于变更代码server/、rag/、runtimes/): 读取 backend.md 并将这些检查应用于变更代码## 执行摘要
**审查完成时间**: {时间戳}
**总发现数**: {数量}
### 关键问题(必须修复)
1. {问题 1}
2. {问题 2}
### 影响分析结果
- {任何破坏性变更或未考虑影响的摘要}
### 高优先级(应该修复)
1. {问题 1}
2. {问题 2}
### 建议
{基于所审查变更的总体建议}
每周安装量
1.2K
仓库
GitHub 星标数
824
首次出现
2026年1月22日
安全审计
安装于
opencode939
codex938
gemini-cli937
github-copilot935
amp933
kimi-cli932
You are performing a comprehensive code review on a diff. Your task is to analyze the changed code for security vulnerabilities, anti-patterns, and quality issues.
This skill expects a diff to be provided in context before invocation. The caller is responsible for generating the diff.
Example invocations:
/code-reviewgit diff HEAD~1, then invokes this skillIf no diff is present in context, ask the user to provide one or offer to generate one (e.g., git diff, git diff main..HEAD).
Auto-detect which checklists to apply based on directory paths in the diff:
| Directory | Domain | Checklist |
|---|---|---|
designer/ | Frontend | Read frontend.md |
server/ | Backend | Read backend.md |
rag/ | Backend | Read backend.md |
runtimes/universal/ | Backend | Read backend.md |
If the diff spans multiple domains, load all relevant checklists.
Extract from the diff:
Create a review document using the temp-files pattern :
SANITIZED_PATH=$(echo "$PWD" | tr '/' '-')
REPORT_DIR="/tmp/claude/${SANITIZED_PATH}/reviews"
mkdir -p "$REPORT_DIR"
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
FILEPATH="${REPORT_DIR}/code-review-${TIMESTAMP}.md"
Initialize with this schema:
# Code Review Report
**Date**: {current date}
**Reviewer**: Code Review Agent
**Source**: {e.g., "PR diff", "unstaged changes", "main..HEAD"}
**Files Changed**: {count}
**Domains Detected**: {list}
**Status**: In Progress
## Summary
| Category | Items Checked | Passed | Failed | Findings |
|----------|---------------|--------|--------|----------|
| Security | 0 | 0 | 0 | 0 |
| Code Quality | 0 | 0 | 0 | 0 |
| LLM Code Smells | 0 | 0 | 0 | 0 |
| Impact Analysis | 0 | 0 | 0 | 0 |
| Simplification | 0 | 0 | 0 | 0 |
{domain-specific categories added based on detected domains}
## Detailed Findings
{findings added here as review progresses}
For EACH checklist item:
Key principle : The diff is what gets reviewed. The rest of the file provides context to make that review accurate.
Check if the diff might affect other parts of the codebase:
Report any unaccounted-for impacts as findings with severity based on risk.
For each issue found, add an entry:
### [{CATEGORY}] {Item Name}
**Status**: FAIL
**Severity**: Critical | High | Medium | Low
**Scope**: Changed code | Impact analysis
#### Violation
- **File**: `path/to/file.ext`
- **Line(s)**: 42-48 (from diff)
- **Code**:
// problematic code snippet from diff
- **Issue**: {explanation of what's wrong}
- **Recommendation**: {how to fix it}
After completing all checks:
These checks apply to ALL changed code regardless of domain.
Check diff for :
api_key, apiKey, password, secret, token, credential with literal valuesPass criteria : No hardcoded secrets in diff (should use environment variables) Severity : Critical
Check diff for :
eval(, new Function(, setTimeout(", setInterval("eval(, exec(, compile(Pass criteria : No dynamic code execution in changed lines Severity : Critical
Check diff for :
subprocess with shell=True, os.system(exec.Command( with unsanitized inputPass criteria : No unvalidated user input in shell commands Severity : Critical
Check diff for :
console.log, console.debug, console.infoprint( statementsPass criteria : No debug statements in production code changes Severity : Low
Check diff for :
TODO:, FIXME:, HACK:, XXX: commentsPass criteria : New TODOs should be tracked in issues Severity : Low
Check diff for :
catch { } or catch(e) { }except: pass or empty except blocksPass criteria : All error handlers log or rethrow Severity : High
Check diff for :
TODO, PLACEHOLDER, IMPLEMENT, NotImplementedreturn None, return [], return {}Pass criteria : No placeholder implementations in production code Severity : High
Check diff for :
GenericHandler, BaseManager, AbstractFactoryPass criteria : Abstractions are justified by actual reuse Severity : Low
Check if diff modifies :
Pass criteria : All impacted code identified and accounted for Severity : High (if unaccounted impacts found)
Check diff for :
Pass criteria : No obvious duplication in changed code Severity : Medium Suggestion : Extract shared logic into reusable functions
Check diff for :
Pass criteria : Code is reasonably flat and focused Severity : Medium Suggestion : Use early returns, extract helper functions
Check diff for :
Pass criteria : Code uses idiomatic patterns Severity : Low Suggestion : Simplify using language built-ins
Based on detected domains, read and apply the appropriate checklists:
designer/): Read frontend.md and apply those checks to changed codeserver/, rag/, runtimes/): Read backend.md and apply those checks to changed code## Executive Summary
**Review completed**: {timestamp}
**Total findings**: {count}
### Critical Issues (Must Fix)
1. {issue 1}
2. {issue 2}
### Impact Analysis Results
- {summary of any breaking changes or unaccounted impacts}
### High Priority (Should Fix)
1. {issue 1}
2. {issue 2}
### Recommendations
{Overall recommendations based on the changes reviewed}
Scope to diff : Only flag issues in the changed lines. Don't review unchanged code.
Use context : Read full files to understand the changes, but feedback targets the diff only.
Check impacts : When changes touch exports, APIs, or shared code, search for affected consumers.
Be specific : Include file paths, line numbers (from diff), and code snippets for every finding.
Prioritize : Flag critical security issues immediately.
Provide solutions : Each finding should include a recommendation for how to fix it.
Update incrementally : Update the review document after each category, not at the end.
Weekly Installs
1.2K
Repository
GitHub Stars
824
First Seen
Jan 22, 2026
Security Audits
Gen Agent Trust HubFailSocketPassSnykFail
Installed on
opencode939
codex938
gemini-cli937
github-copilot935
amp933
kimi-cli932
React 组合模式指南:Vercel 组件架构最佳实践,提升代码可维护性
102,200 周安装
cli/ | CLI/Go | Generic checks only |
config/ | Config | Generic checks only |