paulund/code-review
code-review/SKILL.md
Use when reviewing code, pull requests, or auditing code quality and best practices.
$ install --global
skillsauthnpx skillsauth add paulund/skills code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 20, 2026, 5:21 AM22.9s4 files scanned
SKILL.md
- name:
- code-review
- description:
- Use when reviewing code, pull requests, or auditing code quality and best practices.
Core Workflow
- Context - Understand the purpose and scope of the change being reviewed.
- Analyze the submitted code for functionality, readability, and adherence to coding standards.
- Identify areas for improvement, including potential bugs, performance issues, and security vulnerabilities.
- Provide constructive feedback with specific, actionable suggestions for improvement.
- Collaborate with the author to clarify questions and ensure understanding of the feedback.
Feedback Format
Group findings by severity:
- Critical — bugs, security vulnerabilities, data loss risks (must fix)
- High — performance issues, incorrect logic, architectural problems (should fix)
- Medium — code quality, readability, missing tests (fix when possible)
- Low — style, naming, minor improvements (optional)
For each finding: include the file and line reference, explain the problem, and suggest the fix.
What to Check
- Correctness — does it do what it's supposed to?
- Security — input validation, SQL injection, XSS, exposed IDs, auth checks
- Performance — N+1 queries, missing indexes, unnecessary work
- Architecture — does it follow the project's layered pattern (Value Objects, DTOs, Services, Jobs, Models)?
- Test coverage — are the happy path and edge cases covered?
Reference Guide
| Topic | Reference | Load When |
|-------|-----------|-----------|
| Review Checklist | references/code-review-checklist.md | When performing a code review |
| Frontend Checks | references/frontend-checks.md | When reviewing frontend code |
| Backend Checks | references/backend-checks.md | When reviewing backend code |
Constraints
MUST DO
- Provide clear, actionable feedback that the author can implement.
- Focus on both code quality and overall design/architecture.
- Be respectful and constructive in communication.
- Prioritize critical issues that impact functionality, security, or performance.
- Encourage best practices and knowledge sharing.
MUST NOT DO
- Be overly critical or negative; focus on improvement.
- Ignore coding standards or project guidelines.
- Overlook potential security vulnerabilities or performance issues.
- Provide vague feedback without specific suggestions.
- Rush through the review; take the time needed for thorough analysis.
Related Skills
paulund/test-driven-development
development
VerifiedTrustedCommunity
Use when implementing any logic, fixing any bug, or changing any behaviour. Use when you need to prove code works, when a bug report arrives, or when modifying existing functionality. Do NOT use for config changes, data migrations, or dependency updates.
3SKILL.mdUpdated Jul 1, 2026
paulund/spec-driven-development
development
VerifiedTrustedCommunity
Use when starting a new feature, when requirements are unclear, when asked to write code without a clear spec, or before any non-trivial implementation. Do NOT use for trivial bug fixes or one-line changes.
3SKILL.mdUpdated Jul 1, 2026
paulund/source-driven-development
development
VerifiedTrustedCommunity
Use when you want authoritative, source-cited code free from outdated patterns. Use when building with any framework or library where correctness matters. Detects the stack from dependency files, fetches official documentation, implements following documented patterns, and cites sources for every framework-specific decision.
3SKILL.mdUpdated Jul 1, 2026
paulund/shipping-and-launch
development
VerifiedTrustedCommunity
Use when preparing to ship a feature, release, or deployment. Use before merging to main, creating a release, or deploying to production. Do NOT use for CI-only changes or internal refactors that don't reach production.
3SKILL.mdUpdated Jul 1, 2026