# Code Review Checklist

> Generate context-aware code review checklists for changes

- **Type:** Skill
- **Install:** `agentstack add skill-manastalukdar-ai-devstudio-code-review-checklist`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [manastalukdar](https://agentstack.voostack.com/s/manastalukdar)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [manastalukdar](https://github.com/manastalukdar)
- **Source:** https://github.com/manastalukdar/ai-devstudio/tree/main/skills/code-review-checklist

## Install

```sh
agentstack add skill-manastalukdar-ai-devstudio-code-review-checklist
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Review Checklist Generator

I'll generate comprehensive, context-aware code review checklists based on your changes.

Arguments: `$ARGUMENTS` - branch name, commit range, or PR number (optional)

## Checklist Philosophy

Generate checklists that are:
- Framework-specific and relevant
- Based on actual changes, not generic
- Security-focused for sensitive changes
- Performance-aware for critical paths
- Actionable and measurable

## Token Optimization

This skill uses multiple optimization strategies to minimize token usage while maintaining comprehensive checklist generation:

### 1. Git Diff Statistics for Overview (800 token savings)

**Pattern:** Use git diff --stat instead of reading all changed files

```bash
# Instead of: Read all changed files (1,200+ tokens)
# Use: git diff --stat (400 tokens)

# Get high-level overview
git diff --stat "$BASE_BRANCH"...HEAD

# Count changes without reading files
total_files=$(git diff --name-only "$BASE_BRANCH"...HEAD | wc -l)
additions=$(git diff --numstat "$BASE_BRANCH"...HEAD | awk '{sum+=$1} END {print sum}')
deletions=$(git diff --numstat "$BASE_BRANCH"...HEAD | awk '{sum+=$2} END {print sum}')
```

**Savings:**
- Git stats: ~400 tokens (metadata only)
- Full file read: ~1,200 tokens (all changed files)
- **800 token savings (67%)**

### 2. Codebase Analysis Caching (600 token savings)

**Pattern:** Cache framework/stack detection results

```bash
# Cache file: .code-review-stack.cache
# Format: JSON with detected technologies
# TTL: 24 hours (stack rarely changes)

if [ -f ".code-review-stack.cache" ] && [ $(($(date +%s) - $(stat -c %Y .code-review-stack.cache))) -lt 86400 ]; then
    # Read cached stack (80 tokens)
    STACK=$(cat .code-review-stack.cache)
else
    # Full stack detection (680 tokens)
    detect_stack
    echo "$STACK" > .code-review-stack.cache
fi
```

**Savings:**
- Cached: ~80 tokens (read cache file)
- Uncached: ~680 tokens (package.json/requirements.txt analysis, multiple Grep operations)
- **600 token savings (88%)** for subsequent runs

### 3. Template-Based Checklist Generation (1,800 token savings)

**Pattern:** Use comprehensive pre-defined checklist template with conditional sections

```bash
# Instead of: LLM-generated checklist (2,200+ tokens)
# Use: Template-based checklist (400 tokens)

generate_checklist_template() {
    cat templates/base-checklist.md  # Base template (300 tokens)

    # Add framework-specific sections conditionally
    if [ "$HAS_REACT" = "true" ]; then
        cat templates/react-checklist.md  # 100 tokens
    fi

    if [ "$HAS_SECURITY_CHANGES" = "true" ]; then
        cat templates/security-checklist.md  # 150 tokens
    fi
}
```

**Savings:**
- Template-based: ~400 tokens (template assembly)
- LLM-generated: ~2,200 tokens (full checklist generation with analysis)
- **1,800 token savings (82%)** per checklist

### 4. Focus Area Filtering (1,000 token savings)

**Pattern:** Generate only relevant checklist sections based on changes

```bash
# Instead of: Full comprehensive checklist (3,000+ tokens)
# Generate: Focused checklist (800 tokens)

# Analyze change categories
has_frontend=$(git diff --name-only "$BASE_BRANCH"...HEAD | grep -q '\.(tsx|jsx|vue)$' && echo "true" || echo "false")
has_backend=$(git diff --name-only "$BASE_BRANCH"...HEAD | grep -q '\.(py|go|java)$' && echo "true" || echo "false")
has_tests=$(git diff --name-only "$BASE_BRANCH"...HEAD | grep -q 'test\|spec' && echo "true" || echo "false")

# Include only relevant sections
[ "$has_frontend" = "true" ] && include_section "Frontend Performance"
[ "$has_backend" = "true" ] && include_section "API Design"
[ "$has_tests" = "true" ] && include_section "Test Quality"
```

**Savings:**
- Focused checklist: ~800 tokens (3-5 relevant sections)
- Full checklist: ~3,000 tokens (all 10 sections)
- **1,000 token savings (73%)** for focused reviews

### 5. Early Exit for No Changes (95% savings)

**Pattern:** Detect no changes immediately

```bash
# Quick check: Are there any changes?
if ! git diff --quiet "$BASE_BRANCH"...HEAD; then
    CHANGE_COUNT=$(git diff --name-only "$BASE_BRANCH"...HEAD | wc -l)

    if [ "$CHANGE_COUNT" -eq 0 ]; then
        echo "✓ No changes to review"
        exit 0  # 100 tokens total
    fi
else
    echo "✓ No changes to review"
    exit 0
fi

# Otherwise: Full checklist generation (2,500+ tokens)
```

**Savings:**
- No changes: ~100 tokens (early exit)
- Full generation: ~2,500+ tokens
- **2,400+ token savings (96%)** when no changes exist

### 6. Security Risk Pattern Matching (500 token savings)

**Pattern:** Use Grep for security pattern detection instead of full file analysis

```bash
# Instead of: Read files for security analysis (800 tokens)
# Use: Grep for security patterns (300 tokens)

# Detect authentication changes
git diff "$BASE_BRANCH"...HEAD | grep -i -E "auth|login|password|token|jwt" > /dev/null && AUTH_CHANGES=true

# Detect SQL queries
git diff "$BASE_BRANCH"...HEAD | grep -E "query|execute|raw|sql" > /dev/null && SQL_CHANGES=true

# Detect file operations
git diff "$BASE_BRANCH"...HEAD | grep -E "fs\.|readFile|writeFile" > /dev/null && FILE_OPS=true
```

**Savings:**
- Grep patterns: ~300 tokens
- Full file analysis: ~800 tokens (read changed files)
- **500 token savings (62%)**

### 7. Checklist Section Caching (400 token savings)

**Pattern:** Cache common checklist sections for reuse

```bash
# Cache file: .code-review-sections.cache
# Contains pre-loaded checklist sections
# TTL: 24 hours

load_sections() {
    local cache_file=".code-review-sections.cache"

    if [ -f "$cache_file" ]; then
        source "$cache_file"  # 100 tokens
        return
    fi

    # Load all sections (500 tokens)
    SECTION_CODE_QUALITY=$(cat templates/code-quality.md)
    SECTION_SECURITY=$(cat templates/security.md)
    SECTION_PERFORMANCE=$(cat templates/performance.md)
    # ... more sections

    declare -p SECTION_* > "$cache_file"
}
```

**Savings:**
- Cached sections: ~100 tokens
- Load sections: ~500 tokens (multiple file reads)
- **400 token savings (80%)** for subsequent runs

### 8. File Category Analysis Optimization (300 token savings)

**Pattern:** Use awk for efficient file categorization

```bash
# Instead of: Multiple grep operations (500 tokens)
# Use: Single awk command (200 tokens)

git diff --name-only "$BASE_BRANCH"...HEAD | awk -F'/' '{
    if ($0 ~ /test/) tests++
    else if ($0 ~ /\.md$/) docs++
    else if ($0 ~ /\.(ts|js|tsx|jsx)$/) frontend++
    else if ($0 ~ /\.(py|go|java|rb)$/) backend++
    else if ($0 ~ /\.(yml|yaml|json|toml)$/) config++
    else others++
}
END {
    if (tests) print "Tests: " tests
    if (docs) print "Documentation: " docs
    if (frontend) print "Frontend: " frontend
    if (backend) print "Backend: " backend
    if (config) print "Config: " config
    if (others) print "Other: " others
}'
```

**Savings:**
- Awk categorization: ~200 tokens
- Multiple Grep operations: ~500 tokens
- **300 token savings (60%)**

### 9. Real-World Token Usage Distribution

**Typical Scenarios:**

1. **First Run - Medium PR (1,800-2,500 tokens)**
   - Git diff stats: 400 tokens
   - Stack detection: 680 tokens
   - File categorization: 200 tokens
   - Security analysis: 300 tokens
   - Generate focused checklist: 800 tokens
   - **Total: ~2,380 tokens**

2. **Subsequent Run - Same Stack (1,000-1,500 tokens)**
   - Git diff stats: 400 tokens
   - Stack detection (cached): 80 tokens
   - File categorization: 200 tokens
   - Security analysis: 300 tokens
   - Load sections (cached): 100 tokens
   - Generate checklist: 400 tokens
   - **Total: ~1,480 tokens**

3. **No Changes to Review (80-120 tokens)**
   - Git diff check: 50 tokens
   - Early exit: 50 tokens
   - **Total: ~100 tokens**

4. **Large PR with Multiple Areas (2,500-3,500 tokens)**
   - Git diff stats: 400 tokens
   - Stack detection: 680 tokens
   - File categorization: 200 tokens
   - Security analysis: 300 tokens
   - Performance analysis: 300 tokens
   - Generate comprehensive checklist: 2,000 tokens
   - **Total: ~3,880 tokens**

5. **Small Frontend Change (800-1,200 tokens)**
   - Git diff stats: 400 tokens
   - Stack detection (cached): 80 tokens
   - File categorization: 200 tokens
   - Generate focused frontend checklist: 400 tokens
   - **Total: ~1,080 tokens**

**Expected Token Savings:**
- **Average 40% reduction** from baseline (2,500 → 1,500 tokens)
- **96% reduction** when no changes exist
- **Aggregate savings: 1,000-1,500 tokens** per checklist generation

### Optimization Summary

| Strategy | Savings | When Applied |
|----------|---------|--------------|
| Git diff statistics | 800 tokens (67%) | Always |
| Codebase analysis caching | 600 tokens (88%) | Subsequent runs |
| Template-based generation | 1,800 tokens (82%) | Always |
| Focus area filtering | 1,000 tokens (73%) | Focused reviews |
| Early exit for no changes | 2,400 tokens (96%) | No changes |
| Security pattern matching | 500 tokens (62%) | Always |
| Checklist section caching | 400 tokens (80%) | Subsequent runs |
| File categorization optimization | 300 tokens (60%) | Always |

**Key Insight:** The combination of git diff statistics, template-based generation, and focus area filtering provides 40-50% token reduction while maintaining comprehensive review guidance. Early exit patterns provide 96% savings when no changes exist.

## Pre-Flight Checks

Before generating checklist, I'll verify:
- Git repository exists
- Changes to review exist
- Can access modified files
- Framework/stack detected

Checklist Strategy:
- What files changed?
- What frameworks are involved?
- Are there security implications?
- Performance impacts?
- What testing is needed?

First, let me analyze the changes:

```bash
#!/bin/bash
# Analyze changes for review checklist

set -e

echo "=== Code Review Analysis ==="
echo ""

# Parse arguments for branch/commit range
TARGET="${ARGUMENTS:-HEAD}"

# 1. Verify git repository
if ! git rev-parse --git-dir > /dev/null 2>&1; then
    echo "Error: Not a git repository"
    exit 1
fi

# 2. Determine comparison target
echo "Review Target: $TARGET"
echo ""

# 3. Get changed files
echo "Changed Files:"
if [ "$TARGET" = "HEAD" ]; then
    # Compare with main/master
    BASE_BRANCH=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@' || echo "main")
    git diff --stat "$BASE_BRANCH"...HEAD
else
    git diff --stat "$TARGET"
fi
echo ""

# 4. Count changes
total_files=$(git diff --name-only "$BASE_BRANCH"...HEAD 2>/dev/null | wc -l || echo "0")
additions=$(git diff --numstat "$BASE_BRANCH"...HEAD 2>/dev/null | awk '{sum+=$1} END {print sum}' || echo "0")
deletions=$(git diff --numstat "$BASE_BRANCH"...HEAD 2>/dev/null | awk '{sum+=$2} END {print sum}' || echo "0")

echo "Change Summary:"
echo "  Files changed: $total_files"
echo "  Lines added: $additions"
echo "  Lines deleted: $deletions"
echo ""

# 5. Categorize changes
echo "File Categories:"
git diff --name-only "$BASE_BRANCH"...HEAD 2>/dev/null | awk -F'/' '{
    if ($0 ~ /test/) tests++
    else if ($0 ~ /\.md$/) docs++
    else if ($0 ~ /\.(ts|js|tsx|jsx)$/) frontend++
    else if ($0 ~ /\.(py|go|java|rb)$/) backend++
    else if ($0 ~ /\.(yml|yaml|json|toml)$/) config++
    else if ($0 ~ /\.(css|scss|sass)$/) styles++
    else others++
}
END {
    if (tests) print "  Tests: " tests
    if (docs) print "  Documentation: " docs
    if (frontend) print "  Frontend: " frontend
    if (backend) print "  Backend: " backend
    if (config) print "  Config: " config
    if (styles) print "  Styles: " styles
    if (others) print "  Other: " others
}'
echo ""
```

## Phase 1: Framework & Stack Detection

Detect technologies to generate relevant checks:

```bash
#!/bin/bash
# Detect frameworks and technologies

detect_stack() {
    echo "=== Technology Stack Detection ==="
    echo ""

    # Frontend frameworks
    if [ -f "package.json" ]; then
        echo "JavaScript/TypeScript:"
        if grep -q "\"react\":" package.json; then
            echo "  ✓ React"
        fi
        if grep -q "\"vue\":" package.json; then
            echo "  ✓ Vue"
        fi
        if grep -q "\"next\":" package.json; then
            echo "  ✓ Next.js"
        fi
        if grep -q "\"angular\":" package.json; then
            echo "  ✓ Angular"
        fi
        echo ""
    fi

    # Backend frameworks
    if [ -f "requirements.txt" ] || [ -f "pyproject.toml" ]; then
        echo "Python:"
        if grep -q "django" requirements.txt 2>/dev/null || grep -q "django" pyproject.toml 2>/dev/null; then
            echo "  ✓ Django"
        fi
        if grep -q "flask" requirements.txt 2>/dev/null || grep -q "flask" pyproject.toml 2>/dev/null; then
            echo "  ✓ Flask"
        fi
        if grep -q "fastapi" requirements.txt 2>/dev/null || grep -q "fastapi" pyproject.toml 2>/dev/null; then
            echo "  ✓ FastAPI"
        fi
        echo ""
    fi

    # Database
    if [ -f "package.json" ]; then
        echo "Database:"
        if grep -q "\"prisma\":" package.json; then
            echo "  ✓ Prisma ORM"
        fi
        if grep -q "\"typeorm\":" package.json; then
            echo "  ✓ TypeORM"
        fi
        if grep -q "\"pg\":" package.json || grep -q "\"postgres\":" package.json; then
            echo "  ✓ PostgreSQL"
        fi
        if grep -q "\"mongodb\":" package.json || grep -q "\"mongoose\":" package.json; then
            echo "  ✓ MongoDB"
        fi
        echo ""
    fi

    # Testing frameworks
    echo "Testing:"
    if grep -q "\"jest\":" package.json 2>/dev/null; then
        echo "  ✓ Jest"
    fi
    if grep -q "\"vitest\":" package.json 2>/dev/null; then
        echo "  ✓ Vitest"
    fi
    if grep -q "\"playwright\":" package.json 2>/dev/null; then
        echo "  ✓ Playwright"
    fi
    if grep -q "pytest" requirements.txt 2>/dev/null; then
        echo "  ✓ Pytest"
    fi
    echo ""
}

detect_stack
```

## Phase 2: Security Analysis

Analyze changes for security implications:

```bash
#!/bin/bash
# Security-focused analysis

analyze_security_risks() {
    echo "=== Security Risk Analysis ==="
    echo ""

    local has_security_risks=0

    # Check for authentication/authorization changes
    echo "Authentication & Authorization:"
    if git diff "$BASE_BRANCH"...HEAD | grep -i -E "auth|login|password|token|session|jwt|oauth" > /dev/null; then
        echo "  ⚠ Authentication-related changes detected"
        has_security_risks=1
    else
        echo "  ✓ No auth changes"
    fi
    echo ""

    # Check for database queries
    echo "Database Security:"
    if git diff "$BASE_BRANCH"...HEAD | grep -E "query|execute|raw|sql" > /dev/null; then
        echo "  ⚠ Database query changes detected"
        echo "    → Review for SQL injection risks"
        has_security_risks=1
    else
        echo "  ✓ No raw queries"
    fi
    echo ""

    # Check for user input handling
    echo "Input Validation:"
    if git diff "$BASE_BRANCH"...HEAD | grep -E "req\.body|req\.query|request\.|input|form" > /dev/null; then
        echo "  ⚠ User input handling detected"
        echo "    → Review validation and sanitization"
        has_security_risks=1
    else
        echo "  ✓ No input handling changes"
    fi
    echo ""

    # Check for file operations
    echo "File Operations:"
    if git diff "$BASE_BRANCH"...HEAD | grep -E "fs\.|readFile|writeFile|unlink|path\.join" > /dev/null; then
        echo "  ⚠ File system operations detected"
        echo "    → Review for path traversal vulnerabilities"
        has_security_risks=1
    else
        echo "  ✓ No file operations"
    fi
    echo ""

    # Check for environment variables
    echo "Secrets Management:"
    if git diff "$BASE_BRANCH"...HEAD | grep -E "process\.env|API_KEY|SECRET|PASSWORD" > /dev/null; then
        echo "  ⚠ Environment variable usage detected"
        echo "    → Verify no secrets in code"
        has_security_risks=1
    else

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [manastalukdar](https://github.com/manastalukdar)
- **Source:** [manastalukdar/ai-devstudio](https://github.com/manastalukdar/ai-devstudio)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** yes
- **Shell / process execution:** yes
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-manastalukdar-ai-devstudio-code-review-checklist
- Seller: https://agentstack.voostack.com/s/manastalukdar
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.