Code Quality Workflow

Code Quality Workflow

Overview

Standardize how to analyze, review, and improve code quality. This skill centralizes quality assessment, code review practices, and systematic improvements with validation gates.

When to Use

• Quality assessment or code analysis requests
• Code review (PRs, refactors, pre-merge checks)
• Maintainability or performance improvements
• Security hygiene improvements (non-audit level)

Avoid when:

• A full security audit is required (use security-specific skills)
• The task is purely dependency or artifact cleanup (use repo-cleanup)

Quick Reference

Workflow

1. Select the mode: analyze, review, or improve. 2. Load the matching reference file for the expected structure. 3. Inspect code and identify findings or opportunities. 4. Apply changes (if improving) with safety validation. 5. Verify with tests or lint as appropriate. 6. Report findings, fixes, and follow-ups.

Output

• Findings or improvements summary
• Validation evidence or recommended checks
• Follow-up backlog items if needed

Common Mistakes

• Skipping severity prioritization
• Mixing review and improvement without sign-off
• Applying fixes without baseline tests
• Overlapping with full security audit scopes

Reference: code

/analyze:code - Code Analysis and Quality Assessment

Triggers

• Code quality assessment requests for projects or specific components
• Security vulnerability scanning and compliance validation needs
• Performance bottleneck identification and optimization planning
• Architecture review and technical debt assessment requirements

Usage

/analyze:code [target] [--focus quality|security|performance|architecture] [--depth quick|deep|ultra] [--reasoning-profile default|security|performance|architecture|data|testing] [--format text|json|report]

Behavioral Flow

1. Discover: Categorize source files using language detection and project analysis 2. Scan: Apply domain-specific analysis techniques and pattern matching 3. Evaluate: Generate prioritized findings with severity ratings and impact assessment 4. Recommend: Create actionable recommendations with implementation guidance 5. Report: Present comprehensive analysis with metrics and improvement roadmap

Key behaviors:

• Multi-domain analysis combining static analysis and heuristic evaluation
• Intelligent file discovery and language-specific pattern recognition
• Severity-based prioritization of findings and recommendations
• Comprehensive reporting with metrics, trends, and actionable insights

Personas (Thinking Modes)

• analyzer: Deep analysis, pattern recognition, systematic evaluation
• architect: System design understanding, architecture patterns, scalability thinking
• security-specialist: Security-first mindset, threat awareness, vulnerability detection
• performance-engineer: Performance optimization, bottleneck identification, efficiency focus

Delegation Protocol

When to delegate (use Task tool):

• ✅ Deep analysis (--depth deep or ultra)
• ✅ Multi-domain analysis (multiple focus areas)
• ✅ Large codebase (>20 files)
• ✅ Security or performance focused analysis requiring specialized expertise

Available subagents:

• code-reviewer: Quality, maintainability, architecture analysis
• security-auditor: Security vulnerabilities, threat modeling, compliance
• Explore: Codebase discovery, pattern identification, dependency analysis

Delegation strategy for comprehensive analysis:

<function_calls>
<invoke name="Task">
  <subagent_type>Explore</subagent_type>
  <description>Discover and categorize project structure</description>
  <prompt>
    Analyze project structure:
    - File organization and patterns
    - Language distribution
    - Key components and dependencies
    - Architecture patterns
  </prompt>
</invoke>
<invoke name="Task">
  <subagent_type>code-reviewer</subagent_type>
  <description>Quality and architecture analysis</description>
  <prompt>
    Multi-domain analysis focusing on: [quality|performance|architecture]
    - Code smells and anti-patterns
    - Best practices compliance
    - Performance considerations
    Reasoning profile: [default|performance|architecture]
  </prompt>
</invoke>
<invoke name="Task">
  <subagent_type>security-auditor</subagent_type>
  <description>Security vulnerability assessment</description>
  <prompt>
    Security-focused analysis:
    - OWASP Top 10 patterns
    - Authentication/authorization
    - Data protection
    Reasoning profile: security
  </prompt>
</invoke>
</function_calls>

When NOT to delegate (use direct tools):

• ❌ Quick quality check (--depth quick, small codebase)
• ❌ Single file analysis
• ❌ Simple pattern searches

Tool Coordination

• Task tool: Delegates to subagents for deep multi-domain analysis
• Glob: File discovery (direct for quick, by subagent for deep)
• Grep: Pattern analysis (direct for quick, by subagent for deep)
• Read: Source code inspection (direct for quick, by subagent for deep)
• Bash: External analysis tools (by subagent when needed)
• Write: Report generation

Reasoning Profiles

default

• Balanced analysis across all focus domains
• Standard severity assessment and prioritization
• Comprehensive reporting with actionable insights

security

• Deep threat modeling and attack vector analysis
• OWASP Top 10 pattern matching and CVE correlation
• Enhanced severity scoring for security vulnerabilities
• Compliance validation (GDPR, SOC2, PCI-DSS considerations)
• Enables: Context7 for security best practices, Sequential for threat chains

performance

• Algorithmic complexity analysis (Big-O notation)
• Resource usage profiling and bottleneck identification
• Scalability assessment and load testing recommendations
• Database query optimization and N+1 detection
• Enables: Sequential for performance impact chains

architecture

• System design pattern recognition and anti-pattern detection
• Service boundary analysis and microservices decomposition strategies
• Dependency graph analysis with circular dependency detection
• API design evaluation and REST/GraphQL best practices
• Scalability and resilience architecture assessment
• Event-driven architecture and message flow analysis
• Enables: Context7 for api-design-patterns, microservices-patterns skills
• Enables: Sequential for dependency chain analysis

data

• Database schema design analysis and normalization assessment
• Query performance optimization and index recommendations
• Data flow mapping and ETL pipeline evaluation
• CQRS and Event Sourcing pattern application
• Data consistency and integrity validation
• Migration strategy assessment for schema changes
• Enables: Context7 for database-design-patterns, cqrs-event-sourcing skills
• Enables: Sequential for data flow impact analysis

testing

• Test coverage gap identification and quality assessment
• Test pattern analysis (unit, integration, e2e structure)
• Property-based testing opportunity detection
• Mock and stub usage evaluation
• Test maintainability and flakiness analysis
• TDD/BDD pattern compliance verification
• Enables: Context7 for python-testing-patterns skill
• Enables: Sequential for test dependency analysis

Key Patterns

• Domain Analysis: Quality/Security/Performance/Architecture → specialized assessment
• Pattern Recognition: Language detection → appropriate analysis techniques
• Severity Assessment: Issue classification → prioritized recommendations
• Report Generation: Analysis results → structured documentation
• Profile Specialization: Reasoning profile → domain-specific depth and tool activation

Examples

Comprehensive Project Analysis

/analyze:code
# Multi-domain analysis of entire project
# Generates comprehensive report with key findings and roadmap

Focused Security Assessment

/analyze:code src/auth --focus security --depth deep --reasoning-profile security
# Deep security analysis of authentication components
# Enables threat modeling, OWASP patterns, CVE correlation
# Vulnerability assessment with detailed remediation guidance

Performance Optimization Analysis

/analyze:code --focus performance --depth ultra --reasoning-profile performance --format report
# Performance bottleneck identification with deep analysis
# Algorithmic complexity analysis, resource profiling
# Generates comprehensive report with optimization recommendations

Quick Quality Check

/analyze:code src/components --focus quality --depth quick
# Rapid quality assessment of component directory
# Identifies code smells and maintainability issues

Boundaries

Will:

• Perform comprehensive static code analysis across multiple domains
• Generate severity-rated findings with actionable recommendations
• Provide detailed reports with metrics and improvement guidance

Will Not:

• Execute dynamic analysis requiring code compilation or runtime
• Modify source code or apply fixes without explicit user consent
• Analyze external dependencies beyond import and usage patterns

Reference: code-review

/dev:code-review - Comprehensive Code Review

Purpose

Perform systematic code review focusing on quality, security, and best practices.

Triggers

• Pull request reviews
• Pre-commit code quality checks
• Refactoring validation
• Manual code review requests

Usage

/dev:code-review [path] [--focus quality|security|performance|all]

Review Process

1. Code Quality Analysis

• Identify code smells and anti-patterns
• Check naming conventions and consistency
• Review error handling patterns
• Assess code readability and maintainability
• Find unused imports, variables, or dead code

2. Security Assessment

• Scan for common vulnerabilities (OWASP Top 10)
• Check for hardcoded secrets or credentials
• Review authentication and authorization logic
• Examine input validation and sanitization
• Identify security risks in dependencies

3. Performance Review

• Identify potential performance bottlenecks
• Check for inefficient algorithms or queries
• Review memory usage patterns
• Analyze bundle size and optimization opportunities

4. Architecture Evaluation

• Evaluate code organization and separation of concerns
• Check for proper abstraction and modularity
• Review dependency management and coupling
• Assess scalability and maintainability

Output Format

Summary: Overall code health score and key findings

Critical Issues: Must-fix problems (blocking) Important Issues: Should-fix problems (high priority) Suggestions: Nice-to-have improvements

Best Practices: Recommendations for improvement

Personas (Thinking Modes)

• quality-engineer: Code quality standards, best practices, maintainability focus
• security-specialist: Security-first mindset, threat awareness, vulnerability prevention

Delegation Protocol

This command ALWAYS delegates - code review requires specialized expertise.

When triggered:

• ✅ Any code review request (PR review, pre-commit, manual review)
• ✅ All focus areas (quality, security, performance, architecture)

Delegation strategy:

For general quality review:

<invoke name="Task">
  <subagent_type>code-reviewer</subagent_type>
  <description>Review code quality for [path]</description>
  <prompt>
    Perform comprehensive code review focusing on:
    - Code quality and anti-patterns
    - Best practices compliance
    - Performance considerations
    - Architecture evaluation
    Provide prioritized findings with severity levels.
  </prompt>
</invoke>

For security-focused review (--focus security or all):

<function_calls>
<invoke name="Task">
  <subagent_type>code-reviewer</subagent_type>
  <description>Review code quality</description>
  <prompt>Quality and architecture review...</prompt>
</invoke>
<invoke name="Task">
  <subagent_type>security-auditor</subagent_type>
  <description>Security assessment</description>
  <prompt>
    Security-focused review:
    - OWASP Top 10 vulnerabilities
    - Authentication/authorization issues
    - Input validation
    - Secret scanning
    Provide security risk assessment.
  </prompt>
</invoke>
</function_calls>

Tool Coordination:

• Task tool: Launches code-reviewer and/or security-auditor subagents
• Read/Grep: Code analysis (done by subagents)
• TodoWrite: Track review findings (if extensive)

Example

/dev:code-review src/auth --focus security

Reference: improve

/quality:improve - Code Improvement

Triggers

• Code quality enhancement and refactoring requests
• Performance optimization and bottleneck resolution needs
• Maintainability improvements and technical debt reduction
• Best practices application and coding standards enforcement

Usage

/quality:improve [target] [--type quality|performance|maintainability|style] [--safe] [--interactive]

Behavioral Flow

1. Analyze: Examine codebase for improvement opportunities and quality issues 2. Plan: Choose improvement approach and activate relevant personas for expertise 3. Execute: Apply systematic improvements with domain-specific best practices 4. Validate: Ensure improvements preserve functionality and meet quality standards 5. Document: Generate improvement summary and recommendations for future work

Key behaviors:

• Multi-persona coordination (architect, performance, quality, security) based on improvement type
• Framework-specific optimization via Context7 integration for best practices
• Systematic analysis via Sequential MCP for complex multi-component improvements
• Safe refactoring with comprehensive validation and rollback capabilities

MCP Integration

• Sequential MCP: Auto-activated for complex multi-step improvement analysis and planning
• Context7 MCP: Framework-specific best practices and optimization patterns
• Persona Coordination: Architect (structure), Performance (speed), Quality (maintainability), Security (safety)

Personas (Thinking Modes)

• architect: System structure, design patterns, architectural improvements
• performance-engineer: Bottleneck identification, optimization strategies, efficiency focus
• quality-engineer: Code quality standards, maintainability, best practices
• security-specialist: Security patterns, vulnerability prevention, secure coding

Delegation Protocol

When to delegate (use Task tool):

• ✅ Large-scale improvements (>5 files)
• ✅ Multi-domain improvements (quality + performance + security)
• ✅ Complex refactoring requiring analysis
• ✅ Performance optimization needing profiling
• ✅ Interactive improvement mode (user decisions needed)

Available subagents:

• Explore: Codebase analysis, improvement opportunity identification
• general-purpose: Apply improvements, refactoring, optimization implementation
• code-reviewer: Validate improvements, ensure quality preservation

Delegation strategy for systematic improvements:

<function_calls>
<invoke name="Task">
  <subagent_type>Explore</subagent_type>
  <description>Analyze codebase for improvement opportunities</description>
  <prompt>
    Identify improvements in: [target]
    Focus: [quality|performance|maintainability|security]
    Find: Technical debt, bottlenecks, code smells, security issues
  </prompt>
</invoke>
<invoke name="Task">
  <subagent_type>general-purpose</subagent_type>
  <description>Apply systematic improvements</description>
  <prompt>
    Apply improvements with [persona] guidance:
    - Safe refactoring
    - Best practices
    - Framework-specific optimizations (Context7)
    Mode: [--safe|--interactive]
  </prompt>
</invoke>
<invoke name="Task">
  <subagent_type>code-reviewer</subagent_type>
  <description>Validate improvements</description>
  <prompt>
    Verify improvements:
    - Functionality preserved
    - Quality enhanced
    - No regressions introduced
    - Standards compliance
  </prompt>
</invoke>
</function_calls>

When NOT to delegate (use direct tools):

• ❌ Simple style fixes (1-2 files)
• ❌ Trivial refactoring
• ❌ Quick maintainability tweaks

Tool Coordination

• Task tool: Delegates to Explore + general-purpose + code-reviewer for complex improvements
• Read/Grep/Glob: Code analysis (direct for simple, by subagent for complex)
• Edit/MultiEdit: Code modifications (direct for simple, by subagent for complex)
• TodoWrite: Progress tracking for multi-file operations

Key Patterns

• Quality Improvement: Code analysis → technical debt identification → refactoring application
• Performance Optimization: Profiling analysis → bottleneck identification → optimization implementation
• Maintainability Enhancement: Structure analysis → complexity reduction → documentation improvement
• Security Hardening: Vulnerability analysis → security pattern application → validation verification

Examples

Code Quality Enhancement

/quality:improve src/ --type quality --safe
# Systematic quality analysis with safe refactoring application
# Improves code structure, reduces technical debt, enhances readability

Performance Optimization

/quality:improve api-endpoints --type performance --interactive
# Performance persona analyzes bottlenecks and optimization opportunities
# Interactive guidance for complex performance improvement decisions

Maintainability Improvements

/quality:improve legacy-modules --type maintainability --preview
# Architect persona analyzes structure and suggests maintainability improvements
# Preview mode shows changes before application for review

Security Hardening

/quality:improve auth-service --type security --validate
# Security persona identifies vulnerabilities and applies security patterns
# Comprehensive validation ensures security improvements are effective

Boundaries

Will:

• Apply systematic improvements with domain-specific expertise and validation
• Provide comprehensive analysis with multi-persona coordination and best practices
• Execute safe refactoring with rollback capabilities and quality preservation

Will Not:

• Apply risky improvements without proper analysis and user confirmation
• Make architectural changes without understanding full system impact
• Override established coding standards or project-specific conventions