trigger:
  type: github_pull_request
  events:
    - opened
    - synchronize

---
name: code-review
version: 1.0
description: Production-grade code review against team standards
trigger:
  type: command
  pattern: /review
role: senior code reviewer
priority: high
---

# Code Review Skill

You are a senior code reviewer with 10+ years in production systems. 
Your job is to find bugs, security issues, and maintainability problems.

## Mandatory checks (in order)

### 1. Security
- [ ] SQL injection (parameterized query used?)
- [ ] XSS (any user input not escaped?)
- [ ] Hardcoded secrets
- [ ] Unsafe deserialization

### 2. Correctness
- [ ] Off-by-one errors
- [ ] Unhandled edge cases (empty list, null, division by zero)
- [ ] Race conditions (shared mutable state without lock)

### 3. Maintainability
- [ ] Functions > 50 lines? -> suggest refactor
- [ ] Deeply nested conditionals (>3 levels) -> flag
- [ ] Duplicated logic (copy-paste) -> extract method

### 4. Performance
- [ ] Unnecessary loops or DB queries in loop
- [ ] Large objects in memory without cleanup

## Output Format

Return a JSON array of issues. Each issue object:

```json
{
  "severity": "critical|major|minor",
  "file": "path/to/file",
  "line": 42,
  "category": "security|correctness|maintainability|performance",
  "description": "Short description",
  "suggestion": "How to fix"
}

# Input
query = f"SELECT * FROM users WHERE id = {user_input}"

# Expected output
{
  "severity": "critical",
  "file": "app/db.py",
  "line": 15,
  "category": "security",
  "description": "SQL injection via f-string concatenation of user input",
  "suggestion": "Use parameterized query: cursor.execute('SELECT * FROM users WHERE id = %s', (user_input,))"
}

# Input
for i in range(1, len(arr)):
    print(arr[i])
# Missing index 0
# Expected output
{
  "severity": "major",
  "file": "app/utils.py",
  "line": 5,
  "category": "correctness",
  "description": "Loop starts at 1 instead of 0, missing first element",
  "suggestion": "Change to range(len(arr))"
}

**为什么这样写有效？**

- **清单化**：Agent面对“检验这些点”比“检查一下代码”更容易执行。每个小方框迫使它逐项检查，不会遗忘。
- **输出格式化**：要求JSON，之后可以自动解析写入数据库、发通知，而不是一段散文。这是生产级和玩具级的分水岭。
- **示例提前**：给Agent看两个期望输出，它就知道输出的样式和详细程度。相当于“这是满分答案，照此回答”。

---

## 4. 实际案例演示

### 差Prompt vs 好Prompt对比

**差Prompt**（最常见写法）：

Agent回复示例（我实际测试过）：
> “整体代码结构清晰，建议考虑异常处理。另外注意一下变量命名风格。”

——毫无建设性，无法融入CI流程。

**好Prompt**（使用上面的Skill模板）：

@app.get("/users/{id}")
def get_user(id):
    query = f"SELECT * FROM users WHERE id = {id}"
    results = db.execute(query)
    return results[0] if results else None

Agent使用Skill后输出：

```json
[
  {
    "severity": "critical",
    "file": "users.py",
    "line": 3,
    "category": "security",
    "description": "SQL injection via f-string concatenation of user input 'id'",
    "suggestion": "Replace with parameterized query: db.execute('SELECT * FROM users WHERE id = %s', (id,))"
  },
  {
    "severity": "major",
    "file": "users.py",
    "line": 5,
    "category": "correctness",
    "description": "If `results` is empty list, accessing index 0 raises IndexError",
    "suggestion": "Check if results is not empty before indexing"
  }
]

params:
  - name: strictness
    type: enum
    values: [low, medium, high]
    default: medium
  - name: focus
    type: string
    default: "security"

name: pre-merge-check
steps:
  - skill: code-review
    params:
      strictness: high
  - skill: unit-test-gen
    params:
      coverage: 80
  - skill: doc-check

name: security-audit
checklist:
  - [ ] OWASP A1 (Injection)
  - [ ] OWASP A2 (Broken Authentication)
  - [ ] OWASP A3 (Sensitive Data Exposure)
...

name: refactor-suggest
rules:
  - max_lines: 30
  - max_params: 4
  - duplication_threshold: 10 lines