About review
review is a code-review skill for developers assessing changes intended for production. Its checklist focuses on security, data integrity, performance, race conditions, and failure handling, with findings formatted by severity and suggested fixes.
Key features
- 01Trust-boundary and security checks
- 02Data integrity review
- 03Performance and query checks
- 04Race-condition analysis
- 05Severity-based findings with fixes
Use cases
- 01Reviewing a code diff before production
- 02Checking data and error paths for failure risks
- 03Finding security and concurrency issues in a change
Install
Copy the command and run it in a terminal.
$
npx skills add https:/After installing, type/reviewin Claude Code to confirm it loaded.
Details
From the project READMEReview — Paranoid Code Review
Find the bugs that pass tests. Think like an attacker, reason like a debugger.
Mindset
You are reviewing code that will run in production. Assume:
- Every input is hostile
- Every async operation can race
- Every query can be slow at scale
- Every error path will eventually execute
Review Checklist
1. Trust Boundaries
- User input validated at the boundary using the stack's schema/validation tool
- Auth checked before business logic
- No secrets in client-accessible code
- API responses don't leak internal details
2. Data Integrity
- Multi-table writes wrapped in transactions
- Optimistic concurrency or locking where needed
- No orphaned records on partial failure
- Cascading deletes are intentional
3. Performance
- No N+1 queries (look for loops with DB calls)
- Pagination on list endpoints
- Indexes on columns used in WHERE/JOIN
- No unbounded arrays or objects in memory
4. Race Conditions
- Concurrent requests to same resource handled
- Check-then-act patterns use atomic operations
- Shared mutable state is synchronized
- Idempotency keys on critical mutations
5. Error Handling
- Errors caught at appropriate level (not swallowed)
- User-facing errors are helpful, not internal stack traces
- Retry logic has backoff and max attempts
- Partial failures don't leave corrupt state
6. Security (OWASP Top 10)
- No injection attacks (parameterized queries, prepared statements, ORM guards — never string-concat into SQL or shell commands)
- No XSS (output encoding, CSP headers)
- No CSRF (tokens on state-changing requests)
- No insecure direct object references
- Rate limiting on auth endpoints
How to Review
- Read the diff — understand what changed and why
- Trace data flow — from input to output, follow the data
- Check edge cases — nulls, empty arrays, concurrent requests, large inputs
- Question assumptions — "what if this fails?" at every step
- Verify tests exist — for the happy path AND the failure modes
Output Format
For each issue found:
[SEVERITY] file:line — Description
Why: Explanation of the risk
Fix: Suggested change
Severities: CRITICAL (must fix), HIGH (should fix), MEDIUM (consider), LOW (nit)
Comments
Markdown supported