code-review

Use for code/PR review, audits, bug/security checks, reviewing diffs or changes, and finding issues in code.

62stars3forksUpdated 6/18/2026

Security Code Review Git & Version Control #security #static-analysis #quality-assurance #bug-detection #code-review #git

Security Assessment

Low Risk(80/100)

Detected risks:

Command Injection([references/profiles/python.md] shell=True)

Security Score80/100

About code-review

The code-review skill is a comprehensive code analysis tool designed to identify high-impact defects in changed code with evidence-based findings. It prioritizes critical issues like security vulnerabilities, correctness problems, and behavioral regressions over stylistic concerns, making it ideal for pull request reviews, security audits, and pre-commit quality checks.

This skill offers intelligent scope resolution that can target specific files, commit ranges, or automatically detect session-modified and uncommitted changes. It applies a core set of review checks covering behavior regressions, error-path safety, boundary handling, resource leaks, complexity hotspots, and test coverage gaps. Additionally, it supports domain-specific profiles for specialized analysis in areas like security and configuration management. The tool can operate in report-only mode or automatically apply fixes with the --fix flag, followed by verification.

Developers performing code reviews, security engineers conducting audits, and teams implementing quality gates will benefit from this skill. It's particularly valuable for catching subtle bugs that might slip through manual review, ensuring error handling is robust, and identifying security issues in authentication, input handling, and configuration code. The severity-based reporting and optional auto-fix capability make it suitable for both interactive review sessions and automated CI/CD pipelines.

FAQ

What scope does code-review analyze if I don't specify files?

By default, it reviews files modified in the current session. If no session history is available, it falls back to all uncommitted changes (both tracked and untracked files), automatically excluding generated files like lockfiles and build outputs.

How does the --fix flag work?

With --fix enabled, the skill automatically applies all suggested fixes in severity order (CRITICAL → HIGH → MEDIUM → LOW) after reporting findings, then runs verification checks. Without this flag, it reports findings and waits for your confirmation before making any changes.

Can I skip certain types of checks?

Yes, use the --skip-profile flag to exclude specific domain profiles (e.g., --skip-profile security or --skip-profile naming). This flag can be repeated to skip multiple profiles. Core checks always run unless explicitly skipped.

Does this work outside of git repositories?

No, code-review requires a git repository context. It verifies the repository with git rev-parse --git-dir before proceeding and will stop with an error if run outside a git repository.

What severity levels are used for findings?

Findings are assigned severity levels including CRITICAL, HIGH, MEDIUM, and LOW. The severity model prioritizes security issues, correctness problems, and behavioral regressions as high-severity, while style and complexity concerns are typically medium or low.