code-reviewer

What This Skill Does

The code-reviewer skill is an elite analysis engine designed to transform your pull request and codebase assessment process. It functions as a senior-level technical auditor, leveraging sophisticated AI-powered analysis to enforce quality, security, and maintainability standards across your development lifecycle. Unlike basic linters, this skill integrates context-aware analysis with modern tooling like Semgrep, CodeQL, and SonarQube to identify complex logic flaws, security vulnerabilities, and architectural anti-patterns. Whether you are conducting a routine PR review, investigating a memory leak, or performing a rigorous security audit, this skill provides actionable, production-grade feedback that minimizes technical debt and improves overall software reliability.

Installation

To add this skill to your workspace, execute the following command in your OpenClaw terminal: clawhub install openclaw/skills/skills/anton-abyzov/sw-code-reviewer

Use Cases

• Pull Request Analysis: Automatically scan incoming code changes for deviations from team coding standards and potential regressions.
• Security Hardening: Proactively detect OWASP Top 10 vulnerabilities, such as injection risks or improper authentication implementation, before deployment.
• Technical Debt Reduction: Identify code smells, cyclomatic complexity spikes, and inefficient resource utilization to prioritize refactoring efforts.
• Performance Benchmarking: Analyze database queries, caching strategies, and asynchronous execution patterns to ensure your application scales efficiently.
• Infrastructure-as-Code Audits: Validate Terraform or Kubernetes manifests to ensure security best practices are baked into your deployment pipeline.

Example Prompts

1. "Review this pull request for potential security vulnerabilities, specifically focusing on input sanitization and potential SQL injection points."
2. "Analyze this Python function for performance bottlenecks; it currently experiences high latency under load. Suggest improvements for memory management and database query optimization."
3. "Evaluate my Terraform infrastructure files for compliance with production-grade security standards, particularly regarding secret management and public access control."

Tips & Limitations

To maximize the efficacy of this skill, ensure that the provided code snippets include sufficient context or associated configuration files. While the AI is highly proficient in detecting pattern-based issues, it performs best when paired with static analysis tools like Semgrep to verify findings. Note that while this skill can identify severe security flaws, it should be considered a layer in your defense-in-depth strategy, not a replacement for manual security penetration testing or formal compliance certifications. Always verify AI-generated refactoring suggestions in a sandboxed environment before applying them to mission-critical production codebases.