Stats
Actions
Tags
From solo-sdlc
Multi-perspective code review (correctness, security, performance, maintainability) on implemented changes. Use this skill AFTER verification passes and BEFORE the work is shipped. Triggers when implementation is complete, before merging, or when user asks for review. Outputs severity-tagged findings with concrete fixes, not generic advice.
How this skill is triggered — by the user, by Claude, or both
Slash command
/solo-sdlc:code-reviewThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
After `verify` passed. Before `commit-push-pr`. Or whenever user asks for a review.
After verify passed. Before commit-push-pr. Or whenever user asks for a review.
git diff --name-only HEAD~1
git diff HEAD~1
Or if working in a worktree, diff against the base branch:
git diff main..HEAD
Review through FOUR independent lenses. Spawn sub-agents in parallel if available, otherwise do them serially.
Look for:
Look for:
npm audit, pip-audit, govulncheck)Look for:
Look for:
processUser that doesn't process)Each finding gets a severity:
## Code Review - <Feature>
**Reviewed:** <files / line ranges>
**Reviewer:** Claude (multi-perspective)
**Date:** <today>
### 🔴 Critical (must fix)
**1. SQL injection in `pkg/users/repo.go:84`**
```go
query := fmt.Sprintf("SELECT * FROM users WHERE id = '%s'", userID)
Use parameterized query: db.Query("SELECT * FROM users WHERE id = $1", userID). The userID comes from the request body unsanitized.
2. Missing auth check on DELETE /api/posts/:id
Handler at internal/handlers/post.go:142 deletes without checking ownership. Any authenticated user can delete any post.
1. N+1 in dashboard.go:55
The loop fetches Author per post separately. 50 posts = 51 queries. Use .Preload("Author") (Django ORM) or join in raw query. Expected savings: ~250ms on a 50-post page.
2. ...
1. Function validateAndSaveOrder is 87 lines, 4 responsibilities. Split into validate, enrich, persist, emitEvents. Each is independently testable.
1. userId vs userID casing inconsistent across the file. Pick one, apply everywhere. Linter rule: revive with var-naming.
Verdict: ❌ NOT READY TO MERGE. Critical issues must be addressed first.
### Step 5: If critical issues - go fix
DO NOT MERGE. Fix the criticals. Re-run `verify`. Re-run `code-review`. Repeat until clean.
### Step 6: For agreed fixes - apply them
If the user accepts the recommendations, apply them in the same PR. If they should be deferred, create a follow-up issue and link it in the PR description.
### Step 7: Hand off
When clean (or only Lows remain), trigger `commit-push-pr` command.
## Specific Stack Rules
### Python
- Type hints expected, `mypy` clean
- Dataclasses or Pydantic for structured data
- No bare `except:` or `except Exception:` without re-raise
- No mutable default args
- `with` for resource management
- Use `pathlib`, not `os.path`
### Go
- `errors.Is` / `errors.As` for error checking
- Wrap errors with `fmt.Errorf("doing thing: %w", err)`
- No `interface{}` without justification (use `any` if needed)
- Channels for communication, mutexes for state
- Context propagation for cancellation
- Goroutines have a clear lifetime
### Django
- ORM by default, raw SQL only with justification
- Use `select_related` / `prefetch_related` for N+1
- `transaction.atomic` around multi-statement writes
- Form/Serializer validation, not manual
- No business logic in views - keep them thin
- Settings split per environment
### React/Vue
- No state in components that should be in store
- Memoize expensive renders
- Keys on list items
- Avoid prop drilling beyond 2-3 levels
- Side effects in `useEffect` / `onMounted`, not in render
- Loading/error/empty states for every async UI
- Cleanup in effects (event listeners, timers, subscriptions)
## Recommendations
After review, output broader recommendations:
- Patterns repeated 3+ times that should become shared utilities
- Areas of the codebase that are getting tangled (refactor candidates)
- Tests that don't exist but should
- Tooling that would catch this class of issue automatically next time
npx claudepluginhub shakhovskiya-create/shakhoff-claude-marketplace --plugin solo-sdlcProvides behavioral guidelines to reduce common LLM coding mistakes, focusing on simplicity, surgical changes, assumption surfacing, and verifiable success criteria.
Searches, retrieves, and installs Agent Skills from prompts.chat registry using MCP tools like search_skills and get_skill. Activates for finding skills, browsing catalogs, or extending Claude.