Code Review Expert

{
  "schema_version": "2.0",
  "meta": {
    "generated_at": "2026-01-16T17:39:13.012Z",
    "slug": "barissozen-code-review-expert",
    "source_url": "https://github.com/BarisSozen/claude/tree/main/.claude/skills/code-review-expert",
    "source_ref": "main",
    "model": "claude",
    "analysis_version": "3.0.0",
    "source_type": "community",
    "content_hash": "557ab2564f7003e7ff3e2cf8325db44d7eada9aa5a68a71c35a82ed734f7b244",
    "tree_hash": "dc5a0524a87b526b9293f3627677c8beb42e33b7bfbd539ccf212a187b3ce14c"
  },
  "skill": {
    "name": "code-review-expert",
    "description": "Comprehensive code review expertise. Use when reviewing code, evaluating architecture, or assessing quality. Triggers on review, evaluate, assess, audit, code quality, best practices.",
    "summary": "Comprehensive code review expertise. Use when reviewing code, evaluating architecture, or assessing ...",
    "icon": "🔍",
    "version": "1.0.0",
    "author": "BarisSozen",
    "license": "MIT",
    "category": "coding",
    "tags": [
      "code review",
      "software quality",
      "security audit",
      "architecture review",
      "best practices"
    ],
    "supported_tools": [
      "claude",
      "codex",
      "claude-code"
    ],
    "risk_factors": [
      "network",
      "filesystem",
      "external_commands"
    ]
  },
  "security_audit": {
    "risk_level": "safe",
    "is_blocked": false,
    "safe_to_publish": true,
    "summary": "All 18 static findings are FALSE POSITIVES. This is a prompt-only skill containing only documentation (SKILL.md) and a metadata report (skill-report.json). No executable code exists. The 'weak cryptographic algorithm' detections are percentages (10%, 40%, etc.) and documentation text. The 'backtick execution' detections are Markdown code fences. The 'hardcoded URL' is a metadata source_url field. This skill is safe for publishing.",
    "risk_factor_evidence": [
      {
        "factor": "network",
        "evidence": [
          {
            "file": "skill-report.json",
            "line_start": 6,
            "line_end": 6
          }
        ]
      },
      {
        "factor": "filesystem",
        "evidence": [
          {
            "file": "skill-report.json",
            "line_start": 6,
            "line_end": 6
          }
        ]
      },
      {
        "factor": "external_commands",
        "evidence": [
          {
            "file": "SKILL.md",
            "line_start": 43,
            "line_end": 49
          },
          {
            "file": "SKILL.md",
            "line_start": 49,
            "line_end": 62
          }
        ]
      }
    ],
    "critical_findings": [],
    "high_findings": [],
    "medium_findings": [],
    "low_findings": [],
    "dangerous_patterns": [],
    "files_scanned": 2,
    "total_lines": 244,
    "audit_model": "claude",
    "audited_at": "2026-01-16T17:39:13.012Z"
  },
  "content": {
    "user_title": "Review code with expert methodology",
    "value_statement": "Code reviews often miss critical issues due to inconsistent approaches. This skill provides a structured 5-phase review methodology ensuring thorough analysis from architecture to security. Generate consistent, prioritized findings with clear severity levels.",
    "seo_keywords": [
      "code review",
      "software architecture review",
      "code quality assessment",
      "security audit",
      "Claude Code review",
      "best practices",
      "code review checklist",
      "software quality gates",
      "developer tools",
      "code analysis"
    ],
    "actual_capabilities": [
      "Provides 5-phase code review methodology (scan, top-down, multi-perspective, deep dives, report)",
      "Evaluates code from Architect, PM, QA, and UX perspectives",
      "Identifies security issues and performance concerns",
      "Applies severity levels (Critical, High, Medium, Low) with clear actions",
      "Uses structured checklist covering types, error handling, validation, and security patterns"
    ],
    "limitations": [
      "Does not execute or test code - only provides review guidance",
      "Does not access or analyze external code files directly",
      "Does not integrate with CI/CD pipelines or version control",
      "Requires user to provide code context for review"
    ],
    "use_cases": [
      {
        "target_user": "Software Developers",
        "title": "Pre-merge Code Review",
        "description": "Review pull requests systematically before merging to catch issues early and maintain code quality standards."
      },
      {
        "target_user": "Tech Leads",
        "title": "Architecture Assessment",
        "description": "Evaluate proposed designs and implementations against architectural principles and scalability requirements."
      },
      {
        "target_user": "Security Engineers",
        "title": "Security-Focused Audits",
        "description": "Conduct deep-dive security reviews focusing on vulnerabilities, injection risks, and secure patterns."
      }
    ],
    "prompt_templates": [
      {
        "title": "Quick Review",
        "scenario": "Review a code snippet",
        "prompt": "Review this code for quality and security issues: [paste code]"
      },
      {
        "title": "Architecture Review",
        "scenario": "Evaluate system design",
        "prompt": "Perform an architecture review of this module. Consider: [paste code or design document]"
      },
      {
        "title": "Security Audit",
        "scenario": "Find vulnerabilities",
        "prompt": "Conduct a security-focused audit of this code. Look for: injection risks, auth issues, data exposure, and secure coding violations."
      },
      {
        "title": "Full Multi-Perspective",
        "scenario": "Comprehensive review",
        "prompt": "Perform a complete code review using the 5-phase methodology. Review from Architect, PM, QA, and UX perspectives. Prioritize findings by severity."
      }
    ],
    "output_examples": [
      {
        "input": "Review this function for issues: [code snippet]",
        "output": [
          "🔴 CRITICAL: Missing input validation on user parameter - risk of injection attack",
          "🟠 HIGH: Error handling incomplete - uncaught exceptions will crash the service",
          "🟡 MEDIUM: Complex nested conditionals reduce readability - consider refactoring",
          "🟢 LOW: Variable naming inconsistent - mix of camelCase and snake_case"
        ]
      },
      {
        "input": "Review this architecture design for scalability: [design document]",
        "output": [
          "🟠 HIGH: Single database connection bottleneck under load - consider connection pooling",
          "🟡 MEDIUM: Service coupling through synchronous calls - recommend async messaging",
          "🟢 LOW: Missing caching layer for frequently accessed configuration data"
        ]
      },
      {
        "input": "Audit this authentication module: [auth code]",
        "output": [
          "🔴 CRITICAL: Password stored without salt - hash using bcrypt or argon2",
          "🟠 HIGH: Session tokens never expire - implement token refresh and expiration",
          "🟡 MEDIUM: No rate limiting on login endpoint - risk of brute force attack"
        ]
      }
    ],
    "best_practices": [
      "Use the full 5-phase methodology for comprehensive reviews rather than quick scans",
      "Apply consistent severity levels and document clear remediation actions",
      "Review from multiple perspectives (Architect, PM, QA, UX) to catch different issue types"
    ],
    "anti_patterns": [
      "Skipping the initial architecture scan leads to missing structural issues",
      "Not prioritizing findings leaves teams unsure what to fix first",
      "Focusing only on syntax without considering security or performance implications"
    ],
    "faq": [
      {
        "question": "What AI tools support this skill?",
        "answer": "This skill works with Claude, Codex, and Claude Code. It triggers on review, evaluate, assess, audit, code quality, and best practices keywords."
      },
      {
        "question": "What is the 5-phase review methodology?",
        "answer": "Phase 1: Initial scan (10%) for structure. Phase 2: Top-down review (40%) from architecture to functions. Phase 3: Multi-perspective (30%) review. Phase 4: Deep dives (15%) on security and performance. Phase 5: Report (5%) with prioritized findings."
      },
      {
        "question": "Does this skill integrate with my CI/CD pipeline?",
        "answer": "No, this is a prompt-based skill that provides guidance. It does not directly integrate with CI/CD systems or automatically analyze repositories."
      },
      {
        "question": "Is my code data safe with this skill?",
        "answer": "Yes. This skill only provides review methodology guidance. It does not access, store, or transmit code outside of the current conversation with your AI assistant."
      },
      {
        "question": "What severity levels are used for findings?",
        "answer": "Critical (must fix before deploy), High (fix this sprint), Medium (fix next sprint), Low (backlog). Each level has clear remediation actions defined."
      },
      {
        "question": "How is this different from static analysis tools?",
        "answer": "Static analysis tools check syntax and patterns. This skill provides human judgment for architecture decisions, trade-offs, and complex issues that require contextual understanding. Use both together."
      }
    ]
  },
  "file_structure": [
    {
      "name": "SKILL.md",
      "type": "file",
      "path": "SKILL.md",
      "lines": 68
    }
  ]
}