agentsclimarketplace

Code review checklist

Skill VoDaiLocz/kilo-kit-mcp/skills/engineering/code-review-checklist

An MCP server for safer coding agents: skill routing, C4 workflow gates, memory checks, and verification before completion.

Install
npx -y skills add VoDaiLocz/kilo-kit-mcp --skill code-review-checklist

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 24 stars24 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Code review guidelines covering code quality, security, and best practices.

SKILL.md

2.5 KB, as published. Nobody here has run it

Code Review Checklist

Quick Review Checklist

Correctness

  • Code does what it's supposed to do
  • Edge cases handled
  • Error handling in place
  • No obvious bugs

Security

  • Input validated and sanitized
  • No SQL/NoSQL injection vulnerabilities
  • No XSS or CSRF vulnerabilities
  • No hardcoded secrets or sensitive credentials
  • AI-Specific: Protection against Prompt Injection (if applicable)
  • AI-Specific: Outputs are sanitized before being used in critical sinks

Performance

  • No N+1 queries
  • No unnecessary loops
  • Appropriate caching
  • Bundle size impact considered

Code Quality

  • Clear naming
  • DRY - no duplicate code
  • SOLID principles followed
  • Appropriate abstraction level

Testing

  • Unit tests for new code
  • Edge cases tested
  • Tests readable and maintainable

Documentation

  • Complex logic commented
  • Public APIs documented
  • README updated if needed

AI & LLM Review Patterns (2025)

Logic & Hallucinations

  • Chain of Thought: Does the logic follow a verifiable path?
  • Edge Cases: Did the AI account for empty states, timeouts, and partial failures?
  • External State: Is the code making safe assumptions about file systems or networks?

Prompt Engineering Review

// ❌ Vague prompt in code
const response = await ai.generate(userInput);

// ✅ Structured & Safe prompt
const response = await ai.generate({
  system: "You are a specialized parser...",
  input: sanitize(userInput),
  schema: ResponseSchema
});

Anti-Patterns to Flag

// ❌ Magic numbers
if (status === 3) { ... }

// ✅ Named constants
if (status === Status.ACTIVE) { ... }

// ❌ Deep nesting
if (a) { if (b) { if (c) { ... } } }

// ✅ Early returns
if (!a) return;
if (!b) return;
if (!c) return;
// do work

// ❌ Long functions (100+ lines)
// ✅ Small, focused functions

// ❌ any type
const data: any = ...

// ✅ Proper types
const data: UserData = ...

Review Comments Guide

// Blocking issues use 🔴
🔴 BLOCKING: SQL injection vulnerability here

// Important suggestions use 🟡
🟡 SUGGESTION: Consider using useMemo for performance

// Minor nits use 🟢
🟢 NIT: Prefer const over let for immutable variable

// Questions use ❓
❓ QUESTION: What happens if user is null here?

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.