Code Review Assistant

When to use

Triggers:

"Review this code" / "Code review" / "Check this PR"
"Is this secure?" / "Audit this function"
"What's wrong with this?" / "Anything I'm missing?"
A pasted code block or PR link with feedback-intent
Before a commit / PR / merge

Don't fire for:

Full architectural review (use a different skill)
Performance profiling (use profiling tools, not code reading)
Whole-project security audit (use a security-review skill)
Style-only concerns — those belong in a linter

The review priority order

Review in this order. Stop at major if minor/nit aren't adding value:

1. Blockers — correctness bugs

These will break things. Non-negotiable.

Off-by-one errors — loop bounds, array indexing, date arithmetic
Null / undefined access — any .x where x might not exist
Race conditions — async code that doesn't handle concurrent execution
Type errors the TypeScript / PHP / Python typechecker might miss — especially at API boundaries (JSON parsing, form data)
Misapplied error handling — catch that swallows errors silently, throw where a user-visible fallback was expected
Forgotten async — await missing on a Promise, or async missing on a function that uses it
Logic inversions — !== where === was meant (or vice versa)
Dead code that runs — a fall-through in a switch, a missing return that silently continues

2. Security — what an attacker could exploit

Injection — SQL, NoSQL, command, LDAP, XPath. Does user input get interpolated anywhere unescaped?
XSS — does user input render in HTML without sanitisation? React/Vue/Svelte auto-escape but dangerouslySetInnerHTML / v-html / @html opt out.
Authorization bypass — does the endpoint check the user is allowed to access this resource, not just authenticated? (IDOR class)
CSRF — state-changing routes need origin verification or a token
Open redirect — does any redirect take user input for the destination?
Secrets in code — API keys, tokens, passwords, JWTs hardcoded or logged
Credentials in logs — does error handling print request bodies containing auth headers?
Rate limiting — auth, OTP, password reset, expensive ops should be rate-limited
Dependency CVEs — flag any npm audit / pip-audit / gem audit finding that touches this code path
Crypto misuse — MD5 / SHA1 for security (should be SHA-256+), static IVs, plain concatenation of password + salt instead of a KDF

For AU-specific privacy compliance:

Australian Privacy Principle (APP) 11 — security — is personal information adequately protected in this code path?
APP 8 — cross-border disclosure — does this code send PII to a US-based service without explicit consent or appropriate contractual protection?
Notifiable Data Breaches — does the error handling make an accidental breach more likely (logging PII to a third-party log service)?

3. Major — will cause problems soon

N+1 queries — loops that issue a DB query per iteration
Missing indexes — a WHERE clause on an unindexed column, on a table that'll grow
No timeout / circuit breaker on external calls — a slow third-party API will hold up your whole request
Memory leaks — event listeners never removed, subscriptions not unsubscribed, caches without eviction
Unbounded growth — arrays that grow indefinitely, logs that rotate without limits
Synchronous I/O on async runtime — a fs.readFileSync inside a Node.js request handler
Concurrent-safe? — if two instances of this service run, does the code handle them (idempotent, distributed lock, DB constraints)?
Error recovery — on failure, can the system retry safely (is the operation idempotent)?

4. Minor — worth fixing but not urgent

Code clarity — a comment would help the next reader; a variable name is misleading; a function does too much
Duplication — three near-identical blocks that could be one function
Magic numbers — unexplained constants; replace with named constants
Test coverage — new code without new tests; no test for the error path
Error messages — unhelpful errors bubble up to users

5. Nits — style and taste

Formatting, ordering, naming consistency
Preferred patterns ("use const", "prefer composition over inheritance")

Only raise these if the reviewer is otherwise quiet. They burn review goodwill.

Review output format

Per reviewed file / PR:

## [filename]:[function / range]

### Blockers
- Line N: [issue in one sentence]
  Fix: [specific change]
  Why: [1 sentence rationale]

### Major
- Line N: [issue]
  Fix: [suggestion]
  Why: [rationale]

### Minor
- Line N: [issue]
  Fix: [suggestion]

### Nits
- Line N: [style comment]

### What's good
- [one or two specific strengths — this matters for morale AND signal. Don't fabricate.]

End with:

Overall verdict — approve / approve with nits / needs changes / request changes on specific points
Estimated review time if author addresses — how long to fix the stated issues

Anti-patterns in reviews (avoid these)

Gish-gallop — listing 30 nits buries the 2 real issues
Stylistic rewrites — rewriting to match reviewer's style isn't review, it's preference
"I would have" — don't rewrite the PR; point at specific issues with specific fixes
Silent approval — if you can't point at a blocker, acknowledge what's good and approve
Unfounded certainty — "this won't scale" without numbers is opinion, not finding

AU-specific context

Date/time formatting — AU uses DD/MM/YYYY in user-facing contexts; verify consistency
Currency — AUD; flag any hardcoded USD assumptions
Privacy — APP 8 (cross-border) is often invisibly violated by "just use the US-hosted SaaS" default
Compliance for healthcare / finance / NDIS — extra attention to access logs, audit trails, consent management

What this skill does NOT do

Run the code. Static review only. For runtime issues, run tests / profiling / penetration tests.
Replace SAST / DAST tools. This is human-readable review. Tools catch different things.
Audit secrets in git history. Use a secret-scanning tool.
Deep-dive on novel cryptographic protocols. If the code uses a custom crypto scheme, escalate to a specialist.
Replace peer review from a senior engineer. For high-stakes code, human + AI > AI alone.

When to escalate

Flag for human / specialist review when you hit:

Novel cryptography (not using a standard library primitive)
Payment processing logic touching money flows
Authentication / authorisation changes
Changes to privacy-sensitive data paths
Any external-facing API surface
Changes that affect >10% of the codebase

Tier access

Base. Code review is broadly valuable for any technical user. Pro-tier members get a security-review variant that runs a deeper security-only pass.

Related skills

seo-audit — if the code review is for frontend SEO concerns
au-privacy-act-compliance-audit — if the code changes touch personal information handling
thl-react-spa-seo-remediation (internal) — if the code review is for a React SPA with indexing issues