codex-auto-review

Run through a checklist covering correctness, security, and style after every change. Verify edge cases, check for hardcoded secrets and injection risks, confirm naming consistency, then execute the code or tests to confirm expected output.

A solid checklist covers correctness (does it do what was asked, edge cases handled), security (no hardcoded secrets, input validation, no shell injection), style (consistent naming, no dead code), and verification (code runs and output matches expectations).

Scan the changed code for embedded tokens, API keys, or credentials, confirm all external input is validated at boundaries, and ensure no user-controlled data reaches shell commands unsanitized. Fix any findings before reporting completion.

No, the review explicitly requires running the code and any existing tests as part of verification. The checklist complements tests by catching issues tests may miss, such as hardcoded secrets, dead code, and style inconsistencies.

It should not be skipped for code changes; the rule is to never report done without reviewing. It only becomes unnecessary when no code was modified, such as pure documentation reading or question answering tasks.