Backend PR Safety Review
Reviews a backend PR for outage and data-loss risks: migrations, transactions, idempotency, API breaks, authZ. Returns a merge verdict.
Before & after
Same prompt, same agent — the only difference is the skill.
Backend code review is important for reliability and maintainability. You'd want to look at things like error handling, logging, and how the API endpoints are structured. Security is important too—authentication, authorization, input validation. Performance can matter depending on the scale. Documentation and comments help other developers understand the code. Testing coverage is good to check. There are a lot of things to consider when reviewing backend code, and having a structured approach helps you not miss anything important.
I'll perform a structured backend review using a repeatable workflow to assess API reliability, security, and supportability. REVIEW CATEGORIES ERROR HANDLING: Do all endpoints catch exceptions? Do errors return meaningful status codes and messages that support can relay to customers? Are connection timeouts and retry logic present? LOGGING & OBSERVABILITY: Does every endpoint log request/response? Are errors logged with context (user ID, request ID, params)? Can support trace a customer issue backward through logs? API CONTRACTS: Are request/response schemas documented? Do endpoints validate input (type, length, required fields)? Does API versioning exist? SECURITY AUDIT: Authentication on every protected route? Rate limiting on public endpoints? SQL injection risk in queries? Credential management (no hardcoded secrets)? DATA LAYER: N+1 query problems? Inefficient queries? Are there database indexes on frequently-queried fields? CODE STRUCTURE: Repeated logic that should be extracted? Single responsibility principle followed? Dependency injection or tightly coupled? TESTING: Unit test coverage for critical paths? Integration tests for API flows? Do tests cover happy path and error cases? DELIVERABLE A structured report with: findings grouped by severity (Critical/Major/Minor/Nit), specific code locations cited, actionable fixes, and a score (e.g. "78/100, support-ready after addressing 3 major items").
About this skill
Catch the backend changes that cause 2 a.m. incidents before they merge. This review focuses only on what can break production: data, contracts, retries, concurrency, and access control.
What it does
- Maps the blast radius: endpoints, tables and sizes, queues, and consumers
- Checks migrations for locks, table rewrites, and unsafe expand/contract ordering
- Checks transactions, idempotency, retries, timeouts, and outbox patterns
- Detects breaking API changes and missing object-level authorization
- Classifies findings as Blocker, Must fix, Should fix, or Question
What you get
A review with a merge verdict, blast radius summary, file:line findings with failure scenarios and fixes, deploy and rollback notes, and tests to add.
Best for
Backend teams merging schema changes, payment or webhook handlers, or public API changes, especially on large tables or with mobile clients in the wild.
SKILL.md preview
---
name: backend-pr-safety-review
description: Review a backend pull request for the failures that cause outages and data loss - unsafe migrations, missing transactions, non-idempotent handlers, breaking API contract changes, swallowed errors, race conditions, and missing authorization - and return a merge verdict with line-referenced findings. Use when the user says "review this backend PR", "is this migration safe?", "check this API change before merge", or shares a diff touching services, database schema, queues, or endpoints. Also triggers on "can you take a quick look at this migration?", "anything wrong with this diff?", or "is this safe to merge?".
---
# Backend PR Safety Review
… (sign up to view the full skill)More development skills
View all Development skills →Production Go: Concurrency, Services & Profiling
Production Go code with leak-free goroutines, context-correct services, wrapped errors, and pprof-driven performance fixes.
Backend Feature Build Plan
Builds one backend feature through gates: confirmed requirements, one-screen design, small tested slices, and a deploy/rollback handoff.
Consistent, Safe Application Logging
Adds structured, correlated logs with useful severity, safe fields, bounded volume, and targeted verification.
Reliable WebSocket Messaging and Scaling
Build WebSocket and Socket.IO systems with authorized rooms, reconnect recovery, bounded queues, and multi-node presence.