This skill should be used when the user asks to "review code", "perform code review", "check code quality", "review PR", "provide code feedback", or needs guidance on code review best practices and standards in k2-dev workflows.
Reviews code against security, logic, and quality standards using a four-pass method.
/plugin marketplace add ivankristianto/k2-dev/plugin install k2-dev@k2-dev-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
Code review is a critical quality control process that catches bugs, ensures standards compliance, and facilitates knowledge sharing.
Review Objectives: Ensure code quality and maintainability, catch bugs and logic errors, validate security practices, enforce project standards, share knowledge.
Pass 1: High-Level Understanding
Pass 2: Line-by-Line Detailed Review
Pass 3: Standards Validation
Pass 4: Architectural Assessment
Readability:
Structure:
Error Handling:
Functionality:
Data Handling:
OWASP Top 10 Check:
Input Validation:
Authentication & Authorization:
Data Protection:
Efficiency:
Resource Usage:
Coverage:
Test Quality:
Code Documentation:
External Documentation:
AGENTS.md Compliance:
CLAUDE.md Compliance:
constitution.md Compliance:
Standard format:
**[Severity]** [Category]: [Issue]
[Explanation]
[Suggestion]
[Example or reference]
Severity levels:
Reference: See k2-dev-reference.md#review-severity-levels
P0 - Security Issue:
**P0** Security: SQL Injection Vulnerability
The search query is directly concatenated into the SQL statement, allowing injection attacks.
\```typescript
// Current (vulnerable)
const query = `SELECT * FROM users WHERE name = '${searchTerm}'`;
// Fix: Use parameterized queries
const query = 'SELECT * FROM users WHERE name = ?';
const results = await db.query(query, [searchTerm]);
\```
Reference: OWASP SQL Injection Prevention Cheat Sheet
P1 - Logic Error:
**P1** Logic: Off-by-One Error in Pagination
The pagination logic will skip the last item on each page due to incorrect boundary condition.
\```typescript
// Current (incorrect)
const end = start + pageSize; // Should be exclusive
// Fix
const end = Math.min(start + pageSize, totalItems);
\```
Add test case TC-045 to catch this.
DO: ✅ Be specific and objective ✅ Explain the reasoning ✅ Provide examples and references ✅ Suggest solutions, not just problems ✅ Distinguish between must-fix and nice-to-have ✅ Acknowledge good practices ✅ Ask questions if unclear
DON'T: ❌ Be vague ("this looks wrong") ❌ Be condescending or dismissive ❌ Focus only on negatives ❌ Nitpick style in isolation ❌ Demand specific implementations ❌ Leave feedback without explanation
Reviewer:
Engineer:
Reviewer:
Engineer:
If issues remain after 2 iterations:
Create follow-up tickets:
# Critical issues
bd create "Fix authentication bypass vulnerability" \
-d "Critical issue from PR #456 review. Details: [...]" \
-p P0
# Important issues
bd create "Refactor validation logic" \
-d "Code quality issue from PR #456. Details: [...]" \
-p P1
Document in PR:
## Outstanding Issues
After 2 review iterations, the following issues remain:
### Created Follow-Up Tickets
- **P0:** beads-789 - Fix authentication bypass (blocking next release)
- **P1:** beads-790 - Refactor validation logic
### Decision
Merging this PR to maintain forward progress. Critical issues tracked in P0 ticket and will be addressed immediately.
Reference: See k2-dev-reference.md#beads-cli-commands for beads task creation.
bd show beads-123
bd comments beads-123
cat AGENTS.md CLAUDE.md constitution.md
gh pr view 456 --web
gh pr diff 456
Review complete for beads-123 (PR #456):
- P0 issues: 1 (security)
- P1 issues: 2 (logic errors)
- P2 issues: 3 (style)
- Requesting changes
Reference: See k2-dev-reference.md#github-cli-gh-commands for gh pr commands.
✅ Review within 24 hours of PR creation ✅ Block time for focused review ✅ Review all changed files (including tests and docs) ✅ Consider broader impact ✅ Be constructive and helpful
❌ Rush through review or review when tired ❌ Only review main files (skip tests/docs) ❌ Be dismissive or condescending ❌ Make personal attacks ❌ Ignore engineer's responses
## Review Started
Beginning review of PR #456 for beads-123.
Will be checking:
✓ Code quality and logic
✓ Security vulnerabilities
✓ Standards compliance (AGENTS.md, CLAUDE.md, constitution.md)
✓ Test coverage
✓ Documentation
Feedback coming soon.
## ✅ Approved
Great work on this implementation! All quality gates pass.
### Highlights
- Excellent test coverage (95%)
- Clean, maintainable code
- Good security practices
- Clear documentation
### Standards Validation
✅ AGENTS.md quality gates pass
✅ CLAUDE.md patterns followed
✅ constitution.md principles upheld
Ready to merge!
## 🔄 Changes Requested
Found some issues that need addressing before merge. Overall approach is solid!
### Must Fix (P0/P1)
1. [P0] SQL injection vulnerability (line 123)
2. [P1] Logic error in pagination (line 234)
### Should Consider (P2)
3. Inconsistent error handling (throughout)
### Suggestions
- Consider extracting validation logic to utility
Please address P0/P1 issues and push updates. Let me know if you have questions!
Follow these code review standards to maintain high code quality and catch issues early in k2-dev development workflows.
Reference: See k2-dev-reference.md for priority levels, common patterns, and gh commands.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.