review

Review Skill - AI 代码审查

对暂存的更改、指定文件或拉取请求进行全面的代码审查。根据文件类型，分派预加载相关 -ops 技能的通用审查员，并自动为严重问题创建任务。

架构

review [target] [--focus] [--depth]
    │
    ├─→ Step 1: Determine Scope
    │     ├─ No args → git diff --cached (staged)
    │     ├─ --all → git diff HEAD (all uncommitted)
    │     ├─ File path → specific file diff
    │     └─ --pr N → gh pr diff N
    │
    ├─→ Step 2: Analyze Changes (parallel)
    │     ├─ delta for syntax-highlighted diff
    │     ├─ difft for semantic diff (structural)
    │     ├─ Categorize: logic, style, test, docs, config
    │     └─ Identify touched modules/components
    │
    ├─→ Step 3: Load Project Standards
    │     ├─ AGENTS.md, CLAUDE.md conventions
    │     ├─ .eslintrc, .prettierrc, pyproject.toml
    │     ├─ Detect test framework
    │     └─ Check CI config for existing linting
    │
    ├─→ Step 4: Route to Reviewers (general-purpose + skill preload)
    │     ├─ TypeScript → general-purpose, preload typescript-ops
    │     ├─ React/JSX → general-purpose, preload react-ops
    │     ├─ Python → general-purpose, preload python-pytest-ops
    │     ├─ Go → general-purpose, preload go-ops
    │     ├─ Rust → general-purpose, preload rust-ops
    │     ├─ Vue → general-purpose, preload vue-ops
    │     ├─ SQL/migrations → general-purpose, preload postgres-ops
    │     ├─ Cypress/E2E → general-purpose, preload cypress-ops
    │     ├─ Cloudflare/Workers → general-purpose, preload cloudflare-ops
    │     ├─ Shell/bash → general-purpose, preload bash-ops
    │     ├─ Claude extensions → general-purpose, preload claude-code-ops
    │     ├─ Multi-domain → parallel general-purpose dispatch
    │     └─ All reviewers preload: security-ops + testing-ops context
    │
    ├─→ Step 5: Generate Review
    │     ├─ Severity: CRITICAL / WARNING / SUGGESTION / PRAISE
    │     ├─ Line-specific comments (file:line refs)
    │     ├─ Suggested fixes as diff blocks
    │     └─ Overall verdict: Ready to commit? Y/N
    │
    └─→ Step 6: Integration
          ├─ Auto-create tasks (TaskCreate) for CRITICAL issues
          ├─ Link to /save for tracking
          └─ Suggest follow-up: /testgen, /explain

执行步骤

步骤 1：确定范围

# Default: staged changes
git diff --cached --name-only

# Check if anything is staged
STAGED=$(git diff --cached --name-only | wc -l)
if [ "$STAGED" -eq 0 ]; then
    echo "No staged changes. Use --all for uncommitted or specify a file."
    git status --short
fi

审查 PR 时：

gh pr diff $PR_NUMBER --patch

审查指定文件时：

git diff HEAD -- "$FILE"

进行基线比较时（--base）：

git diff $BASE_BRANCH...HEAD

步骤 2：分析更改

运行语义差异分析（尽可能并行）：

使用 difft（语义分析）：

command -v difft >/dev/null 2>&1 && git difftool --tool=difftastic --no-prompt HEAD~1 || git diff HEAD~1

使用 delta（语法高亮）：

command -v delta >/dev/null 2>&1 && git diff --cached | delta || git diff --cached

对更改进行分类：

git diff --cached --name-only | while read file; do
    case "$file" in
        *.test.* | *.spec.*) echo "TEST: $file" ;;
        *.md | docs/*) echo "DOCS: $file" ;;
        *.json | *.yaml | *.toml) echo "CONFIG: $file" ;;
        *) echo "CODE: $file" ;;
    esac
done

获取差异统计信息：

git diff --cached --stat

步骤 3：加载项目规范

# Claude Code conventions
cat AGENTS.md 2>/dev/null | head -50
cat CLAUDE.md 2>/dev/null | head -50

# Linting configs
cat .eslintrc* 2>/dev/null | head -30
cat .prettierrc* 2>/dev/null
cat pyproject.toml 2>/dev/null | head -30

# Test framework detection
cat package.json 2>/dev/null | jq '.devDependencies | keys | map(select(test("jest|vitest|mocha|cypress|playwright")))' 2>/dev/null

检查 CI 中是否已有 lint 检查：

cat .github/workflows/*.yml 2>/dev/null | grep -E "eslint|prettier|pylint|ruff" | head -10

步骤 4：分派审查员

分派时优先使用技能：领域知识来自 -ops 技能，通用 general-purpose 子 Agent 会在审查前预加载相关的 SKILL.md。

文件模式	分派对象	预加载
*.ts	general-purpose	skills/typescript-ops/SKILL.md
*.tsx	general-purpose	skills/react-ops/SKILL.md + skills/typescript-ops/SKILL.md
*.vue	general-purpose	skills/vue-ops/SKILL.md + skills/typescript-ops/SKILL.md
*.py	general-purpose	skills/python-pytest-ops/SKILL.md（如果使用 ORM，还需加载 skills/sql-ops/SKILL.md）
*.go	general-purpose	skills/go-ops/SKILL.md
*.rs	general-purpose	skills/rust-ops/SKILL.md
*.sql, migrations/*	general-purpose	skills/postgres-ops/SKILL.md
agents/*.md, skills/*, commands/*	general-purpose	skills/claude-code-ops/SKILL.md
*.test.*, *.spec.*	general-purpose	（按文件类型加载框架技能）
*.cy.ts, cypress/*	general-purpose	skills/cypress-ops/SKILL.md + skills/typescript-ops/SKILL.md
*.spec.ts（Playwright）	general-purpose	skills/playwright-ops/SKILL.md + skills/typescript-ops/SKILL.md
playwright/*, e2e/*	general-purpose	skills/playwright-ops/SKILL.md + skills/typescript-ops/SKILL.md
wrangler.toml, workers/*	general-purpose	skills/cloudflare-ops/SKILL.md
*.sh, *.bash	general-purpose	skills/bash-ops/SKILL.md

通过 Agent 工具调用：

Agent tool with subagent_type: "general-purpose" (or surviving specialist from table)
model: "sonnet"
Prompt includes:
  - Skill preloading (domain knowledge):
    "First, read these files for review context:
     - Read: skills/security-ops/references/owasp-top10-a01-a05.md
     - Read: skills/security-ops/references/owasp-top10-a06-a10.md
     - Read: skills/testing-ops/SKILL.md
     - Read: [Preload column for the matched file pattern]"
  - Diff content
  - Project conventions from AGENTS.md
  - Linting config summaries
  - Requested focus area
  - Request for structured review output

按语言预加载（追加到上述预加载部分）：

语言	额外预加载	原因
Python	skills/python-pytest-ops/SKILL.md	用于覆盖率审查的 Python 测试模式
Go	skills/go-ops/SKILL.md	Go 惯用写法及并发注意事项
Rust	skills/rust-ops/SKILL.md	所有权模式及不安全代码审查
TypeScript	skills/typescript-ops/SKILL.md	类型安全模式

步骤 5：生成审查结果

审查员会生成结构化的审查结果：

# Code Review: [scope description]

## Summary

| Metric | Value |
|--------|-------|
| Files reviewed | N |
| Lines changed | +X / -Y |
| Issues found | N (X critical, Y warnings) |

## Verdict

**Ready to commit?** Yes / No

[1-2 sentence summary of overall quality]

---

## Critical Issues

### `src/auth/login.ts:42`

**Issue:** SQL injection vulnerability in user input handling

**Risk:** Attacker can execute arbitrary SQL queries

**Fix:**
```diff
- const query = `SELECT * FROM users WHERE id = ${userId}`;
+ const query = `SELECT * FROM users WHERE id = $1`;
+ const result = await db.query(query, [userId]);

---

警告

src/components/Form.tsx:89

问题： useEffect 中缺少依赖项

建议： 将 userId 添加到依赖数组中

- useEffect(() => { fetchUser(userId) }, []);
+ useEffect(() => { fetchUser(userId) }, [userId]);

---

建议

[样式改进、可选增强]

---

值得肯定之处

[值得指出的优秀模式]

---

已审查文件

文件	更改	问题
src/auth/login.ts	+42/-8	1 个严重问题

### Step 6: Integration

**Auto-create tasks for CRITICAL issues:**

TaskCreate: subject: "修复：login.ts:42 中的 SQL 注入" description: "在用户输入处理过程中发现 SQL 注入漏洞。" activeForm: "正在修复 login.ts:42 中的 SQL 注入"

**Link with dependencies for related issues:**

TaskCreate: #1 "修复 login.ts 中的 SQL 注入" TaskCreate: #2 "修复 register.ts 中的 SQL 注入" TaskUpdate: taskId: "2", addBlockedBy: ["1"]

**After fixing issues:**

TaskUpdate: taskId: "1" status: "completed"

---

## Severity System

| Level | Icon | Meaning | Action | Auto-Task? |
|-------|------|---------|--------|------------|
| CRITICAL | :red_circle: | Security bug, data loss risk, crashes | Must fix before merge | Yes |
| WARNING | :yellow_circle: | Logic issues, performance problems | Should address | No |
| SUGGESTION | :blue_circle: | Style, minor improvements | Optional | No |
| PRAISE | :star: | Good patterns worth noting | Recognition | No |

---

## Focus Modes

| Mode | What It Checks |
|------|----------------|
| `--security` | OWASP top 10, secrets in code, injection, auth issues |
| `--perf` | N+1 queries, unnecessary re-renders, complexity, memory |
| `--types` | Type safety, `any` usage, generics, null handling |
| `--tests` | Coverage gaps, test quality, mocking patterns |
| `--style` | Naming, organization, dead code, comments |
| (default) | All of the above |

---

## Depth Modes

| Mode | Behavior |
|------|----------|
| `--quick` | Surface-level scan, obvious issues only |
| `--normal` | Standard review, all severity levels (default) |
| `--thorough` | Deep analysis, traces data flow, checks edge cases |

---

## Advanced Flags

### `--base <branch>` - Baseline Comparison

Compare changes against a specific branch instead of HEAD:

```bash
/review --base main
/review src/ --base develop --thorough

--json - CI/CD 集成

将审查结果输出为 JSON：

{
  "summary": {
    "files_reviewed": 3,
    "lines_changed": { "added": 42, "removed": 8 },
    "issues": { "critical": 1, "warning": 2, "suggestion": 1 }
  },
  "verdict": {
    "ready_to_commit": false,
    "reason": "1 critical issue requires attention"
  },
  "issues": [...]
}

CI/CD 用法：

- name: Code Review
  run: |
    claude "/review --json" > review.json
    if jq -e '.issues[] | select(.severity == "critical")' review.json; then
      exit 1
    fi

--fix - 自动应用修复

自动应用建议的修复：

1. 执行标准审查
2. 针对每个可修复的问题，请求确认
3. 使用 Edit 工具应用已批准的修复
4. 为已解决的问题创建 TaskUpdate

非交互模式：

/review --fix --auto-approve

---

CLI 工具集成

工具	用途	后备方案
delta	语法高亮的差异	git diff
difft	语义／结构差异	git diff
gh	GitHub PR 操作	手动查看差异
rg	搜索模式	Grep 工具
jq	解析 JSON 配置	手动读取

优雅降级：

command -v delta >/dev/null 2>&1 && git diff --cached | delta || git diff --cached

---

集成

命令	关联
/explain	深入分析标记的代码
/testgen	为发现的问题生成测试
/save	将审查结果保存到会话状态