78 lines
4.3 KiB
Markdown
78 lines
4.3 KiB
Markdown
---
|
|
allowed-tools: Read, Grep, Glob, Bash, TodoWrite
|
|
description: "Analyze code quality, security, performance, and architecture"
|
|
---
|
|
|
|
# /code-review - Code Review
|
|
|
|
## Purpose
|
|
|
|
Execute comprehensive code analysis across quality, security, performance, and architecture domains.
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
/code-review [branch]
|
|
```
|
|
|
|
## Execution
|
|
|
|
1. Discover and categorize files for analysis based on the diff between the current branch and the target branch:
|
|
- Use `git diff {branch_argument}...$(git branch --show-current)` where `{branch_argument}` is the first argument (defaults to 'master' if not provided)
|
|
2. Apply appropriate analysis tools and techniques:
|
|
- **Quality**: Code style, complexity, maintainability, technical debt assessment, SOLID principles compliance, error handling patterns
|
|
- **Security**: Vulnerability scanning, dependency checks, threat modeling, authentication/authorization flaws, data exposure risks, input validation
|
|
- **Performance**: Profiling, bottleneck identification, resource usage analysis, scalability assessment, Core Web Vitals (frontend), memory management (leaks, dangling pointers, buffer overflows)
|
|
- **Architecture**: Design patterns, modularity, scalability, coupling analysis, separation of concerns, future-proofing evaluation
|
|
- **Testing**: Test quality, edge case handling, test pyramid compliance (DO NOT run tests, just analyze test
|
|
- **Maintainability**: Code readability, documentation quality, code comments, naming conventions, modularity
|
|
coverage and quality)
|
|
- Based on an initial quick analysis, add additional checks if necessary
|
|
3. Generate findings with severity ratings
|
|
4. Create actionable recommendations with priorities, only if issues are found
|
|
- Severity levels:
|
|
- High: Critical issues that must be addressed immediately
|
|
- Medium: Important issues that should be resolved soon
|
|
- Low: Minor issues that can be addressed later
|
|
- List should be sorted by severity
|
|
- Include file project root relative filepaths and line numbers for each issue
|
|
- Focus on changes and the effects of those changes, not the entire file
|
|
5. Present ONLY a nicely formatted compact markdown table of text-based analysis report nothing else
|
|
- If you have positive findings, just add a tick mark next to the section that you used as a point to review
|
|
- Start with the positive findings and then list the improvements at the end
|
|
- Only include list of improvements
|
|
- Include:
|
|
- File paths in a following format: `./path/to/file.js:line_number` (DO NOT include ranges just where the issue
|
|
is)
|
|
- Issues found
|
|
- Severity
|
|
- Recommendations
|
|
|
|
### Example Output
|
|
|
|
```text
|
|
| Category | Assessment | Notes |
|
|
|----------------|------------|-------------------------------------------------------|
|
|
| Quality ✓ | Good | Clean JWT implementation following best practices |
|
|
| Security ⚠️ | Poor | Critical JWT verification vulnerability present |
|
|
| Performance ✓ | Good | Efficient key caching and library migration |
|
|
| Architecture ✓ | Good | Well-structured auth system with feature flag support |
|
|
|
|
Improvements Needed
|
|
|
|
| File | Issue | Severity | Recommendation |
|
|
|---------------------------------------------|------------------------------------------|----------|---------------------------------------------------------------------|
|
|
| ./src/util/jwt-token.ts:26 | Incorrect key selection for verification | High | Use publicKey instead of checking privateKey for token verification |
|
|
| ./src/middlewares/auth-middleware.ts:68 | Hardcoded httpOnly setting | Medium | Use consistent auth v2 flag check like in login route |
|
|
| ./src/app/portal/api/user/login/route.ts:82 | Age verification expiry inconsistency | Low | Consider using consistent expiry calculation method |
|
|
```
|
|
|
|
DO NOT include any other text, explanations, or comments outside the markdown table.
|
|
|
|
## Claude Code Integration
|
|
|
|
- Uses Glob for systematic file discovery
|
|
- Leverages Grep for pattern-based analysis
|
|
- Applies Read for deep code inspection
|
|
- Maintains structured analysis reporting
|