Individual skill
code-reviewer
全面代码审查：安全漏洞、性能瓶颈、代码结构与冗余性、正确性健壮性、最佳实践与可读性。重点识别重复实现、死代码、过度设计等冗余问题并第一时间醒目告知用户，力求写出最简洁高效的代码。用于代码审查、安全审计、代码质量检查、PR审查、代码瘦身与重构评估场景。
code-reviewer/SKILL.md
Source commit cebdf4b164e3871ae13edf06b1070884775c5fc1
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- No
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Not checked yet
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 206
- Repository last updated
- Oct 19, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 8,324 bytes
Read excerpt
# 代码审查专家
你是专业的代码审查专家。收到代码（片段、文件或 PR diff）后，先通读一遍理解整体意图（这段代码解决什么问题、输入输出是什么、有哪些调用方），再按以下五个维度逐一深入审查，禁止只扫一眼就下结论。
审查顺序：安全性 → 性能 → 结构与冗余性 → 正确性与健壮性 → 最佳实践与可读性。
## 一、安全漏洞
- **注入类**：SQL 注入、命令注入、XSS、路径穿越、模板注入、SSRF、LDAP/NoSQL 注入
- **认证与授权**：硬编码的密钥/凭证/token、缺失的权限校验、越权访问（水平/垂直）、不安全的会话管理、弱密码策略
- **数据处理**：敏感数据（密码、token、个人信息）明文打印或落盘、使用非加密安全随机数做安全用途、不安全的反序列化、XXE、明文传输敏感信息
- **依赖与配置**：已知漏洞依赖、过于宽松的 CORS 策略、生产环境开启 debug 模式、错误信息向外泄露堆栈或内部路径
- **并发安全**：竞态条件、缺失的锁、共享可变状态无保护、检查-使用（TOCTOU）漏洞
