{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/code-review",
  "version": "1.0.0",
  "name": "code-review",
  "description": "Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, \"review this before I merge\", \"is this code safe?\", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.",
  "system_prompt_fragment": "# /code-review\n\n> If you see unfamiliar placeholders or need to check which tools are connected, see [CONNECTORS.md](../../CONNECTORS.md).\n\nReview code changes with a structured lens on security, performance, correctness, and maintainability.\n\n## Usage\n\n```\n/code-review <PR URL or file path>\n```\n\nReview the provided code changes: @$1\n\nIf no specific file or URL is provided, ask what to review.\n\n## How It Works\n\n```\n┌─────────────────────────────────────────────────────────────────┐\n│                      CODE REVIEW                                   │\n├─────────────────────────────────────────────────────────────────┤\n│  STANDALONE (always works)                                       │\n│  ✓ Paste a diff, PR URL, or point to files                      │\n│  ✓ Security audit (OWASP top 10, injection, auth)               │\n│  ✓ Performance review (N+1, memory leaks, complexity)           │\n│  ✓ Correctness (edge cases, error handling, race conditions)    │\n│  ✓ Style (naming, structure, readability)                        │\n│  ✓ Actionable suggestions with code examples                    │\n├─────────────────────────────────────────────────────────────────┤\n│  SUPERCHARGED (when you connect your tools)                      │\n│  + Source control: Pull PR diff automatically                    │\n│  + Project tracker: Link findings to tickets                     │\n│  + Knowledge base: Check against team coding standards           │\n└─────────────────────────────────────────────────────────────────┘\n```\n\n## Review Dimensions\n\n### Security\n- SQL injection, XSS, CSRF\n- Authentication and authorization flaws\n- Secrets or credentials in code\n- Insecure deserialization\n- Path traversal\n- SSRF\n\n### Performance\n- N+1 queries\n- Unnecessary memory allocations\n- Algorithmic complexity (O(n²) in hot paths)\n- Missing database indexes\n- Unbounded queries or loops\n- Resource leaks\n\n### Correctness\n- Edge cases (empty input, null, overflow)\n- Race conditions and concurrency issues\n- Error handling and propagation\n- Off-by-one errors\n- Type safety\n\n### Maintainability\n- Naming clarity\n- Single responsibility\n- Duplication\n- Test coverage\n- Documentation for non-obvious logic\n\n## Output\n\n```markdown\n## Code Review: [PR title or file]\n\n### Summary\n[1-2 sentence overview of the changes and overall quality]\n\n### Critical Issues\n| # | File | Line | Issue | Severity |\n|---|------|------|-------|----------|\n| 1 | [file] | [line] | [description] | 🔴 Critical |\n\n### Suggestions\n| # | File | Line | Suggestion | Category |\n|---|------|------|------------|----------|\n| 1 | [file] | [line] | [description] | Performance |\n\n### What Looks Good\n- [Positive observations]\n\n### Verdict\n[Approve / Request Changes / Needs Discussion]\n```\n\n## If Connectors Available\n\nIf **~~source control** is connected:\n- Pull the PR diff automatically from the URL\n- Check CI status and test results\n\nIf **~~project tracker** is connected:\n- Link findings to related tickets\n- Verify the PR addresses the stated requirements\n\nIf **~~knowledge base** is connected:\n- Check changes against team coding standards and style guides\n\n## Tips\n\n1. **Provide context** — \"This is a hot path\" or \"This handles PII\" helps me focus.\n2. **Specify concerns** — \"Focus on security\" narrows the review.\n3. **Include tests** — I'll check test coverage and quality too.",
  "applicable_domains": [
    "code",
    "engineering",
    "architecture"
  ],
  "invocation": [
    "/code-review",
    "/code-review <PR URL, diff, or file path>"
  ],
  "tags": [
    "engineering",
    "anthropics",
    "knowledge-work"
  ],
  "authored_by": "anthropics",
  "source_url": "https://github.com/anthropics/knowledge-work-plugins/blob/main/engineering/skills/code-review/SKILL.md",
  "lifecycle": "stable",
  "category": "coding",
  "provenance": {
    "source": "anthropics/knowledge-work-plugins",
    "source_url": "https://github.com/anthropics/knowledge-work-plugins/blob/main/engineering/skills/code-review/SKILL.md",
    "author": "Anthropic",
    "license": "Apache-2.0",
    "notes": "Imported by scripts/import-anthropic-skills.py."
  }
}