Code review
Build Your Own AI Employee. The complete starter kit for OpenClaw + Hermes Agent. 155 deduplicated skills, drag-and-drop workspace, case studies, install scripts.
npx -y skills add S3YED/appie-kit --skill code-reviewAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 6 stars6 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Guidelines for performing thorough code reviews with security and quality focus
SKILL.md
2.2 KB, as published. Nobody here has run it
Code Review Skill
Use this skill when reviewing code changes, pull requests, or auditing existing code.
Review Checklist
1. Security First
- No hardcoded secrets, API keys, or credentials
- Input validation on all user-provided data
- SQL queries use parameterized statements (no string concatenation)
- File operations validate paths (no path traversal)
- Authentication/authorization checks present where needed
2. Error Handling
- All external calls (API, DB, file) have try/catch
- Errors are logged with context (but no sensitive data)
- User-facing errors are helpful but don't leak internals
- Resources are cleaned up in finally blocks or context managers
3. Code Quality
- Functions do one thing and are reasonably sized (<50 lines ideal)
- Variable names are descriptive (no single letters except loops)
- No commented-out code left behind
- Complex logic has explanatory comments
- No duplicate code (DRY principle)
4. Testing Considerations
- Edge cases handled (empty inputs, nulls, boundaries)
- Happy path and error paths both work
- New code has corresponding tests (if test suite exists)
Review Response Format
When providing review feedback, structure it as:
## Summary
[1-2 sentence overall assessment]
## Critical Issues (Must Fix)
- Issue 1: [description + suggested fix]
- Issue 2: ...
## Suggestions (Nice to Have)
- Suggestion 1: [description]
## Questions
- [Any clarifying questions about intent]
Common Patterns to Flag
Python
# Bad: SQL injection risk
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# Good: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = ?", (user_id,))
JavaScript
// Bad: XSS risk
element.innerHTML = userInput;
// Good: Safe text content
element.textContent = userInput;
Tone Guidelines
- Be constructive, not critical
- Explain why something is an issue, not just what
- Offer solutions, not just problems
- Acknowledge good patterns you see