Agent Skills
› vudovn/ag-kit
› code-review-checklist
code-review-checklist
GitHub提供代码审查清单，涵盖正确性、安全、性能、质量及测试等维度。特别针对AI应用，包含提示工程审查和防注入指南，并定义评论分级标准，辅助高效完成代码评审工作。
Trigger Scenarios
需要检查代码质量或安全漏洞
进行AI相关代码的提示工程审查
Install
npx skills add vudovn/ag-kit --skill code-review-checklist -g -y
SKILL.md
Frontmatter
{
"name": "code-review-checklist",
"version": "1.0.0",
"description": "Code review guidelines covering code quality, security, and best practices.",
"when_to_use": "When reviewing code for quality, security, and best practices. When the user says 'review my code' or 'check this PR'.",
"allowed-tools": "Read, Glob, Grep"
}
Code Review Checklist
Quick Review Checklist
Correctness
- Code does what it's supposed to do
- Edge cases handled
- Error handling in place
- No obvious bugs
Security
- Input validated and sanitized
- No SQL/NoSQL injection vulnerabilities
- No XSS or CSRF vulnerabilities
- No hardcoded secrets or sensitive credentials
- AI-Specific: Protection against Prompt Injection (if applicable)
- AI-Specific: Outputs are sanitized before being used in critical sinks
Performance
- No N+1 queries
- No unnecessary loops
- Appropriate caching
- Bundle size impact considered
Code Quality
- Clear naming
- DRY - no duplicate code
- SOLID principles followed
- Appropriate abstraction level
Testing
- Unit tests for new code
- Edge cases tested
- Tests readable and maintainable
Documentation
- Complex logic commented
- Public APIs documented
- README updated if needed
AI & LLM Review Patterns
Logic & Hallucinations
- Chain of Thought: Does the logic follow a verifiable path?
- Edge Cases: Did the AI account for empty states, timeouts, and partial failures?
- External State: Is the code making safe assumptions about file systems or networks?
Prompt Engineering Review
// ❌ Vague prompt in code
const response = await ai.generate(userInput);
// ✅ Structured & Safe prompt
const response = await ai.generate({
system: "You are a specialized parser...",
input: sanitize(userInput),
schema: ResponseSchema
});
Anti-Patterns to Flag
// ❌ Magic numbers
if (status === 3) { ... }
// ✅ Named constants
if (status === Status.ACTIVE) { ... }
// ❌ Deep nesting
if (a) { if (b) { if (c) { ... } } }
// ✅ Early returns
if (!a) return;
if (!b) return;
if (!c) return;
// do work
// ❌ Long functions (100+ lines)
// ✅ Small, focused functions
// ❌ any type
const data: any = ...
// ✅ Proper types
const data: UserData = ...
Review Comments Guide
// Blocking issues use 🔴
🔴 BLOCKING: SQL injection vulnerability here
// Important suggestions use 🟡
🟡 SUGGESTION: Consider using useMemo for performance
// Minor nits use 🟢
🟢 NIT: Prefer const over let for immutable variable
// Questions use ❓
❓ QUESTION: What happens if user is null here?
Version History
- 211561c Current 2026-08-20 11:38
