Apply these language-agnostic patterns to every code review:
Security Fundamentals: Check for secrets, API keys, or credentials in code—these belong in environment variables or secure vaults. Examine all input handling for injection vulnerabilities: SQL injection, command injection, path traversal, XSS. Verify authentication checks protect sensitive operations. Confirm authorization validates resource ownership, not just authentication status. Review cryptographic usage for appropriate algorithms, key sizes, and secure random number generation.
Logic Correctness: Analyze null and undefined handling—are all code paths safe? Test boundary conditions: empty arrays, zero values, maximum sizes, negative numbers. Trace error paths to ensure failures are handled gracefully and don't expose internal details. Identify potential race conditions in concurrent code: check-then-act patterns, shared mutable state, missing synchronization. Verify loops terminate and recursion has base cases.
Performance Considerations: Evaluate algorithmic complexity—O(n²) or worse on unbounded inputs is problematic. Check resource cleanup: files closed, connections released, timers cleared, event listeners removed. Assess caching opportunities for expensive computations or external calls. Review lazy loading and pagination for large datasets. Identify synchronous operations blocking event loops or main threads.
Maintainability Standards: Assess coupling—changes should be localized, not rippling across modules. Verify single responsibility—functions and classes should have one reason to change. Check for magic numbers and strings—extract named constants. Review error messages for actionability—include context for debugging.
Naming Quality: Names should reveal intent—verb phrases for functions (
, not
), descriptive nouns for variables (
, not
), boolean prefixes (
,
,
). See
~/.agents/skills/code-review/references/naming.md
for detailed conventions by language and common anti-patterns.
对每次代码评审应用以下与语言无关的检查项：
安全基础：检查代码中是否包含密钥、API密钥或凭证——这些应存储在环境变量或安全密钥管理服务中。检查所有输入处理是否存在注入漏洞：SQL注入、命令注入、路径遍历、XSS。验证认证检查是否保护敏感操作。确认授权机制验证资源所有权，而非仅验证认证状态。审查加密算法的使用是否恰当，包括算法选择、密钥长度和安全随机数生成。
逻辑正确性：分析空值和未定义值的处理——所有代码路径是否安全？测试边界条件：空数组、零值、最大值、负数。跟踪错误路径，确保故障被优雅处理且不暴露内部细节。识别并发代码中潜在的竞态条件：检查-然后-执行模式、共享可变状态、缺失同步机制。验证循环会终止，递归有基例。
性能考量：评估算法复杂度——在无界输入上使用O(n²)或更差的算法存在问题。检查资源清理：文件是否关闭、连接是否释放、定时器是否清除、事件监听器是否移除。评估昂贵计算或外部调用的缓存机会。审查大型数据集的懒加载和分页实现。识别阻塞事件循环或主线程的同步操作。
可维护性标准：评估耦合度——变更应局限于局部，而非波及多个模块。验证单一职责原则——函数和类应有且仅有一个变更原因。检查魔法数字和字符串——提取为命名常量。审查错误信息的可操作性——包含调试所需的上下文。
命名质量：命名应清晰表达意图——函数使用动词短语（如
，而非
），变量使用描述性名词（如
，而非
），布尔值使用前缀（
、
、
）。有关各语言的详细命名规范和常见反模式，请参阅
~/.agents/skills/code-review/references/naming.md
。