Purpose / Development

Code Review Excellence Skill Security Audit

What the author says it does (original text)

Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.

Independent security check

No obvious risks found in this check

Files checked: 1
Risks found: 0

Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found

Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found

Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found

Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found

Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found

Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

8 instruction sections

This Skill is a code-review methodology guide for reviewing changes, establishing team standards, and mentoring developers; its stated goals include finding bugs, improving maintainability, sharing knowledge, and enforcing coding standards.

View source

SKILL.md:12In the instructionsOpen original file

1112- Reviewing pull requests and code changes13- Establishing code review standards for teams14- Mentoring junior developers through reviews15- Conducting architecture reviews16- Creating review checklists and guidelines17- Improving team collaboration

SKILL.md:27In the instructionsOpen original file

2627- Catch bugs and edge cases28- Ensure code maintainability29- Share knowledge across team30- Enforce coding standards31- Improve design and architecture32- Build team culture

Its workflow calls for reading the PR description, linked issue, CI status, and business requirement, followed by architecture, testing, line-level logic, security, performance, and maintainability checks, then an approve, comment, or request-changes decision.

View source

SKILL.md:92In the instructionsOpen original file

91921. Read PR description and linked issue932. Check PR size (>400 lines? Ask to split)943. Review CI/CD status (tests passing?)954. Understand the business requirement965. Note any relevant architectural decisions97```

SKILL.md:124In the instructionsOpen original file

1231241. **Logic & Correctness**125   - Edge cases handled?126   - Off-by-one errors?127   - Null/undefined checks?128   - Race conditions?1291302. **Security**131   - Input validation?132   - SQL injection risks?133   - XSS vulnerabilities?134   - Sensitive data exposure?1351363. **Performance**137   - N+1 queries?138   - Unnecessary loops?139   - Memory leaks?140   - Blocking operations?141

SKILL.md:152In the instructionsOpen original file

151```markdown1521. Summarize key concerns1532. Highlight what you liked1543. Make clear decision:155   - ✅ Approve156   - 💬 Comment (minor suggestions)157   - 🔄 Request Changes (must address)1584. Offer to pair if complex159```

The Skill provides a security-review checklist covering authentication and authorization, secret protection, input and upload restrictions, SQL injection, XSS, sensitive-data protection, dynamic execution, CSRF, and rate limiting.

View source

SKILL.md:399In the instructionsOpen original file

398399### Authentication & Authorization400401- [ ] Is authentication required where needed?402- [ ] Are authorization checks before every action?403- [ ] Is JWT validation proper (signature, expiry)?404- [ ] Are API keys/secrets properly secured?405406### Input Validation407408- [ ] All user inputs validated?409- [ ] File uploads restricted (size, type)?410- [ ] SQL queries parameterized?411- [ ] XSS protection (escape output)?412413### Data Protection414415- [ ] Passwords hashed (bcrypt/argon2)?416- [ ] Sensitive data encrypted at rest?417- [ ] HTTPS enforced for sensitive data?418- [ ] PII handled according to regulations?419420### Common Vulnerabilities421422- [ ] No eval() or similar dynamic execution?423- [ ] No hardcoded secrets?424- [ ] CSRF protection for state-changing operations?425- [ ] Rate limiting on public endpoints?426```

The supplied content consists of guidance, checklists, a review-comment template, and examples explicitly marked as good or bad; the visible source contains no installation steps, command-execution instructions, credential requests, data-upload directions, or implementation that automatically changes files.

View source

SKILL.md:501In the instructionsOpen original file

500501```markdown502## Summary503504[Brief overview of what was reviewed]505506## Strengths507508- [What was done well]509- [Good patterns or approaches]510511## Required Changes512513🔴 [Blocking issue 1]514🔴 [Blocking issue 2]515516## Suggestions517518💡 [Improvement 1]519💡 [Improvement 2]520521## Questions522523❓ [Clarification needed on X]524❓ [Alternative approach consideration]525526## Verdict527528✅ Approve after addressing required changes529```

Start here · InstructionsSKILL.md

code-review-excellence

Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source. 2 more sections are available in the original file.

Files and check records1 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

SKILL.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

SKILL.mdInstructions

Operations mentioned in code and instructions

Connect to websites

SKILL.md:310In the instructionsOpen original file

309async function fetchUser(id: string) {310    const response = await fetch(`/api/users/${id}`);311    return response.json();  // What if network fails?

SKILL.md:317In the instructionsOpen original file

316    try {317        const response = await fetch(`/api/users/${id}`);318        if (!response.ok) {

Lines read: 530
File checksum (to compare versions): 5ddb61d462e19129db555ace045777234b1467f851c5bee21a26ec45b6386983

Related skill security audits

Compare the source, risk signals and checked scope in these related reports.

Skill / source	What we found	Last checked
code-simplification github.com/addyosmani/agent-skills/tree/…/skills/code-simplification	Security risks found	07 Sept 202614:13 UTC+8
code-review-and-quality github.com/addyosmani/agent-skills/tree/…/skills/code-review-and-quality	No obvious risks found in this check	07 Sept 202613:50 UTC+8
codex-pet github.com/prime-skills/runcomfy-agent-skills/tree/…/codex-pet	Do not install or run it yet	07 Sept 202612:22 UTC+8
code-review github.com/mattpocock/skills/tree/…/skills/engineering/code-review	Do not install or run it yet	07 Sept 202612:08 UTC+8
codebase-design github.com/mattpocock/skills/tree/…/skills/engineering/codebase-design	Security risks found	07 Sept 202612:08 UTC+8