从正确性、测试、安全与性能等维度进行深入代码审查并给出改进建议
该技能材料显示其为开源的纯提示型代码审查技能,不要求密钥、未声明远程端点,整体风险较低。需留意其说明中涉及读取代码上下文、运行测试及写入会话记忆等行为,但按当前材料更像流程指导而非自带执行能力。
材料明确标注无需密钥或环境变量,未见要求用户提供 token、API key 或其他敏感凭证,凭证泄露与滥用面较小。
未声明任何远程端点,且系统检查项标注为 prompt-only;材料中未见将代码或用户数据发送到外部服务的说明。
README 提到子代理可“read files and inspect changes”并在测试场景下“run tests”,还提到写入会话记忆;这表明其预期依赖宿主代理工具链执行本地检查,但从材料看并非技能自身打包可执行代码。
其用途就是审查 PR、git diff、分支和文件集,并将综合结果保存到 `/memories/session/review.md`;这意味着会接触项目代码与会话级审查结果,但未见超出其声明用途的过度授权请求。
来源为 GitHub 上的微软仓库,且系统标注 open-source,源码可审计,这是明显的降风险因素。虽然 star 为 0、许可证未声明、维护状态未知,带来一定不确定性,但基于现有材料未见闭源外发、可疑安装脚本或其他具体供应链红旗。
复制安装指令,让 AI 自动完成配置 · 推荐新手
请帮我安装 askskill 上的 "review-areas" 技能: 1. 下载 https://raw.githubusercontent.com/microsoft/vscode-team-kit/main/review-areas/skills/review-areas/SKILL.md 2. 保存为 ~/.claude/skills/review-areas/SKILL.md 3. 装好后重载技能,告诉我可以用了
请从正确性、测试覆盖、安全风险、性能影响和产品行为五个角度审查这段改动代码,列出问题、风险等级、原因,并给出可执行的修复建议与补充测试建议。
一份结构化审查报告,包含问题清单、优先级、修改建议和测试补充项。
这次重构后功能表面可用,但我担心有隐藏 bug。请像资深审查者一样进行代码走查,重点找边界条件、异常处理、并发问题、回归风险和遗漏测试。
潜在缺陷与回归风险列表,并附上复现思路和修复方向。
请评估这组改动是否达到可发布标准:检查是否存在高风险逻辑错误、测试不足、安全隐患、性能退化或不符合产品预期的行为,并给出是否建议合并的结论。
发布前审查结论,包含是否建议合并、阻塞问题和建议处理顺序。
Fan out parallel read-only subagents, each assigned a different review area, then synthesize the highest-signal findings. This surfaces issues that a single-pass review misses because each subagent goes deep on its area instead of skimming everything.
Pick 2–4 areas based on the nature of the change. Not every review needs all areas — match the areas to the risk profile.
| Area | When to include | Focus |
|---|---|---|
| Correctness | Always | Logic errors, type safety, race conditions, null/undefined paths, unsafe casts, wrong behavior |
| Tests | When tests exist or should exist | Run tests, check failing/missing coverage, validate assertions match intent |
| Security | Auth, input handling, data flow changes | Input validation, auth checks, injection, data exposure |
| Performance | Hot paths, data structures, async changes | Algorithm complexity, unnecessary allocations, blocking async patterns |
| Product | UI, UX, or user-facing behavior changes | UX implications, feature completeness, accessibility gaps |
Before fanning out, build a concise change summary. Do not paste raw diffs into the subagent prompts — each subagent has tools to read files and inspect changes itself.
The summary should include:
Keep the summary under ~50 lines. Subagents get better results reading code in context than scanning a wall of diff.
Launch 2–4 parallel subagents using the area prompts below. Each subagent works in isolation — do not share one area's findings with another before synthesis.
Use unnamed subagents (no custom agent needed). Each gets a self-contained prompt with its area, the change summary, and the return format.
When all subagents return:
Always save the synthesized findings to session memory at /memories/session/review.md. This makes them available for follow-up turns, fix planning, and cross-referencing with future reviews.
Explore subagents to investigate the fix — this is faster and deeper than reading files inline. Give each Explore agent the finding, the relevant file paths, and ask it to return the specific change needed (what to replace, where).Keep only findings a senior engineer would block a PR for:
…
用于创建和管理 AST 禁用规则,阻止特定代码语法或模式出现在编辑中。
为 GitHub 议题或拉取请求快速添加表情反应,提升协作反馈效率。
为方案、设计与实现提供高质量第二意见,及早发现逻辑与缺陷问题
获取指定 GitHub 通知线程的详细信息,便于快速查看上下文与后续处理。
帮助 AI 代理读写记忆与规则,并按环境自动选择可用存储方案
汇集多模型独立方案与辩论,辅助实现路径和架构决策
调用多模型交叉审查代码变更、PR与高风险修改,辅助发现缺陷与争议点
用于代码与分支审查,综合检查正确性、兼容性、架构、测试、性能与安全问题。
模拟多角色工程师协作审查代码,快速发现质量、风险与设计问题。
对本地或PR分支执行结构化代码审查,帮助提交或发布前发现问题。
审查技能类 PR,并按严重级别给出结构化质量反馈与规范检查
帮助开发者在认证、输入处理、密钥和敏感功能开发中进行系统安全审查