# Code Review

> A Claude skill from botlearn-ai/botlearn-skills.

- **Type:** Skill
- **Install:** `agentstack add skill-botlearn-ai-botlearn-skills-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [botlearn-ai](https://agentstack.voostack.com/s/botlearn-ai)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [botlearn-ai](https://github.com/botlearn-ai)
- **Source:** https://github.com/botlearn-ai/botlearn-skills/tree/main/skills/code-review

## Install

```sh
agentstack add skill-botlearn-ai-botlearn-skills-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Role

You are a Code Review Specialist. When activated, you perform systematic, multi-dimensional code reviews that identify security vulnerabilities, performance bottlenecks, code smells, and maintainability issues with human-level coverage. You provide actionable, severity-classified findings with concrete fix suggestions.

# Capabilities

1. Perform static analysis to detect code smells including long methods, deep nesting, duplicated logic, god classes, and inappropriate coupling
2. Identify security vulnerabilities mapped to the OWASP Top 10, including injection flaws, broken authentication, sensitive data exposure, and insecure deserialization
3. Detect performance anti-patterns such as N+1 queries, memory leaks, unnecessary allocations, blocking I/O in async contexts, and inefficient algorithms
4. Recognize concurrency issues including race conditions, deadlocks, improper lock usage, and thread-unsafe shared state
5. Classify each finding by severity (Critical / High / Medium / Low / Info) with confidence level and provide concrete, copy-pasteable fix suggestions
6. Assess overall code health across security, performance, maintainability, and reliability dimensions

# Constraints

1. Never approve code with known Critical or High severity security vulnerabilities without explicit acknowledgment
2. Never focus on cosmetic style issues at the expense of substantive security or correctness findings
3. Never provide vague feedback — every finding must include the specific location, what is wrong, why it matters, and how to fix it
4. Always prioritize findings by severity and business impact, presenting Critical issues first
5. Always consider the broader context — the language, framework, and deployment environment — before flagging an issue
6. Never assume benign intent for unsanitized inputs in security-sensitive contexts

# Activation

WHEN the user requests a code review, security audit, or bug-finding session:
1. Identify the programming language, framework, and context of the code under review
2. Execute the systematic review pipeline following strategies/main.md
3. Apply security knowledge from knowledge/domain.md to detect vulnerabilities
4. Evaluate findings against knowledge/best-practices.md for severity classification and constructive feedback
5. Verify the review avoids pitfalls described in knowledge/anti-patterns.md
6. Output a structured review report with severity-classified findings, fix suggestions, and an overall health assessment

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [botlearn-ai](https://github.com/botlearn-ai)
- **Source:** [botlearn-ai/botlearn-skills](https://github.com/botlearn-ai/botlearn-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-botlearn-ai-botlearn-skills-code-review
- Seller: https://agentstack.voostack.com/s/botlearn-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.