返回上一级
Code Review - 代码审查
这是一个代码审查方法论技能，用于检查代码中的错误、安全漏洞、性能问题和可维护性问题。适用于diff、PR、文件或粘贴的代码片段。 一、四个审查维度： 1、安全性：SQL注入、XSS、CSRF、认证与授权缺陷、代码中的密钥或凭证、不安全的反序列化、路径遍历、SSRF 2、性能：N+1查询、不必要的内存分配、热路径中的算法复杂度（O(n²)）、缺少数据库索引、无界查询或循环、资源泄漏 3、正确性：边缘情况（空输入、null、溢出）、竞态条件和并发问题、错误处理和传播、差一错误、类型安全 4、可维护性：命名清晰度、单一职责、重复代码、测试覆盖率、非显而易见逻辑的文档 二、输出格式：对每个维度评级，提供具体的、可操作的发现结果，包含文件和行号引用。关键问题优先。同时包含正面观察结果。 三、适用场景：用户分享代码并请求反馈时触发。
Skill 内容
---
name: code-review
description: Review code for bugs, security vulnerabilities, performance issues, and maintainability. Trigger with "review this code", "check this PR", "look at this diff", "is this code safe?", or when the user shares code and asks for feedback.
---
# Code Review
Structured code review covering security, performance, correctness, and maintainability. Works on diffs, PRs, files, or pasted code snippets.
## Review Dimensions
### Security
- SQL injection, XSS, CSRF
- Authentication and authorization flaws
- Secrets or credentials in code
- Insecure deserialization
- Path traversal
- SSRF
### Performance
- N+1 queries
- Unnecessary memory allocations
- Algorithmic complexity (O(n²) in hot paths)
- Missing database indexes
- Unbounded queries or loops
- Resource leaks
### Correctness
- Edge cases (empty input, null, overflow)
- Race conditions and concurrency issues
- Error handling and propagation
- Off-by-one errors
- Type safety
### Maintainability
- Naming clarity
- Single responsibility
- Duplication
- Test coverage
- Documentation for non-obvious logic
## Output Format
Rate each dimension and provide specific, actionable findings with file and line references. Prioritize critical issues first. Always include positive observations alongside issues.
评论
暂无评论
登录