# Code Review Checklist

> Runs a systematic checklist review on any code diff or file, covering correctness, security, performance, and readability.

- **Type:** Skill
- **Install:** `agentstack add skill-notysoty-openagentskills-code-review-checklist`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Notysoty](https://agentstack.voostack.com/s/notysoty)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Notysoty](https://github.com/Notysoty)
- **Source:** https://github.com/Notysoty/openagentskills/tree/main/skills/code-review-checklist

## Install

```sh
agentstack add skill-notysoty-openagentskills-code-review-checklist
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Review Checklist

## What this skill does

This skill directs the agent to perform a structured code review using a proven checklist. It catches bugs, security issues, performance problems, and readability concerns that are easy to miss in a quick scan. The output is a prioritized list of findings — not vague suggestions, but specific line-level feedback with clear explanations.

Use this before merging a PR, after a refactor, or any time you want a second opinion on code quality.

## How to use

### Claude Code / Cline

Copy this file to `.agents/skills/code-review-checklist/SKILL.md` in your project root.

Then ask the agent:
- *"Review this file using the Code Review Checklist skill."*
- *"Run the Code Review Checklist skill on my PR diff."*

### Cursor

Add the contents of the "Prompt / Instructions" section below to your `.cursorrules` file, then open the file you want reviewed and ask Cursor to review it.

### Codex

Paste the code and the instructions from the section below into the Codex chat.

## The Prompt / Instructions for the Agent

When asked to review code, work through each section of this checklist in order. For every issue found, output:

- **Severity**: `critical` | `major` | `minor` | `nit`
- **Location**: file name and line number(s)
- **Issue**: one-sentence description
- **Suggestion**: what to do instead

---

### 1. Correctness

- [ ] Does the logic match the intended behavior (based on function name, comments, or context)?
- [ ] Are there off-by-one errors in loops or array accesses?
- [ ] Are all code paths handled, including edge cases (empty input, null, zero, negative numbers)?
- [ ] Are async operations properly awaited? Could there be race conditions?
- [ ] Are errors caught and handled appropriately, or silently swallowed?

### 2. Security

- [ ] Is any user input used in SQL queries, shell commands, or file paths without sanitization?
- [ ] Are secrets, API keys, or passwords hardcoded or logged?
- [ ] Are authentication and authorization checks in place before sensitive operations?
- [ ] Is output properly escaped before being rendered in HTML (XSS)?
- [ ] Are dependencies pinned to known-good versions?

### 3. Performance

- [ ] Are there any N+1 query patterns (a query inside a loop)?
- [ ] Is expensive work (network calls, heavy computation) done unnecessarily on every request?
- [ ] Are large data structures being copied when a reference would suffice?
- [ ] Are there obvious opportunities for caching or memoization?

### 4. Readability & Maintainability

- [ ] Are variable and function names descriptive and consistent with the surrounding codebase?
- [ ] Is any logic complex enough to warrant a comment but currently unexplained?
- [ ] Are there magic numbers or strings that should be named constants?
- [ ] Is the function doing more than one thing (violates single-responsibility)?
- [ ] Is there dead code, commented-out code, or TODO comments that should be resolved?

### 5. Tests

- [ ] Are the critical paths covered by tests?
- [ ] Do the tests actually assert meaningful behavior, or just that no error was thrown?
- [ ] Are edge cases (empty input, error states) tested?

---

After completing the checklist, output a **summary** with:
1. Total findings by severity
2. The top 3 issues to fix first (highest severity / most impactful)
3. An overall assessment: `Approve` | `Approve with minor fixes` | `Needs changes`

If no issues are found in a section, write "✓ No issues found" for that section rather than skipping it.

## Example

**Input to Agent:**
> "Use the Code Review Checklist skill on this function:
>
> ```typescript
> async function getUser(id: string) {
>   const query = `SELECT * FROM users WHERE id = '${id}'`;
>   const result = await db.raw(query);
>   return result.rows[0];
> }
> ```"

**Output from Agent:**

**Correctness**
- **Major** | Line 3 | No null check on `result.rows[0]` — returns `undefined` if user not found, which may cause downstream errors. | Return `null` explicitly or throw a `NotFoundError`.

**Security**
- **Critical** | Line 2 | SQL injection vulnerability — `id` is interpolated directly into the query string. | Use a parameterized query: `db.raw('SELECT * FROM users WHERE id = ?', [id])`.

**Performance**
- **Minor** | Line 2 | `SELECT *` fetches all columns even if only a few are needed. | Specify the columns you actually use.

**Summary**
- 1 critical, 1 major, 1 minor
- Top issues: SQL injection (critical), missing null check (major), over-fetching columns (minor)
- **Assessment: Needs changes**

## Notes

- If the diff is large, focus on files with the most business logic first.
- For nitpicks (formatting, naming), group them at the end rather than interspersing them with real issues.
- This skill does not run linters or static analysis — it is a reasoning-based review. For automated checks, run your existing lint/test pipeline first.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Notysoty](https://github.com/Notysoty)
- **Source:** [Notysoty/openagentskills](https://github.com/Notysoty/openagentskills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-notysoty-openagentskills-code-review-checklist
- Seller: https://agentstack.voostack.com/s/notysoty
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.