---
name: review-code
description: Expert code review covering security (OWASP), architecture, clean code (SOLID), performance, and SmartStack conventions via MCP. Use for PR reviews, security audits, and code quality checks.
model: sonnet
---

## Files to review (auto-injected)
- Preflight: !`if [ -f .git ] && grep -q '^gitdir: [A-Za-z]:' .git 2>/dev/null && grep -qi microsoft /proc/version 2>/dev/null; then p=$(sed 's/^gitdir: //' .git | tr -d '\r\n'); d=$(echo "${p:0:1}" | tr A-Z a-z); r="${p:2}"; r="${r//\\//}"; printf 'gitdir: %s\n' "$(realpath -m --relative-to="$(pwd)" "/mnt/$d$r")" > .git && echo "repaired"; else echo "ok"; fi`
- Changed files: !`git diff --name-only HEAD~1 2>/dev/null || git diff --name-only --staged 2>/dev/null || echo "no changes detected"`
- Diff stats: !`git diff --stat HEAD~1 2>/dev/null || git diff --stat --staged 2>/dev/null || echo "no stats"`
- SmartStack detected: !`test -f "*.sln" && grep -l "SmartStack" *.sln 2>/dev/null && echo "YES" || echo "NO"`

<objective>
Provide expert-level code review guidance that focuses on high-impact issues: security vulnerabilities, logic errors, maintainability problems, and architectural concerns. Skip nitpicks and style issues that should be automated.

Based on research from Google, Microsoft, OWASP, and academic studies on code review effectiveness.

**For SmartStack projects**: Automatically validates SmartStack-specific conventions via MCP.
See [steps/step-01-smartstack.md](steps/step-01-smartstack.md) for full MCP integration workflow.
</objective>

<quick_start>

**Priority order**: Security > Correctness > Maintainability > Performance

**High-value feedback** (36-43% implementation rate):
- Bug fixes and logic errors
- Security vulnerabilities
- Readability/maintainability issues
- Missing error handling

**Skip these** (automate instead):
- Formatting/whitespace
- Simple naming conventions
- Linting violations

**Essential checks:**
1. **Security**: Input validation, auth checks, secrets exposure
2. **Logic**: Edge cases, error handling, null checks
3. **Architecture**: Single responsibility, proper abstractions
4. **Tests**: Coverage for new functionality

See [steps/step-02-detailed-review.md](steps/step-02-detailed-review.md) for full review categories, metrics, and anti-patterns.
</quick_start>

<feedback_guidelines>

**Structure**: What + Why + How

Good:
- "This function is 80 lines with 5 responsibilities. Consider extracting the validation logic (lines 20-45) into `validateUserInput()` for testability."
- "SQL query uses string concatenation (line 34). Use parameterized queries to prevent injection: `db.query('SELECT * FROM users WHERE id = ?', [userId])`"
- "Missing null check on `user.profile` (line 52). This will throw if user hasn't completed onboarding. Add: `if (!user.profile) return defaultProfile;`"

Bad:
- "This could be cleaner" (vague)
- "Rename this variable" (nitpick - use linter)
- "I would do this differently" (subjective without reason)

**Priority labels:**
- **[BLOCKING]**: Must fix before merge (security, bugs)
- **[SUGGESTION]**: Would improve code but not required
- **[NIT]**: Minor preference (mark clearly or skip entirely)

See [references/feedback-patterns.md](references/feedback-patterns.md) for communication strategies.
</feedback_guidelines>

<react_nextjs>
**When reviewing a React or Next.js project**, launch an additional parallel code-reviewer agent.
See [steps/step-03-react.md](steps/step-03-react.md) for detection and agent configuration.
</react_nextjs>

<success_criteria>
A good code review:
- Identifies security vulnerabilities (if any)
- Catches logic errors and edge cases
- Flags maintainability issues with specific fixes
- Uses priority labels ([BLOCKING] vs [SUGGESTION])
- Provides actionable feedback (What + Why + How)
- Avoids nitpicks on style/formatting
- Completes in reasonable time (<4 hours for small PRs)
- **[React/Next.js]** Includes Vercel best practices review when applicable
- **[SmartStack]** Runs MCP validation and integrates results into review output
</success_criteria>

<reference_guides>
For detailed guidance and patterns:

- **`references/security-checklist.md`** - OWASP Top 10, authentication patterns, input validation, rate limiting, security headers
- **`references/owasp-api-top10.md`** - OWASP API Security Top 10: BOLA, mass assignment, SSRF, resource consumption, SmartStack-specific detection patterns
- **`references/clean-code-principles.md`** - SOLID principles, naming conventions, function design, code smell detection
- **`references/feedback-patterns.md`** - Valuable vs wasteful feedback patterns, communication strategies, priority labeling
- **`references/code-quality-metrics.md`** - Complexity calculations, maintainability index, measurement techniques
- **`references/smartstack-conventions.md`** - SmartStack-specific conventions, MCP integration, multi-tenant patterns
</reference_guides>
