# Code Review > Guidelines and checklist for performing rigorous AI-based code reviews emphasizing test coverage, naming, DRY principles, and standards alignment. - **Type:** Skill - **Install:** `agentstack add skill-apinstein-skills-code-review` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [apinstein](https://agentstack.voostack.com/s/apinstein) - **Installs:** 0 - **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [apinstein](https://github.com/apinstein) - **Source:** https://github.com/apinstein/skills/tree/main/skills/code-review ## Install ```sh agentstack add skill-apinstein-skills-code-review ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # Code Review Skill When performing a code review, follow this checklist to ensure high quality, maintainable code. Your review should be rigorous, catching both macro architectural missteps and micro implementation flaws. ## 1. Project-Specific Standards - [ ] **Coding Standards**: Does the code strictly adhere to the project's specifically documented coding standards? (Reference project-local documentation first). ## 2. General Code Quality - [ ] **Idiomatic Implementation**: Is the code written using APIs, patterns, and architectural semantics that are idiomatic to the specific host environment being modified? Especially in monorepos, explicitly verify that you are evaluating the code within its correct context (e.g., Apple ecosystem paradigms for Swift, TS/React paradigms for the web) rather than applying generalized defaults. - [ ] **Naming Conventions**: Are the names for variables, functions, and classes clear, descriptive, and accurately reflective of their intent, while remaining consistent with the overall naming patterns of the project and its ecosystem? (Think hard about this—bad naming is technical debt). - [ ] **Inline Documentation**: Are non-trivial implementations properly documented with inline comments or docstrings? Documentation should explain the *why* and the intent behind complex logic to a "future version of yourself" in a way that makes the function immediately easy to grok. - [ ] **Readability & Complexity**: Is the logic overly "clever" or unnecessarily complex? Ensure the code is simplified or factored cleanly so that future developers can easily comprehend it. - [ ] **The Boy Scout Rule (No Lazy Defers)**: Did the coder leave trivial "will fix later" or "TODO" notes out of laziness? AI coders have the capacity to apply trivial improvements instantly; code must be left better than it was found. (Note: Carefully distinguish this from initiating massive, spiraling refactors, which violates the Scope Creep rule). ## 3. Test Coverage - [ ] **Coverage of Affected Code**: Is there robust automated test coverage that achieves high, rigorous coverage specifically on the lines and branches of code that were created or modified? (The *diff* itself must be thoroughly covered). - [ ] **Verification & Test Matrix**: Assert that tests form a proper "test matrix" covering materially different input ranges (to trigger distinct behaviors) as well as pathological cases where explicit guards and edge-case handling are required. ## 4. DRY Principle (Don't Repeat Yourself) - [ ] **Reinventing the Wheel**: Does the code duplicate functionality that already exists elsewhere in the codebase? (Crucial: identify if existing utilities, helpers, or pattern language classes should have been used instead). - [ ] **Test Helpers & Fixtures**: In test suites, are redundant setup functions, mock object factories, and standardized test data factored out into shared helper utilities rather than being copy-pasted across multiple test cases? ## 5. Architecture and Logic - [ ] **Error Handling**: Are all reasonable failure modes and edge cases anticipated and handled gracefully? - [ ] **Scope Creep**: Are the code changes strictly constrained to the stated goals? Call out any unprovoked refactoring or unrelated changes. - [ ] **Data Migrations**: If changes involve schema updates or data transformations, assess the rollout risk. Are migrations safe, reversible, and designed to run without locking core tables or causing downtime? - [ ] **Performance**: Are there any obvious performance bottlenecks (e.g., N+1 queries, unnecessary loop iterations, or large object allocations)? - [ ] **Security**: Does the code introduce any vulnerabilities? Look specifically for missing authentication/authorization guards on new routes, unsanitized inputs susceptible to injection, or accidental exposure of secrets/PII. - [ ] **Observability**: Does the code emit appropriate logs or metrics for production debugging without exposing sensitive data? - [ ] **Backward Compatibility**: If this alters APIs, database schemas, or exported modules, is it backward compatible? Ensure that any breaking changes are explicitly highlighted and that downstream consequences are handled. - [ ] **Concurrency & Thread Safety**: Is the code thread-safe? Ensure that no race conditions or deadlocks are introduced, particularly in asynchronous operations. - [ ] **Coupling & Domain Boundaries**: Does the change inappropriately couple two separate domains or modules (e.g., UI code leaking into the database layer)? Ensure strict modular boundaries are respected. ## 6. Output and Action Present your findings as a structured code review. If applicable, provide the exact diffs or replacement blocks required to resolve the issues you found, or proactively patch the code based on the established workflow. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [apinstein](https://github.com/apinstein) - **Source:** [apinstein/skills](https://github.com/apinstein/skills) - **License:** MIT Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-apinstein-skills-code-review - Seller: https://agentstack.voostack.com/s/apinstein - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.