# Code Review

> |

- **Type:** Skill
- **Install:** `agentstack add skill-viktorbezdek-skillstack-code-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [viktorbezdek](https://agentstack.voostack.com/s/viktorbezdek)
- **Installs:** 0
- **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [viktorbezdek](https://github.com/viktorbezdek)
- **Source:** https://github.com/viktorbezdek/skillstack/tree/main/code-review/skills/code-review

## Install

```sh
agentstack add skill-viktorbezdek-skillstack-code-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Comprehensive Code Review Skill

This skill is a curated merge of four complementary code review skills:

1. **Evidence-Based Code Review**: Evidence-based multi-agent swarm review with specialized reviewers
2. **PR Comment Analysis**: Extract, consolidate, and prioritize GitHub PR comments
3. **Development Workflow Specialist**: TDD, debugging, performance optimization, and automated code review
4. **Consultant**: AI-powered deep analysis for complex architectural and security reviews

---

## When to Use

**Use this skill when:**
- Reviewing PRs systematically with multiple quality dimensions
- Extracting and consolidating feedback from multiple reviewers
- Need evidence-based findings with file:line references
- Assessing security vulnerabilities, performance bottlenecks, or code quality
- Creating action plans from PR comments
- Complex architectural decisions requiring deep analysis
- Audit requirements mandate systematic review (compliance, release gates)

**Do NOT use for:**
- Simple formatting fixes (use linter/prettier directly)
- Non-code files (documentation, configuration without logic)
- Trivial changes (typo fixes, comment updates)
- Generated code (build artifacts, vendor dependencies)

---

## Core Capabilities

### 1. Evidence-Based Code Review
Every finding MUST include:
- Code location: `[file:line]` with surrounding context (5 lines before/after)
- Evidence type: DIRECT, STYLE_RULE, or BEST_PRACTICE
- Severity: CRITICAL, MAJOR, MINOR, or NIT
- Confidence score: 0.0-1.0
- Suggested fix with specific code changes

### 2. PR Comment Analysis
- Fetches ALL comments from GitHub PR (inline + conversation)
- Groups comments by file path and code section
- Identifies "High Consensus Issues" (2+ reviewers same concern)
- Three-phase analysis: Consolidation, Context Validation, Impact Analysis

### 3. Multi-Agent Swarm Review
Five specialized review agents working in parallel:
- **Security Reviewer**: Vulnerabilities, unsafe patterns, secrets
- **Performance Analyst**: Bottlenecks, optimization opportunities
- **Style Reviewer**: Code style, best practices, maintainability
- **Test Specialist**: Test coverage, quality, edge cases
- **Documentation Reviewer**: Comments, API docs, README updates

### 4. AI-Powered Consultation
- Supports 100+ LLM providers through LiteLLM
- Deep analysis for complex architectural decisions
- Async operation with session management

### 5. TRUST 5 Validation Framework
- **Truthfulness**: Code does what it claims
- **Relevance**: Changes are appropriate for the context
- **Usability**: Code is maintainable and understandable
- **Safety**: No security vulnerabilities or data risks
- **Timeliness**: Follows current best practices

---

## Severity Levels

- **CRITICAL**: Architecture-level issues (security vulnerabilities, data loss risks)
- **MAJOR**: Module-level issues (performance bottlenecks, maintainability problems)
- **MINOR**: Function-level improvements (code style, readability)
- **NIT**: Line-level suggestions (formatting, naming)

## Validation Rules

- NEVER approve code without evidence
- ALWAYS provide line numbers with every finding
- VALIDATE findings against multiple perspectives
- DISTINGUISH symptoms from root causes
- AVOID false confidence: flag uncertain findings as "needs manual review"
- Findings require 2+ confirming signals before flagging as violations

See [Extended Patterns](references/extended-patterns.md) for detailed finding templates, PR comment workflow, multi-agent swarm execution, CI/CD integration, and quality gate configuration.

---

## Success Criteria

- **Violations Detected**: All quality issues found with ZERO false negatives
- **False Positive Rate**: <5% (95%+ findings are genuine issues)
- **Actionable Feedback**: Every finding includes file path, line number, and fix guidance
- **Root Cause Identified**: Issues traced to underlying causes, not just symptoms

---

## Resources Reference

### Scripts

| Script | Purpose |
|--------|---------|
| `pr-comment-grabber.py` | Extract all PR comments from GitHub |
| `pr-comment-filter.py` | Filter comments by criteria |
| `analyze-pr.sh` | Full PR analysis workflow |
| `multi_agent_review.py` | Multi-agent swarm orchestration |
| `security_scan.sh` | Security vulnerability scanning |
| `performance_check.py` | Performance bottleneck detection |
| `style_audit.py` | Style and best practices audit |
| `consultant_cli.py` | AI consultation CLI |

### References

| Reference | Description |
|-----------|-------------|
| `extended-patterns.md` | Detailed examples and workflow patterns |
| `analysis-prompt.md` | LLM prompt for PR comment analysis |
| `analysis-prompt-v2.md` | Enhanced analysis with validation |
| `github-api.md` | GitHub API endpoints reference |
| `impact-analysis-methodology.md` | Risk assessment framework |
| `validation-workflow.md` | Three-phase validation process |
| `best-practices.md` | Code review best practices |
| `review-categories.md` | Severity and scope categories |

### Templates

| Template | Purpose |
|----------|---------|
| `review-checklist.yaml` | Code review checklist |
| `security-rules.json` | Security rule definitions |
| `performance-thresholds.json` | Performance thresholds |

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [viktorbezdek](https://github.com/viktorbezdek)
- **Source:** [viktorbezdek/skillstack](https://github.com/viktorbezdek/skillstack)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-viktorbezdek-skillstack-code-review
- Seller: https://agentstack.voostack.com/s/viktorbezdek
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.