code-reviewer

Security code review checks for exposed secrets, missing input validation, SQL injection, XSS, and broken authentication. This Skill scans target files against a security checklist and reports each issue with its file location and a suggested fix.

Run the review on the changed files to receive feedback grouped into Critical, Warning, and Suggestion tiers. Each finding includes the file path, line number, explanation of the issue, and a concrete fix recommendation.

The checklist covers five areas: code quality (readability, naming, DRY), security (secrets, injection, XSS), error handling, performance (bottlenecks, query optimization), and testing (coverage, edge cases).

Yes, the review operates on any readable source files using Read, Grep, and Glob, so it is language-agnostic. However, language-specific checks like framework security rules depend on the reviewer's own knowledge rather than dedicated linters.

Checklist-based review cannot execute code or run tests, so it detects static patterns rather than runtime behavior. It may miss logic bugs that only surface during execution and should complement, not replace, automated testing.