Code Review Skill Purpose: Enforce automated code reviews as a mandatory guardrail before every commit and deployment. Choose between Claude, OpenAI Codex, Google Gemini, or multiple engines for comprehensive analysis. Sub skills: [adr gate.md](./adr gate.md) — Pre review ADR and spec enforcement Pre Review: ADR Gate (Mandatory) Before any review engine runs, the ADR gate executes automatically: 1. Classify — trivial changes (typos, deps, tests only) skip the gate 2. Discover — scan docs/adr/ , project specs/ , iCPG ReasonNodes, git history for linked ADRs and specs 3. Enforce — if no ADRs found for non trivial changes: Interactive (default): draft ADR from git history, ask user to confirm Unattended (CI): write as Status: proposed , proceed Strict : block review until ADR exists 4. Inject — feed discovered ADRs + specs into the review prompt as architectural context ADR Compliance Review Dimension Added to the standard 7 review categories: Category What It Checks ADR Compliance Change conforms to documented decisions, no undocumented architectural shifts Finding Severity Change contradicts accepted ADR Critical Architectural decision not in any ADR High ADR exists but is outdated/stale Medium Minor drift from ADR intent Low See [adr gate.md](./adr gate.md) for full protocol, reverse engineering rules, and configuration. Review Engine Choice When running /code review , users can choose their preferred review engine: Engine Comparison Aspect Claude Codex Gemini Multi Engine Setup None npm + OpenAI API npm + Google Account All setups Speed Fast Fast Fast 2 3x time Context Conversation Fresh per review 1M tokens N/A Detection Good 88% (best) 63.8% SWE Bench Combined Free Tier N/A Limited 1,000/day Varies Best for Quick reviews High accuracy Large codebases Critical code Set Default Engine Usage Examples Multi Engine Output When using multiple engines, findings are compared and deduplicated: Dual Engine Example Triple Engine Example (All Three) When to Use Each Mode Mode Use When Single (Claude) Quick in flow reviews, exploration Single (Codex) CI/CD automation, high accuracy needed Single (Gemini) Large codebases (100+ files), free tier Dual Important PRs, pre merge reviews Triple (All) Security critical code, payment systems, auth Core Philosophy When to Run Code Review Mandatory Review Points Trigger Action Command Before commit Review staged changes /code review Before PR Review all changes vs base /code review Before merge Final review of PR /code review Before deploy Review deployment diff /code review Automatic Integration Run code review automatically before every commit: Using the Code Review Plugin Basic Usage Review Categories The code review plugin analyzes: Category What It Checks Security Vulnerabilities, injection risks, auth issues, secrets Performance N+1 queries, memory leaks, inefficient algorithms Architecture Design patterns, SOLID principles, coupling Code Quality Readability, complexity, duplication Best Practices Language idioms, framework conventions Testing Coverage gaps, test quality, edge cases Documentation Missing docs, outdated comments Severity Levels Level Action Required Can Commit? 🔴 Critical Must fix immediately ❌ NO 🟠 High Should fix before commit ❌ NO 🟡 Medium Fix soon, can commit ✅ YES 🟢 Low Nice to have ✅ YES ℹ️ Info Suggestions only ✅ YES Pre Commit Hook Integration Install Pre Commit Hook Make Hook Executable Codex CLI Setup (For Codex/Both Modes) If you want to use Codex or Both modes, install the Codex CLI: Verify Installation See codex review.md skill for full Codex documentation. Gemini CLI Setup (For Gemini/Multi Engine Modes) If you want to use Gemini or multi engine modes, install the Gemini CLI: Authenticate Verify Installation See gemini review.md skill for full Gemini documentation. CI/CD Integration GitHub Actions Claude Only GitHub Actions Codex Only GitHub Actions Both Engines GitHub Actions Gemini Only GitHub Actions All Three Engines Review Checklist Before Every Commit [ ] Run /code review on staged changes [ ] No critical (🔴) issues [ ] No high (🟠) issues [ ] Security concerns addressed [ ] Performance issues considered Before Every PR [ ] Full code review of all changes [ ] All critical/high issues resolved [ ] Tests added for new functionality [ ] Documentation updated if needed Before Every Deployment [ ] Final review of deployment diff [ ] Security scan passed [ ] No new vulnerabilities introduced [ ] Rollback plan documented Common Review Findings Security Issues (Always Fix) Issue Example Fix SQL Injection query = f"SELECT FROM users WHERE id = {id}" Use parameterized queries XSS innerHTML = userInput Sanitize or use textContent Secrets in code apiKey = "sk xxx" Use environment variables Missing auth Unprotected endpoints Add authentication middleware Insecure crypto MD5/SHA1 for passwords Use bcrypt/argon2 Performance Issues (Should Fix) Issue Example Fix N+1 queries Loop with individual queries Use batch/eager loading Memory leak Unclosed connections Use connection pooling Missing index Slow queries Add database indexes Large payload Fetching unused fields Select only needed fields No pagination Loading all records Implement pagination Code Quality (Nice to Fix) Issue Example Fix Long function 100+ lines Extract into smaller functions Deep nesting 5+ levels Early returns, extract methods Magic numbers if (status === 3) Use named constants Duplicate code Copy pasted blocks Extract shared function Missing types any everywhere Add proper TypeScript types Post Review: Decision Extraction After review completes, extract architectural decisions automatically: 1. If review flagged new architectural choices → prompt to create ADR in docs/adr/ 2. If review approved a new pattern → log to project specs/session/decisions.md 3. If review found ADR drift → flag the ADR for update or supersede Integration with TDD Workflow Review Response Template When code review finds issues, respond with: Claude Instructions When to Invoke Code Review Claude should automatically suggest or run code review: 1. After completing a feature → "Let me run a code review before we commit" 2. Before creating a PR → "Running code review on all changes" 3. When user says "commit" → "First, let me review the changes" 4. After fixing bugs → "Reviewing the fix for any issues" Review Focus Areas Prioritize review based on change type: Change Type Focus Areas Auth/Security code Security, input validation, crypto Database code SQL injection, N+1, transactions API endpoints Auth, rate limiting, validation Frontend code XSS, state management, performance Infrastructure Secrets, permissions, logging Quick Reference Commands Severity Actions Workflow

code-review