Install
openclaw skills install ai-code-review-expertAI-powered code review assistant �� perform deep static analysis, identify security vulnerabilities, enforce coding standards, suggest refactoring patterns, and generate PR review comments. Supports Python, JavaScript, TypeScript, Java, Go, Rust, and more. Integrates with GitHub PR workflows. Keywords: code review, static analysis, security scanning, refactoring, PR review, code quality, SAST, CodeRabbit, CodiumAI, code smell, best practices, AI code reviewer, CI/CD, �������, ��������, �����ع�, ��ȫɨ��, pull request, ��̬����, ����淶.
openclaw skills install ai-code-review-expertAutomated, opinionated, actionable �� code reviews that actually ship better software.
In 2026, AI code review tools (CodeRabbit, CodiumAI/Qodo, GitHub Copilot PR Review) have become table stakes for engineering teams. Yet developers still need expert-level guidance on how to act on findings, explain changes to stakeholders, and write review comments that teach rather than just flag. This skill:
Code review, PR review, review my code, check this code, static analysis, code smell, refactor, security scan, find bugs, SAST, pull request feedback, code quality check, �������, ������, ������, ��������, �ع�����, ��ȫ©��, review this PR, ���ҿ�������
Step 2 ��������������2026����
Ask the user for (or infer from the code):
Analyze the provided code across these dimensions:
| # | ©������ | ���ؼ���/ģʽ | ���ض� | AI������ⷽ�� |
|---|---|---|---|---|
| A01 | Ȩ����ʧЧ��Broken Access Control�� | δ��Ȩ����/IDOR/·������ | ?? Critical | ���·��/API�˵��Ƿ�ȱ��Ȩ��ע����м�� |
| A02 | ����ʧ�ܣ�Cryptographic Failure�� | Ӳ������Կ/����ϣ/���Ĵ��� | ?? Critical | ɨ���ַ�������/�������ʽƥ����Կģʽ |
| A03 | ע�빥����Injection�� | SQLƴ��/NoSQLע��/����ע�� | ?? Critical | ����ַ���ƴ�ӽ����ѯ/exec/system���� |
| A04 | ����ȫ��ƣ�Insecure Design�� | ȱ����������/����֤��/��©�� | ?? Warning | ���API�˵��Ƿ�ȱ��RateLimit/ Captcha |
| A05 | ��ȫ���ô���Security Misconfiguration�� | Ĭ��ƾ��/���Ŷ˿�/��ϸ���� | ?? Warning | ��������ļ�/��������/�쳣���� |
| A06 | ���ܹ�����ʱ�����Vulnerable Components�� | ��֪CVE/��ʱ���� | ?? Warning | �Ա�package.json/lock�ļ���NVD���ݿ� |
| A07 | ����ʶ�����֤ʧЧ��Identification and Authentication Failures�� | ���������/�Ự�̶�/��MFA | ?? Critical | �����֤�м������/�����ϣ�㷨 |
| A08 | ���������������Թ��ϣ�Software and Data Integrity Failures�� | �����ŷ����л�/CI/CD��Ⱦ | ?? Warning | ��鷴���л�����/��ˮ������ |
| A09 | ��ȫ��־�ͼ�ع��ϣ�Security Logging and Monitoring Failures�� | �������־/��־δ���� | ?? Suggestion | ���ؼ������Ƿ�����־��¼ |
| A10 | ������������α�죨Server-Side Request Forgery�� | �û����Ƶ�URL���� | ?? Warning | ���HTTP�ͻ��˵����Ƿ���֤Ŀ��URL |
Claude Code Review ר������2026����
For each finding, output a structured review comment:
?? Location: [filename:line_number] or [function_name]
??/??/?? Severity: [Critical / Warning / Suggestion]
?? Issue: [Clear description of the problem]
?? Why it matters: [Impact on security / performance / maintainability]
? Recommended fix:
[code block with the corrected implementation]
| Dimension | Score (1�C10) | Notes |
|---|---|---|
| Correctness | �� | Logic & edge case handling |
| Security | �� | OWASP, secrets, auth |
| Performance | �� | Time/space complexity, DB queries |
| Readability | �� | Naming, structure, comments |
| Testability | �� | Modular, injectable dependencies |
| Overall | �� | Weighted average |
Generate a ready-to-paste GitHub PR description:
## Code Review Summary
**Reviewed by:** AI Code Review Expert
**Date:** [today]
**Overall:** ???? (4/5 �� Minor issues found)
### Critical Issues (0)
No blocking issues found. ?
### Warnings (2)
- `user_service.py:45` �� Potential SQL injection via raw query concatenation
- `auth.py:12` �� JWT secret read from environment variable without validation
### Suggestions (3)
- Consider extracting the validation logic into a shared utility
- Add docstrings to public methods
- Use `dataclasses` instead of plain dicts for `UserProfile`
### Positive Highlights ??
- Excellent use of dependency injection in `UserController`
- Clear separation of concerns between service and repository layers
User:
def get_user(user_id):
query = "SELECT * FROM users WHERE id = " + user_id
return db.execute(query)
Skill response:
?? Critical �� SQL Injection (
get_userfunction) Issue: String concatenation in SQL queries allows attackers to inject malicious SQL. Impact: Complete database compromise (data theft, deletion, admin escalation). Fix:def get_user(user_id: int) -> dict | None: query = "SELECT * FROM users WHERE id = %s" return db.execute(query, (user_id,))
User: "Review this TypeScript React component for performance issues"
Skill response: Identifies missing useMemo/useCallback wrappers, unnecessary re-renders, missing key props in lists, and suggests a refactor to a presentational/container pattern.
Python, JavaScript, TypeScript, Java, Kotlin, Go, Rust, C/C++, C#, Ruby, PHP, Swift, SQL, Shell/Bash, Terraform/HCL, Dockerfile, YAML/JSON configs
GitHub: https://github.com/gechengling/ai-code-review-expert