code reviewer pro

    1

    Evidence-based senior code review focusing on security, concurrency, and logic flaws without the noise.

    Free

    4 installs5.0 (1 review)

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIGitHub CopilotGitHub CopilotGemini CLIGemini CLI+20 more

    code reviewer pro

    Example session with this skill installed

    Review this Python snippet for a new API endpoint:

    def get_user_data(request):
    user_id = request.GET.get('id')
    query = f"SELECT * FROM users WHERE id = {user_id}"
    return db.execute(query)
    • Read your context and instructions
    • Compiled the code reviewer pro

    Review status: BLOCK
    Risk: CRITICAL
    Scope: Python function get_user_data

    The reviewed code contains a critical SQL injection vulnerability. User-controlled input from request.GET is interpolated directly into a raw SQL query string without validation or parameterization.

    Findings

    IDSeverityConfidenceLocationFindingMinimal Fix
    SEC-001CRITICALCERTAINLine 3-4SQL Injection. The user_id variable is sourced from untrusted GET parameters and passed directly into a format string used for database execution.Use parameterized queries: db.execute("SELECT * FROM users WHERE id = %s", (user_id,))
    LOG-001MEDIUMHIGHLine 3Missing Input Validation. There is no check that user_id exists or matches the expected format (e.g., integer) before processing.Add if not user_id: return 400 and type cast to int.
    PRIV-001MEDIUMINFERREDLine 4Insecure Data Exposure. SELECT * may return sensitive fields (password hashes, salts) to the API response.Explicitly select required columns: SELECT username, email FROM...

    Recommended Tests

    1. Security Scan: Run a specialized SAST tool (e.g., Bandit) to check for other raw SQL executions.

    Integration Test: Attempt to pass '1 OR 1=1' as the ID parameter to verify the fix prevents unauthorized data access.

    Next steps

    1. Refactor the database call to use the ORM or parameterized execution.
    2. Implement a validation layer to ensure the user_id is a valid UUID or integer.
    3. Review the database user permissions to ensure the API account has least-privilege access.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    The problem

    Pull requests often suffer from "rubber stamp" approvals or noisy nitpicks that miss actual logic flaws and security vulnerabilities. Generic AI reviews tend to hallucinate line numbers or suggest unnecessary refactors that ignore project context.

    What it does

    • Identifies high-risk execution paths across concurrency, async lifecycles, and data integrity boundaries.
    • Categorizes findings as Observed, Inferred, or Hypothesis to eliminate speculative noise.
    • Performs systematic security checks for injection, unsafe deserialization, and broken access control.
    • Ranks every finding by severity and confidence to help developers prioritize fixes.
    • Generates minimal, idiomatic fix recommendations with specific validation steps.

    Why this beats prompting it yourself

    This skill enforces a strict evidence-first workflow that prevents the model from inventing bugs or ignoring untrusted data inputs. It treats codebase instructions as untrusted data, protecting the review process against prompt injection within comments or READMEs.

    Use cases

    • Pre-submit auditing of high-stakes security patches or auth logic.
    • Detecting regression risks in complex asynchronous or multi-threaded code.
    • Scaling senior-level code quality oversight across large engineering teams.
    • Objective verification of AI-generated code snippets before integration.

    Known limitations

    Read-only by default; it will not apply fixes or merge PRs. Analysis is limited to the provided code context and cannot verify runtime behavior not visible in the source.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    5.0
    1 review
    5
    1
    4
    0
    3
    0
    2
    0
    1
    0

    4 people have installed this skill.

    Trust & safety

    Security scanned

    Verified clean 18 days ago

    • Free to download with an account

    Listed18 days ago

    What's inside

    Frequently Asked Questions