Skill · Build
Code review
Get a senior-engineer code review from AI: bugs, security issues, edge cases and readability problems, ranked by severity with suggested fixes.
The skill#
Act as a senior software engineer doing a careful code review.
Language and framework: [LANGUAGE AND FRAMEWORK]
What the code should do: [PURPOSE]
The code: [PASTE YOUR CODE OR DIFF]
Review it for:
1. Bugs and logic errors, including edge cases (empty input, nulls, large values, concurrency).
2. Security issues (injection, unsafe input handling, secrets, access control).
3. Error handling and failure modes.
4. Performance problems that matter at realistic scale.
5. Readability and maintainability.
For each issue give: severity (critical, major, minor), the exact line or function, why it is a problem, and a suggested fix.
Only report issues you can point to in the code. Do not invent APIs. If something depends on code you cannot see, say so.How to use it#
- Copy the skill and paste the code or diff, with the language and what it should do.
- Fix critical and major issues first; question minor style points if they don't fit your codebase.
- Add the suggested tests so the bug cannot come back.
Example#
Paste a 60-line login handler. You get a critical SQL-injection issue on line 14 with a parameterized-query fix, a major missing rate limit, two minor naming notes, and tests for each.
Quick and strict versions#
Use the quick version for everyday checks and the strict version when the result matters.
Review this code and list the three most serious problems (bugs or security first), each with the line and a fix.
Code: [PASTE YOUR CODE]Act as a staff engineer and security reviewer. Context: [LANGUAGE, FRAMEWORK, PURPOSE, WHERE IT RUNS]
Code or diff: [PASTE YOUR CODE OR DIFF]
1. Trace the main execution paths and state what the code actually does.
2. For each path, test edge cases: empty, null, huge, malformed, concurrent and repeated calls.
3. Check security against the OWASP Top 10 categories that apply.
4. Check error handling: what happens on failure, and is anything left half-done?
5. Suggest tests that would catch each bug found.
Only report what you can point to. Mark anything that needs code you cannot see as "Needs context".
Return: Summary | Issue table (severity | location | problem | fix | test) | Questions for the authorUse it as an agent skill#
Save this as SKILL.md in a folder named after the skill, and agents that support skills (Claude, Claude Code and other skill-aware agents) can load it automatically when the task fits.
---
name: code-review
description: Use when the user shares code or a diff and wants it reviewed for bugs, security problems and quality.
---
# Code review
Fill each [BRACKETED] field from the conversation. If one is missing, ask the user for it before starting.
Act as a senior software engineer doing a careful code review.
Language and framework: [LANGUAGE AND FRAMEWORK]
What the code should do: [PURPOSE]
The code: [PASTE YOUR CODE OR DIFF]
Review it for:
1. Bugs and logic errors, including edge cases (empty input, nulls, large values, concurrency).
2. Security issues (injection, unsafe input handling, secrets, access control).
3. Error handling and failure modes.
4. Performance problems that matter at realistic scale.
5. Readability and maintainability.
For each issue give: severity (critical, major, minor), the exact line or function, why it is a problem, and a suggested fix.
Only report issues you can point to in the code. Do not invent APIs. If something depends on code you cannot see, say so.
Frequently asked questions
Can AI replace human code review?
Not fully. It is fast at catching common bugs and security issues, but humans still need to judge design, intent and context.
Is it safe to paste code into AI?
Check your company's policy. Never paste secrets, keys or credentials; remove them first.
Why does it say "Needs context"?
Many bugs depend on code it cannot see. Flagging them is better than guessing how unseen functions behave.