Code Review
/code-review.promptReview the selected code (or the current diff if nothing is selected) across four dimensions. Only report issues you are **confident about** - flag uncertainty explicitly rather than guessing.
--- agent: agent description: Comprehensive code quality and security review of the selected code or recent changes --- # Code Review Review the selected code (or the current diff if nothing is selected) across four dimensions. Only report issues you are confident about : flag uncertainty explicitly rather than guessing. ## Dimensions ### 1. Security (CRITICAL : block ship if found) - Hardcoded secrets, tokens, API keys, passwords - Missing input validation or sanitization at system boundaries - SQL/NoSQL injection risk (string interpolation in queries) - XSS risk (unsanitized HTML output) - Auth/authz checks missing or client-side only - Sensitive data in logs or error messages exposed to clients - Missing rate limiting on public endpoints ### 2. Code Quality (HIGH) - Mutation of existing state instead of creating new objects - Functions over 50 lines or files over 800 lines - Nesting deeper than 4 levels - Duplicated logic that should be extracted - Misleading or non-descriptive names ### 3. Error Handling (HIGH) - Silently swallowed errors (catch {}, empty catch blocks) - Missing error handling at async boundaries - Errors returned but not checked by callers - User-facing error messages leaking internal details ### 4. Test Coverage (MEDIUM) - Missing tests for new logic - Tests that only test happy paths (missing error/edge cases) - Assertions that always pass ## Output Format For each issue found: `` **[CRITICAL|HIGH|MEDIUM|LOW]** : [File:Line if known] Issue: [What is wrong] Fix: [Concrete suggestion] ` End with a summary: ` ## Summary - Critical: N - High: N - Medium: N - Approved to ship: yes / no (fix CRITICAL and HIGH first) ``
