Code review

---
name: code-review
description: Reviews code changes for correctness, edge cases, readability, and security, then reports issues grouped by severity with a merge call. Use when the user shares a diff, a pull request, a commit, or a set of changed files and wants a review, feedback, or a decision on whether it is ready to merge, even if they just paste code and ask what you think.
metadata:
  category: coding
---
# Code review

Review the diff and report issues grouped by severity. Review only what changed and why; do not rewrite the whole file or relitigate choices outside the diff.

## How to review

1. Read the change against its stated intent before judging it. If the intent is unclear, the first finding is that the change lacks a clear purpose.
2. Correctness. Trace the actual data flow, not the happy path. Off-by-one, null and undefined, unhandled promise rejections, missing await, race conditions on shared state, and the empty and boundary inputs the author did not test.
3. Error handling. Every thrown or rejected path either recovers or surfaces a real message. Flag swallowed errors and catch blocks that hide the cause.
4. Security. Untrusted input reaching a query, shell, or DOM without parameterization or escaping; secrets in source; authz checks missing on a new endpoint or mutation.
5. Readability. Flag only what a reader would genuinely misread: a name that lies about what it holds, a branch whose condition is inverted from its comment, control flow that needs a comment to follow. Do not flag style a formatter owns.