---
name: review
description: Multi-category code review — security, architecture, performance
group: E
allowed-tools: [Read, Glob, Grep]
---

# Skill: Code Review

> Multi-category code review guide.

## 9 Review Categories

### 1. Security (OWASP Top 10)
- No hardcoded secrets (CWE-798)
- No SQL injection (CWE-89)
- Tenant isolation (CWE-639)
- Authorization on each controller (CWE-862)

### 2. Architecture (Clean Architecture)
- Controller → Service → Repository (no layer skipping)
- DTOs only at boundaries

### 3. Hardcoded Values
- No connection strings, URLs, credentials in code

### 4. Test Coverage
- Each branch has a test
- Naming: `{Method}_When{Condition}_Should{Result}`

### 5. Performance
- No N+1 queries
- `AsNoTracking()` for read-only queries
- `CancellationToken` propagated everywhere

### 6. Dead Code
- No unused private methods

### 7. Quality Metrics
- Cognitive complexity < 15, cyclomatic < 10
- Function size < 50 lines, nesting < 3

### 8. i18n
- No hardcoded UI strings

### 9. Accessibility
- Labels, alt text, keyboard navigation

## Severities

| Level | Meaning |
|-------|---------|
| blocking | Must be fixed before merge |
| critical | Immediate correction recommended |
| warning | Best practice |
| info | Suggestion |