Prioritized Code Review: Bugs, Security, Performance
Reviews diffs or files and returns ranked findings: real bugs, security holes, N+1 queries, each with evidence and a concrete fix.
Before & after
Same prompt, same agent — the only difference is the skill.
I can review the code for you and provide feedback on potential issues. I'll look for common problems like bugs, security vulnerabilities, performance issues, and code quality concerns. It might help to know what the code is supposed to do and what changes are being made. There could be SQL injection risks, improper error handling, or other security problems, but I'll need to see the actual code to identify specific issues. I might also suggest refactoring opportunities or naming improvements. Would you like me to look at the diff first, or would you prefer to share the full file context? I'd recommend checking the test coverage as well.
CODE REVIEW REPORT
FILE: db-query-service.ts (Lines 42-67)
PRIORITY 1: SQL INJECTION RISK
Location: Line 54, buildQuery() concatenates user input
Issue: "SELECT * FROM users WHERE id = " + userId (unsanitized)
OWASP: A03:2021 — Injection
Fix: Use parameterized queries: db.query("SELECT * FROM users WHERE id = ?", userIdParam)
Severity: Critical
PRIORITY 2: N+1 QUERY PATTERN
Location: Lines 59-63, loop fetches user for each row
Issue: for (const row of results) loop fetches separate query per row
Performance: 100 users = 101 queries (1 initial + 100 in loop)
Fix: batch eager-load users in single query before loop
Estimated impact: 50-100ms saved per request
PRIORITY 3: MISSING ERROR BOUNDARY
Location: catch block (line 65) swallows errors silently
Issue: console.log(error) with no alerting, no retry logic
Fix: Throw structured error with context; log to monitoring
PRIORITY 4: NAME SMELL
Location: Variable "x" (line 45)
Fix: Rename to "userPermissions"
TEST COVERAGE: 60% for this file (aim for 80%+)About this skill
Most AI code reviews read like a linter with opinions. You get twenty bullets where a SQL injection sits next to "consider a more descriptive variable name," half the issues are guesses about code the reviewer never saw, and the one bug that will page you at 2 a.m. is missing. This skill reviews code the way a strong senior engineer does: it hunts for defects that will actually fire, proves each one with a concrete trigger, and ranks them so you know what blocks the merge.
What it does
- Works through a fixed hunt order: boundaries and null paths, error handling, concurrency, trust boundaries (injection, XSS, unsafe deserialization, missing authorization), resource use, money and time handling, and API or migration compatibility
- Requires every finding to name a location, a triggering input, a consequence, and a minimal fix patch. Anything it cannot prove becomes a labeled question, not a false alarm
- Ranks findings into Blocker, High, Medium, and Nit using a stated rubric. Style nits are capped and grouped so they never crowd out real bugs
- Catches N+1 queries and names the eager-loading fix for your ORM
- Flags deploy hazards that diffs hide: changed signatures with unseen callers, migrations that lock tables, and renamed fields that break running clients
- Checks whether the tests would actually fail if the bug came back, not just whether tests exist
What you get
A review headed by a merge verdict, followed by ranked findings with code-level fixes. Each finding is marked Confirmed, Likely, or Question. The review closes with what was out of scope or could not be seen.
Best for
Developers reviewing teammates' PRs or their own changes before merge, solo builders who have no second reviewer, and teams auditing a module before refactoring it.
SKILL.md preview
---
name: prioritized-code-review
description: Reviews code diffs, files, or modules for real defects (correctness bugs, security holes, N+1 queries, concurrency and deploy hazards) using a fixed hunt order. Each finding is backed by a concrete trigger and a minimal fix, ranked by severity under a merge verdict. Use when the user says "review this PR", "can you code review this diff", "is this safe to merge", "what's wrong with this function", "audit this module before I refactor it", "my endpoint gets slow with more data", "this works locally but breaks in prod", or "find bugs in this".
---
# Prioritized Code Review: Bugs, Security, Performance
… (sign up to view the full skill)More development skills
View all Development skills →Performance Bottleneck Profiling: Node, Python, Go
Classifies a slowdown, gives exact profiler commands, reads the output, and proves the fix with same-conditions p95/p99 numbers.
Feature Scaffolding with Working Tests
Turn a short feature spec into code, runnable tests, and integration wiring that match your existing project.
Feature Flag Rollouts and Kill Switches
Design staged flag rollouts, verify rollback paths, and audit flag debt with explicit defaults, gates, and retirement plans.
Microcontroller Firmware and RTOS Engineering
Build and debug MCU firmware with bounded ISR/RTOS timing, safe DMA ownership, and measured power budgets.