# Sc:code Review

> Review a diff or PR like a senior engineer: correctness and edge cases first, then security, performance, readability, and tests — with severity-tagged, actionable findings tied to specific lines. Prioritizes real bugs over style nits and verifies claims against the code. Activate for: review this code, code review, review my PR, review the diff, find bugs, security review, סקירת קוד, בדיקת קוד,…

- **Type:** Skill
- **Install:** `agentstack add skill-squadcodercom-squadcoder-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [squadcodercom](https://agentstack.voostack.com/s/squadcodercom)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [squadcodercom](https://github.com/squadcodercom)
- **Source:** https://github.com/squadcodercom/squadcoder/tree/main/.squadcoder/skills/code-review
- **Website:** https://squadcoder.com

## Install

```sh
agentstack add skill-squadcodercom-squadcoder-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Review — senior-engineer pass over a diff/PR

Find what matters and say it clearly. A good review surfaces **real defects** with evidence, not a
list of style opinions. Default to reviewing the **changed lines** and their blast radius.

## Step 0 — orient
- What is this change trying to do? (Read the PR description / commit messages / the diff intent.)
- What's the blast radius — what calls this, what does it call, what data does it touch?
- Get the actual diff (`git diff`), don't review from memory.

## Review dimensions (in priority order)
1. **Correctness & edge cases** — does it do what it claims? Off-by-one, null/empty/None, error paths,
   async races, unhandled rejections, boundary inputs, wrong default. **This is most of the value.**
2. **Security** — input validation, injection (SQL/command/path traversal), authn/authz checks,
   secrets in code/logs, unsafe deserialization, XSS/CSRF for web, SSRF for fetchers.
3. **Resource & performance** — N+1 queries, unbounded loops/memory, missing pagination, blocking I/O
   on a hot path, leaks (listeners, handles), needless re-renders.
4. **API & data contracts** — backward compatibility, migration safety, nullable changes, error shapes.
5. **Readability & maintainability** — names, dead code, duplication, function size, matches the
   surrounding style. Flag, don't bikeshed.
6. **Tests** — is the new behavior covered? Are the tests meaningful (assert real outcomes) or hollow?

## How to report findings
For each finding:
- **Severity**: `blocker` / `major` / `minor` / `nit`.
- **Location**: `file:line` (clickable).
- **What & why**: the concrete problem and the failure it causes — quote the code.
- **Fix**: a specific suggestion (or a diff), not "consider improving this".

Group by severity; lead with blockers. Example:
> **[blocker] `auth.ts:42`** — token compared with `==`, so an empty token matches when the stored
> value is also falsy. Use a constant-time compare and reject empty tokens.

## Discipline
- **Verify before asserting.** Trace the data flow; don't claim a bug you didn't confirm in the code.
  If you're unsure, say "possible issue — verify X", don't state it as fact.
- Separate **must-fix** (correctness/security) from **nice-to-have** (style). Don't drown blockers in nits.
- Praise genuinely good choices briefly — it calibrates the rest.
- If the diff is large, review in passes (correctness → security → the rest) rather than skimming once.
- RTL/Hebrew web code: check for physical-CSS leftovers (`left/right`/`ml-`/`mr-`) that break RTL —
  prefer logical properties.

## Output shape
A short summary verdict (approve / approve-with-changes / request-changes), then findings grouped by
severity, then a one-line note on test coverage.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [squadcodercom](https://github.com/squadcodercom)
- **Source:** [squadcodercom/squadcoder](https://github.com/squadcodercom/squadcoder)
- **License:** MIT
- **Homepage:** https://squadcoder.com

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-squadcodercom-squadcoder-code-review
- Seller: https://agentstack.voostack.com/s/squadcodercom
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.