code-review

---
name: code-review
description: Use when the user wants to review a file for bugs, antipatterns, or quality issues. Triggers on "review", "check for issues", "look for problems", "audit", "before I ship".
allowed-tools: Read, Grep, Glob
---

## Code Review

1. **Read the target file** fully before reporting anything

2. **Check for general antipatterns:**

   **Backend / API:**
   - [ ] Auth check missing on protected endpoints
   - [ ] User input concatenated directly into SQL (injection risk)
   - [ ] Missing error handling on DB calls or external requests
   - [ ] Secrets or credentials hardcoded in source
   - [ ] N+1 query patterns (query inside a loop)
   - [ ] Missing tenant/org filter on multi-tenant queries

   **JavaScript / Frontend:**
   - [ ] `console.log` left in
   - [ ] Missing error handling on async calls
   - [ ] Direct DOM manipulation before checking element exists
   - [ ] Hardcoded IDs or environment-specific values
   - [ ] Inline styles that should be CSS classes
   - [ ] Missing mobile breakpoints

   **General:**
   - [ ] Functions doing more than one thing
   - [ ] Magic numbers/strings without named constants
   - [ ] Dead code or commented-out blocks left in
   - [ ] Missing input validation at system boundaries

3. **Report findings** in a table:
   | File | Line | Issue | Severity |
   |------|------|-------|----------|

4. Ask: "Fix any of these now, or just flag for later?"

5. **Do not change anything** until the user confirms.