Which AI agents does it work with?

Any agent that supports the SKILL.md standard and can run git and read files, e.g. Claude Code, Codex CLI, Cursor. It was tested in Claude Code 2.1.

How is this different from pasting my code into a chat?

It reads the actual diff plus the surrounding code of every touched file, and checks the same five areas every time (correctness, security, data/API, performance, maintainability), returning a findings table ranked by severity instead of free-form comments.

Does it support specific languages or frameworks?

It works on any language git can diff. The checklist includes specific checks for JavaScript/TypeScript, React (renders, effect dependencies), Node APIs and GraphQL (N+1, breaking schema changes).

Will it change my code?

No. It only reads and reports. It edits code only if you explicitly ask it to apply a fix.

A zip with one SKILL.md file. Install it by copying the "review" folder into .claude/skills/ in your project (or ~/.claude/skills/ for all projects). One-time payment, future updates included.

Code Review by Severity

I reviewed the two staged files (src/auth/service.ts and src/middleware/auth.ts). There are three serious problems, one of them an authentication bypass.

Sev.	File:line	Problem	Suggestion
🔴 high	`src/middleware/auth.ts:8-9`	Auth bypass. `verifyToken` now returns `null` for an invalid or expired token. The middleware still sets `req.user = null` and calls `next()`. A request with `Authorization: Bearer garbage` therefore passes `requireAuth`. Any handler that only checks the middleware, or reads `req.user?.sub` loosely, is exposed.	After verifying, add `if (!payload) return res.status(401).json({ error: "invalid token" });` before `next()`.
🔴 high	`src/auth/service.ts:21`	SQL injection. `findUserByEmail` interpolates `email` straight into the query. An input like `' OR '1'='1` returns arbitrary users, and `'; DROP TABLE users;--` can run further statements, depending on the driver.	Use a parameterized query, e.g. `db.query("SELECT * FROM users WHERE email = $1", [email])`, with the placeholder syntax your driver uses. Replace `db: any` with a real type, and select only the columns you need instead of `*`.
🔴 high	`src/auth/service.ts:4`	Secret in logs. `console.log("auth init", config.JWT_SECRET)` writes the JWT signing secret to stdout on every start. Anyone with log access can forge valid tokens.	Delete the line. If you need a startup message, log without the secret.
🟡 medium	`src/auth/service.ts:13-17`	`catch {}` swallows every error and returns `null`. A bad token, an expired token and a misconfigured secret all look the same, which makes failures hard to diagnose. `jwt.verify` can also return a string payload, so callers can't rely on `.sub`.	Return a typed result, such as `{ sub: string } \| null`, or narrow the payload type. Log or distinguish `TokenExpiredError` from other errors.
🟡 medium	`src/middleware/auth.ts:6`	`replace("Bearer ", "")` doesn't check the scheme. A header of `Basic xyz` becomes `Basic xyz` and is passed to `verify`. That is harmless once the bypass is fixed, but sloppy.	Match with `/^Bearer (.+)$/` and return 401 if it doesn't match.
⚪ minor	`src/middleware/auth.ts:4`	Dropping `async` is correct now that `verifyToken` is synchronous.	None. This is fine as is.
⚪ minor	`src/auth/service.ts`	There are no tests for `verifyToken` or `findUserByEmail`. A test for "invalid token returns 401" would have caught the bypass.	Add tests for valid, expired, malformed and missing tokens.

I recommend not merging until the three 🔴 items are fixed. I haven't changed anything. Tell me if you want me to apply the fixes.

About this skill

Type "review" and Claude reads the diff plus the context of every touched file, then checks in a fixed order:

Correctness: edge cases, null/undefined, missing await, race conditions, off-by-one, swallowed errors.
Security: injection (SQL, shell, XSS), secrets in code, input validation, missing authorization, sensitive data in logs.
Data and API: irreversible migrations, breaking REST/GraphQL changes, N+1 queries.
Performance: unnecessary React renders, wrong effect dependencies, queries in loops.
Maintainability: duplication, confusing names, dead code, missing tests.

Output: a table with severity (high / medium / minor), file:line, problem and suggestion. It only reports what it can justify with a concrete scenario, says so when it finds nothing serious, and never edits code unless you ask.

Unofficial. Not affiliated with Anthropic.

Code Review by Severity