tranhieutt/code-review
.claude/skills/code-review/SKILL.md
Performs architectural and quality code review checking coding standards, SOLID principles, architectural compliance, and common software issues. Use when reviewing a file or directory before merge, or when the user mentions code review, PR review, or quality check.
$ install --global
skillsauthnpx skillsauth add tranhieutt/software_development_department code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 15, 2026, 11:48 PM14.9s1 file scanned
SKILL.md
- name:
- code-review
- description:
- Performs architectural and quality code review checking coding standards, SOLID principles, architectural compliance, and common software issues. Use when reviewing a file or directory before merge, or when the user mentions code review, PR review, or quality check.
- argument-hint:
- [path-to-file-or-directory]
- user-invocable:
- true
- allowed-tools:
- Read, Glob, Grep, Bash
- context:
- fork
- agent:
- lead-programmer
- effort:
- 2
- when_to_use:
- When a full architectural and quality review is needed before merging a PR
When this skill is invoked:
-
Read the target file(s) in full.
-
Read the CLAUDE.md for project coding standards.
-
Identify the system category (api, service, repository, component, utility, infrastructure) and apply category-specific standards.
-
Evaluate against coding standards:
- [ ] Public methods and classes have doc comments
- [ ] Cyclomatic complexity under 10 per method
- [ ] No method exceeds 40 lines (excluding data declarations)
- [ ] Dependencies are injected (no singletons for business state)
- [ ] Configuration values loaded from external config, not hardcoded
- [ ] Systems expose interfaces (not concrete class dependencies)
-
Check architectural compliance:
- [ ] Correct dependency direction (infrastructure ← domain ← application)
- [ ] No circular dependencies between modules
- [ ] Proper layer separation (UI does not own business logic)
- [ ] Events/messages used for cross-service communication
- [ ] Consistent with established patterns in the codebase
-
Check SOLID compliance:
- [ ] Single Responsibility: Each class has one reason to change
- [ ] Open/Closed: Extendable without modification
- [ ] Liskov Substitution: Subtypes substitutable for base types
- [ ] Interface Segregation: No fat interfaces
- [ ] Dependency Inversion: Depends on abstractions, not concretions
-
Check for common web/software issues:
- [ ] No N+1 query patterns (use eager loading or joins)
- [ ] Proper async/await usage (no unhandled promises, no floating async)
- [ ] Input validation at system boundaries (user input, external APIs)
- [ ] Proper error handling with meaningful, safe messages (no stack traces exposed)
- [ ] No secrets or sensitive data hardcoded (API keys, passwords, tokens)
- [ ] Resource cleanup (DB connections, streams, subscriptions, event listeners)
- [ ] Thread/concurrency safety where required
-
Output the review in this format:
## Code Review: [File/System Name]
### Standards Compliance: [X/6 passing]
[List failures with line references]
### Architecture: [CLEAN / MINOR ISSUES / VIOLATIONS FOUND]
[List specific architectural concerns]
### SOLID: [COMPLIANT / ISSUES FOUND]
[List specific violations]
### Web/Software Concerns
[List web and software-specific issues found]
### Positive Observations
[What is done well — always include this section]
### Required Changes
[Must-fix items before approval]
### Suggestions
[Nice-to-have improvements]
### Verdict: [APPROVED / APPROVED WITH SUGGESTIONS / CHANGES REQUIRED]
Protocol
- Question: Auto-starts from argument (file or directory path); no clarification needed
- Options: Skip — single review path
- Decision: Skip — verdict is advisory
- Draft: Full review shown in conversation only
- Approval: Skip — read-only; no files written
Output
Deliver exactly:
- Risk Tier (Low / Medium / High) with one-sentence justification
- Standards & Architecture compliance score (X/6, X/5)
- Blocking issues — must fix before merge (or "None")
- Suggestions — optional improvements, max 3
- Verdict:
APPROVED/APPROVED WITH SUGGESTIONS/CHANGES REQUIRED
Related Skills
tranhieutt/visual-engineer
testing
VerifiedTrustedCommunity
Generates high-fidelity architecture diagrams, sequence flows, and component maps for SDD projects. Use when finalizing a design phase, documenting system architecture, or visualizing agentic workflows. Default style: Style 6 (Claude Official).
60SKILL.mdUpdated Apr 15, 2026
tranhieutt/vector-database-engineer
data-ai
VerifiedTrustedCommunity
Provides vector database and semantic search patterns for Pinecone, Weaviate, Qdrant, Milvus, and pgvector in RAG and recommendation systems. Use when implementing vector search or when the user mentions vector database, semantic search, embeddings, or similarity search.
60SKILL.mdUpdated Apr 15, 2026
tranhieutt/update-codemap
development
VerifiedTrustedCommunity
Updates docs/technical/CODEMAP.md by scanning the current codebase structure. Run after a significant feature merge, refactor, or when CODEMAP feels stale.
60SKILL.mdUpdated Apr 15, 2026
tranhieutt/unfreeze
development
VerifiedTrustedCommunity
Unlocks the codebase after a release freeze or incident freeze period to resume normal development. Use when a freeze period ends or when the user mentions unfreezing or lifting the code freeze.
60SKILL.mdUpdated Apr 15, 2026