Code Review

---
name: code-review
description: |
  Trigger when the user asks for a code review, PR review, or quality check.
  Phrases: "review", "code review", "check this code", "PR review",
  "review my changes".
allowed-tools:
  - Bash(git diff *)
  - Bash(git log *)
  - Read
  - Grep
  - Glob
---

# Code Review

Multi-agent code review that checks 5 dimensions with confidence-based
scoring to filter false positives.

## Prerequisites

- Git repository with changes to review
- Diff available via `git diff` or `git diff --staged`

## Steps

1. **Gather the diff:**
   ```bash
   git diff --staged --stat
   git diff --staged
   ```
   If no staged changes, use `git diff HEAD~1` or the appropriate range.

2. **Run 5 review passes** (mentally or in parallel):

   **Pass 1 - Correctness:** Logic errors, off-by-one, null derefs, race
   conditions. Only flag issues with HIGH confidence.

   **Pass 2 - Security:** SQL injection, XSS, command injection, hardcoded
   secrets, unsafe deserialization. Check OWASP Top 10.

   **Pass 3 - Performance:** N+1 queries, unnecessary re-renders, missing
   indexes, unbounded loops, memory leaks.

   **Pass 4 - Maintainability:** Dead code, duplicated logic, unclear naming,
   missing types, functions that are too long (>50 lines).

   **Pass 5 - Test coverage:** Are new code paths tested? Are edge cases
   covered? Do tests actually assert behavior?

3. **Score each finding:**
   - CRITICAL: Will cause bugs or security issues in production
   - WARNING: Should be fixed but won't break anything
   - SUGGESTION: Nice to have, style preference

4. **Output format:**
   ```
   ## Code Review Summary

   **Files reviewed:** N
   **Findings:** X critical, Y warnings, Z suggestions

   ### Critical
   - [file:line] Description of issue

   ### Warnings
   - [file:line] Description of issue

   ### Suggestions
   - [file:line] Description of suggestion
   ```

5. Only report findings with HIGH confidence. If unsure, skip it.