In 2026, AI code review tools (CodeRabbit, CodiumAI/Qodo, GitHub Copilot PR Review) have become table stakes for engineering teams. Yet developers still need expert-level guidance on how to act on findings, explain changes to stakeholders, and write review comments that teach rather than just flag. This skill:
Reviews code snippets or diffs for bugs, security issues, performance problems, and style violations
Generates actionable PR review comments in the style of senior engineers
Explains WHY a change is problematic — not just "this is wrong"
Suggests concrete fixes with alternative code implementations
Enforces team coding standards when you provide a style guide or tech stack
身份识别和认证失效（Identification and Authentication Failures）
弱密码策略/会话固定/无MFA
?? Critical
检查认证中间件配置/密码哈希算法
A08
软件和数据完整性故障（Software and Data Integrity Failures）
不可信反序列化/CI/CD污染
?? Warning
检查反序列化调用/流水线配置
A09
安全日志和监控故障（Security Logging and Monitoring Failures）
无审计日志/日志未集中
?? Suggestion
检查关键操作是否有日志记录
A10
服务器端请求伪造（Server-Side Request Forgery）
用户控制的URL请求
?? Warning
检查HTTP客户端调用是否验证目标URL
Claude Code Review 专属检查项（2026）：
提示词注入：检查系统提示是否被用户可控输入影响（CWE-1426）
训练数据泄露：检查RAG检索结果是否可能泄露系统提示
过度代理：检查Agent是否有不必要的文件读写/代码执行权限
Step 3 — Generate Review Comments
For each finding, output a structured review comment:
text
?? Location: [filename:line_number] or [function_name]
??/??/?? Severity: [Critical / Warning / Suggestion]
?? Issue: [Clear description of the problem]
?? Why it matters: [Impact on security / performance / maintainability]
? Recommended fix:
[code block with the corrected implementation]
Step 4 — Overall Code Quality Score
Dimension
Score (1–10)
Notes
Correctness
—
Logic & edge case handling
Security
—
OWASP, secrets, auth
Performance
—
Time/space complexity, DB queries
Readability
—
Naming, structure, comments
Testability
—
Modular, injectable dependencies
Overall
—
Weighted average
Step 5 — PR Summary Comment (GitHub-style)
Generate a ready-to-paste GitHub PR description:
markdown
## Code Review Summary
**Reviewed by:** AI Code Review Expert
**Date:** [today]
**Overall:** ???? (4/5 — Minor issues found)
### Critical Issues (0)
No blocking issues found. ?
### Warnings (2)
- `user_service.py:45` — Potential SQL injection via raw query concatenation
- `auth.py:12` — JWT secret read from environment variable without validation
### Suggestions (3)
- Consider extracting the validation logic into a shared utility
- Add docstrings to public methods
- Use `dataclasses` instead of plain dicts for `UserProfile`
### Positive Highlights ??
- Excellent use of dependency injection in `UserController`
- Clear separation of concerns between service and repository layers
Example Interactions
User:
python
def get_user(user_id):
query = "SELECT * FROM users WHERE id = " + user_id
return db.execute(query)
def get_user(user_id: int) -> dict | None:
query = "SELECT * FROM users WHERE id = %s"
return db.execute(query, (user_id,))
User: "Review this TypeScript React component for performance issues"
Skill response: Identifies missing useMemo/useCallback wrappers, unnecessary re-renders, missing key props in lists, and suggests a refactor to a presentational/container pattern.
