Agent Skills
› anthropics/knowledge-work-plugins
› code-review
code-review
GitHub用于审查代码变更，涵盖安全性、性能、正确性及可维护性。支持通过PR URL或文件路径触发，提供结构化报告及改进建议。
Trigger Scenarios
提供 PR URL 或 diff
用户请求 'review this before I merge'
询问 'is this code safe?'
Install
npx skills add anthropics/knowledge-work-plugins --skill code-review -g -y
SKILL.md
Frontmatter
{
"name": "code-review",
"description": "Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, \"review this before I merge\", \"is this code safe?\", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.",
"argument-hint": "<PR URL, diff, or file path>"
}
/code-review
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Review code changes with a structured lens on security, performance, correctness, and maintainability.
Usage
/code-review <PR URL or file path>
Review the provided code changes: @$1
If no specific file or URL is provided, ask what to review.
How It Works
┌─────────────────────────────────────────────────────────────────┐
│ CODE REVIEW │
├─────────────────────────────────────────────────────────────────┤
│ STANDALONE (always works) │
│ ✓ Paste a diff, PR URL, or point to files │
│ ✓ Security audit (OWASP top 10, injection, auth) │
│ ✓ Performance review (N+1, memory leaks, complexity) │
│ ✓ Correctness (edge cases, error handling, race conditions) │
│ ✓ Style (naming, structure, readability) │
│ ✓ Actionable suggestions with code examples │
├─────────────────────────────────────────────────────────────────┤
│ SUPERCHARGED (when you connect your tools) │
│ + Source control: Pull PR diff automatically │
│ + Project tracker: Link findings to tickets │
│ + Knowledge base: Check against team coding standards │
└─────────────────────────────────────────────────────────────────┘
Review Dimensions
Security
- SQL injection, XSS, CSRF
- Authentication and authorization flaws
- Secrets or credentials in code
- Insecure deserialization
- Path traversal
- SSRF
Performance
- N+1 queries
- Unnecessary memory allocations
- Algorithmic complexity (O(n²) in hot paths)
- Missing database indexes
- Unbounded queries or loops
- Resource leaks
Correctness
- Edge cases (empty input, null, overflow)
- Race conditions and concurrency issues
- Error handling and propagation
- Off-by-one errors
- Type safety
Maintainability
- Naming clarity
- Single responsibility
- Duplication
- Test coverage
- Documentation for non-obvious logic
Output
## Code Review: [PR title or file]
### Summary
[1-2 sentence overview of the changes and overall quality]
### Critical Issues
| # | File | Line | Issue | Severity |
|---|------|------|-------|----------|
| 1 | [file] | [line] | [description] | 🔴 Critical |
### Suggestions
| # | File | Line | Suggestion | Category |
|---|------|------|------------|----------|
| 1 | [file] | [line] | [description] | Performance |
### What Looks Good
- [Positive observations]
### Verdict
[Approve / Request Changes / Needs Discussion]
If Connectors Available
If ~~source control is connected:
- Pull the PR diff automatically from the URL
- Check CI status and test results
If ~~project tracker is connected:
- Link findings to related tickets
- Verify the PR addresses the stated requirements
If ~~knowledge base is connected:
- Check changes against team coding standards and style guides
Tips
- Provide context — "This is a hot path" or "This handles PII" helps me focus.
- Specify concerns — "Focus on security" narrows the review.
- Include tests — I'll check test coverage and quality too.
Version History
- 6f13415 Current 2026-07-05 18:28
