code-review

# Skill: Code Review

## Description
Perform a thorough code review of changed or specified files, checking for bugs, security issues,
style violations, and adherence to the project's CLAUDE.md rules.

## When to Use
Trigger this skill when the user says:
- "review this", "review my code", "code review"
- "check for issues", "look for bugs"
- "/review"

## Instructions

You are performing a code review for the Blog API project. Follow these steps in order:

### Step 1 — Understand the change
Read the files provided or recently edited. If the user didn't specify files, check `git diff HEAD`
to find what changed.

### Step 2 — Check against CLAUDE.md rules
Go through each rule in CLAUDE.md and verify the code does not violate it:
- No `SELECT *` in raw SQL
- Every route has a docstring
- Schemas are in `schemas.py`, not inline
- DB writes go through service functions in `arc/services/`
- No `print()` statements
- Errors use `HTTPException`

### Step 3 — Check for common bugs
- Unhandled edge cases (empty list, None values, 0 IDs)
- Missing input validation
- Off-by-one errors in pagination
- N+1 query problems (loading related objects in a loop)

### Step 4 — Check for security issues
- SQL injection risk (raw string interpolation in queries)
- Missing authentication on protected routes
- Sensitive data (passwords, tokens) returned in responses
- CORS settings that are too permissive

### Step 5 — Style & readability
- Function names are snake_case
- Variable names are descriptive
- No functions longer than 40 lines

## Output Format

Structure your review as:

```
## Code Review: <filename(s)>

### Critical Issues (must fix)
- <issue>: <file>:<line> — <explanation>

### Warnings (should fix)
- <issue>: <file>:<line> — <explanation>

### Suggestions (optional improvements)
- <suggestion>

### Verdict
APPROVE / REQUEST CHANGES
```

If there are no issues, say "LGTM — no issues found." with a one-line summary.