# Code Review

> A Claude skill from sjarmak/agent-workflows.

- **Type:** Skill
- **Install:** `agentstack add skill-sjarmak-agent-workflows-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [sjarmak](https://agentstack.voostack.com/s/sjarmak)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [sjarmak](https://github.com/sjarmak)
- **Source:** https://github.com/sjarmak/agent-workflows/tree/main/skills/code-review

## Install

```sh
agentstack add skill-sjarmak-agent-workflows-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Comprehensive code review of uncommitted or recently committed changes. Reviews for security, quality, and maintainability, then reports findings by severity.

## Arguments

$ARGUMENTS — format: `[file path | glob pattern | PR number | blank]`

- If a file path or glob is provided, scope the review to those files.
- If a PR number is provided, review that pull request via `gh pr diff`.
- If no argument is provided, review all uncommitted changes.

## Parse Arguments

Extract:

- **scope**: a file path, glob pattern, PR number (digits only), or empty

## Phase 1: Gather Changes

1. **Uncommitted changes** (default): run `git diff --staged` and `git diff` to capture all changes.
2. **File/glob scope**: read the specified files and their diffs.
3. **PR scope**: run `gh pr diff ` to get the full diff.
4. If no changes are found, check `git log --oneline -5` and offer to review the last commit.

For each changed file, also read surrounding code — don't review changes in isolation.

## Phase 2: Review

Launch 3 parallel review agents, each focused on a different severity tier:

### Agent 1: Security (CRITICAL)

```
Review ONLY for security issues. Flag these if found:

- Hardcoded credentials (API keys, passwords, tokens, connection strings)
- SQL injection (string concatenation in queries)
- XSS vulnerabilities (unescaped user input in HTML/JSX)
- Path traversal (user-controlled file paths without sanitization)
- CSRF vulnerabilities (state-changing endpoints without protection)
- Authentication bypasses (missing auth checks on protected routes)
- Exposed secrets in logs (logging tokens, passwords, PII)
- Insecure deserialization or command injection

For each issue, report: file path, line number, what's wrong, and how to fix it.
Only report issues you are >80% confident are real problems, not pre-existing issues.
```

### Agent 2: Code Quality (HIGH)

```
Review for code quality issues. Flag these if found:

- Functions over 50 lines
- Files over 800 lines
- Nesting depth over 4 levels
- Missing error handling (unhandled rejections, empty catch blocks)
- Mutation patterns where immutable operations should be used
- Debug logging left in (console.log, print statements)
- Dead code (commented-out code, unused imports, unreachable branches)
- Missing tests for new code paths

Consolidate similar issues (e.g., "5 functions missing error handling" not 5 separate findings).
Only report issues in changed code. Skip stylistic preferences unless they violate project conventions.
```

### Agent 3: Performance & Best Practices (MEDIUM/LOW)

```
Review for performance and best practice issues:

- Inefficient algorithms (O(n^2) when O(n) or O(n log n) is possible)
- Missing caching for repeated expensive computations
- Large bundle imports when tree-shakeable alternatives exist
- N+1 query patterns
- Unbounded queries without LIMIT
- Missing timeouts on external calls
- TODO/FIXME without issue references
- Magic numbers without explanation

Only flag issues that materially affect the code. Skip minor nitpicks.
```

## Phase 3: Score and Filter

For each finding from Phase 2, assess confidence (0-100):

- **0-25**: Likely false positive or pre-existing issue — drop it.
- **25-50**: Might be real but could be a nitpick — drop it.
- **50-75**: Real issue but low impact — include only if CRITICAL/HIGH.
- **75-100**: Confirmed real issue with practical impact — always include.

Filter out findings below 75 confidence.

## Phase 4: Report

Present findings grouped by severity:

```
[CRITICAL] Description
File: path/to/file.ts:42
Issue: What's wrong and why it matters
Fix: Specific fix recommendation

[HIGH] Description
File: path/to/file.ts:88
Issue: What's wrong
Fix: How to fix it
```

End with a summary table:

```
## Review Summary

| Severity | Count | Status |
|----------|-------|--------|
| CRITICAL | 0     | pass   |
| HIGH     | 2     | warn   |
| MEDIUM   | 1     | info   |
| LOW      | 0     | —      |

Verdict: APPROVE / WARNING / BLOCK
```

- **APPROVE**: No CRITICAL or HIGH issues
- **WARNING**: HIGH issues only (can proceed with caution)
- **BLOCK**: CRITICAL issues found — must fix before proceeding

## Rules

- **Confidence filtering**: only report issues with >75% confidence. No noise.
- **Changed code only**: don't flag issues in unchanged code unless they are CRITICAL security issues.
- **Consolidate**: group similar issues rather than listing each instance separately.
- **No cosmetic complaints**: skip stylistic preferences unless they violate explicit project conventions.
- **Actionable fixes**: every finding must include a specific fix, not just a complaint.
- **Adapt to project**: check for CLAUDE.md, project rules, and established patterns. Match the codebase.

## Pipeline Position

- Runs after simplify, before commit.
- In `/focus`, this is the review phase between simplify and close.
- Can be used standalone on any codebase, branch, or PR.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [sjarmak](https://github.com/sjarmak)
- **Source:** [sjarmak/agent-workflows](https://github.com/sjarmak/agent-workflows)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-sjarmak-agent-workflows-code-review
- Seller: https://agentstack.voostack.com/s/sjarmak
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.