# Code Review

> Structured code review with security, performance, and quality checks

- **Type:** Skill
- **Install:** `agentstack add skill-anthroos-claude-code-orchestrator-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [anthroos](https://agentstack.voostack.com/s/anthroos)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [anthroos](https://github.com/anthroos)
- **Source:** https://github.com/anthroos/claude-code-orchestrator/tree/main/skills/examples/code-review

## Install

```sh
agentstack add skill-anthroos-claude-code-orchestrator-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Review

> Review code changes against a structured checklist covering security, performance, architecture, and correctness.

## When to use

- "Review this PR"
- "Check my code"
- "Code review for #123"
- Before merging any PR

## How to execute

### Step 1: Load the changes

```bash
# For a PR
gh pr diff 

# For local changes
git diff main...HEAD
```

### Step 2: Review checklist

Go through each category:

#### Security
- [ ] No hardcoded secrets, API keys, or credentials
- [ ] User input is validated and sanitized
- [ ] No SQL injection, XSS, or command injection vectors
- [ ] Authentication/authorization checks in place
- [ ] Sensitive data not logged or exposed in errors

#### Correctness
- [ ] Logic handles edge cases (null, empty, negative, overflow)
- [ ] Error handling is appropriate (not swallowed, not over-caught)
- [ ] Race conditions considered for concurrent code
- [ ] Resource cleanup (files, connections, locks)

#### Performance
- [ ] No N+1 queries or unnecessary loops
- [ ] Large datasets paginated or streamed
- [ ] Caching used where appropriate
- [ ] No blocking operations in async code

#### Architecture
- [ ] Changes follow existing patterns in the codebase
- [ ] No unnecessary dependencies added
- [ ] Public API surface is intentional
- [ ] No dead code or commented-out blocks

#### Tests
- [ ] New code has tests
- [ ] Edge cases are covered
- [ ] Tests are deterministic (no flaky tests)

### Step 3: Report findings

Format: severity + file + line + description

```
[CRITICAL] src/auth.py:42 — SQL query built with string concatenation
[WARNING] src/api.py:108 — Missing error handling for network timeout
[SUGGESTION] src/utils.py:15 — Could use list comprehension for clarity
```

### Step 4: Summary

Provide:
1. Overall assessment (approve / request changes / needs discussion)
2. Critical issues (must fix before merge)
3. Suggestions (nice to have)

## Parameters

| Parameter | Description | Default |
|-----------|-------------|---------|
| PR number | GitHub PR to review | current branch diff |
| `--focus security` | Focus on security checks only | all checks |

## Related skills

- `git-workflow` — merge after review passes

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [anthroos](https://github.com/anthroos)
- **Source:** [anthroos/claude-code-orchestrator](https://github.com/anthroos/claude-code-orchestrator)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-anthroos-claude-code-orchestrator-code-review
- Seller: https://agentstack.voostack.com/s/anthroos
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.