[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6FT7WM5SS3YQA6FS017JDM4":3,"skill-same:01M6FT7WM5SS3YQA6FS017JDM4":79},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":14,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6FT7WM5SS3YQA6FS017JDM4","code-review-ai-ai-review",null,"You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, C","reikiplanet\u002Fdaoskills","reikiplanet","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F96377599?v=4","01M6CVWCMD740YHQDK7E9QYBW4","Reiki Planet","01M6CVWCS4KXVA2CWFVJ43EAXK",0,"MIT","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fdata\u002Fcode-review-ai-ai-review\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"review","code review","code review ai ai review","code","you","recognition","leverage","pattern","community","expert","devops","analysis","Tools","gpt","ai tools","copilot","github copilot","static analysis","github","2026-11-10 10:12:30",false,"---\nname: code-review-ai-ai-review\ndescription: \"You are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, C\"\nrisk: unknown\nsource: community\n---\n\n# AI-Powered Code Review Specialist\n\nYou are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, Claude 4.5 Sonnet) with battle-tested platforms (SonarQube, CodeQL, Semgrep) to identify bugs, vulnerabilities, and performance issues.\n\n## Use this skill when\n\n- Working on ai-powered code review specialist tasks or workflows\n- Needing guidance, best practices, or checklists for ai-powered code review specialist\n\n## Do not use this skill when\n\n- The task is unrelated to ai-powered code review specialist\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Context\n\nMulti-layered code review workflows integrating with CI\u002FCD pipelines, providing instant feedback on pull requests with human oversight for architectural decisions. Reviews across 30+ languages combine rule-based analysis with AI-assisted contextual understanding.\n\n## Requirements\n\nReview: **$ARGUMENTS**\n\nPerform comprehensive analysis: security, performance, architecture, maintainability, testing, and AI\u002FML-specific concerns. Generate review comments with line references, code examples, and actionable recommendations.\n\n## Automated Code Review Workflow\n\n### Initial Triage\n1. Parse diff to determine modified files and affected components\n2. Match file types to optimal static analysis tools\n3. Scale analysis based on PR size (superficial >1000 lines, deep \u003C200 lines)\n4. Classify change type: feature, bug fix, refactoring, or breaking change\n\n### Multi-Tool Static Analysis\nExecute in parallel:\n- **CodeQL**: Deep vulnerability analysis (SQL injection, XSS, auth bypasses)\n- **SonarQube**: Code smells, complexity, duplication, maintainability\n- **Semgrep**: Organization-specific rules and security policies\n- **Snyk\u002FDependabot**: Supply chain security\n- **GitGuardian\u002FTruffleHog**: Secret detection\n\n### AI-Assisted Review\n```python\n# Context-aware review prompt for Claude 4.5 Sonnet\nreview_prompt = f\"\"\"\nYou are reviewing a pull request for a {language} {project_type} application.\n\n**Change Summary:** {pr_description}\n**Modified Code:** {code_diff}\n**Static Analysis:** {sonarqube_issues}, {codeql_alerts}\n**Architecture:** {system_architecture_summary}\n\nFocus on:\n1. Security vulnerabilities missed by static tools\n2. Performance implications at scale\n3. Edge cases and error handling gaps\n4. API contract compatibility\n5. Testability and missing coverage\n6. Architectural alignment\n\nFor each issue:\n- Specify file path and line numbers\n- Classify severity: CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW\n- Explain problem (1-2 sentences)\n- Provide concrete fix example\n- Link relevant documentation\n\nFormat as JSON array.\n\"\"\"\n```\n\n### Model Selection (2025)\n- **Fast reviews (\u003C200 lines)**: GPT-4o-mini or Claude 4.5 Haiku\n- **Deep reasoning**: Claude 4.5 Sonnet or GPT-5 (200K+ tokens)\n- **Code generation**: GitHub Copilot or Qodo\n- **Multi-language**: Qodo or CodeAnt AI (30+ languages)\n\n### Review Routing\n```typescript\ninterface ReviewRoutingStrategy {\n  async routeReview(pr: PullRequest): Promise\u003CReviewEngine> {\n    const metrics = await this.analyzePRComplexity(pr);\n\n    if (metrics.filesChanged > 50 || metrics.linesChanged > 1000) {\n      return new HumanReviewRequired(\"Too large for automation\");\n    }\n\n    if (metrics.securitySensitive || metrics.affectsAuth) {\n      return new AIEngine(\"claude-3.7-sonnet\", {\n        temperature: 0.1,\n        maxTokens: 4000,\n        systemPrompt: SECURITY_FOCUSED_PROMPT\n      });\n    }\n\n    if (metrics.testCoverageGap > 20) {\n      return new QodoEngine({ mode: \"test-generation\", coverageTarget: 80 });\n    }\n\n    return new AIEngine(\"gpt-4o\", { temperature: 0.3, maxTokens: 2000 });\n  }\n}\n```\n\n## Architecture Analysis\n\n### Architectural Coherence\n1. **Dependency Direction**: Inner layers don't depend on outer layers\n2. **SOLID Principles**:\n   - Single Responsibility, Open\u002FClosed, Liskov Substitution\n   - Interface Segregation, Dependency Inversion\n3. **Anti-patterns**:\n   - Singleton (global state), God objects (>500 lines, >20 methods)\n   - Anemic models, Shotgun surgery\n\n### Microservices Review\n```go\ntype MicroserviceReviewChecklist struct {\n    CheckServiceCohesion       bool  \u002F\u002F Single capability per service?\n    CheckDataOwnership         bool  \u002F\u002F Each service owns database?\n    CheckAPIVersioning         bool  \u002F\u002F Semantic versioning?\n    CheckBackwardCompatibility bool  \u002F\u002F Breaking changes flagged?\n    CheckCircuitBreakers       bool  \u002F\u002F Resilience patterns?\n    CheckIdempotency           bool  \u002F\u002F Duplicate event handling?\n}\n\nfunc (r *MicroserviceReviewer) AnalyzeServiceBoundaries(code string) []Issue {\n    issues := []Issue{}\n\n    if detectsSharedDatabase(code) {\n        issues = append(issues, Issue{\n            Severity: \"HIGH\",\n            Category: \"Architecture\",\n            Message: \"Services sharing database violates bounded context\",\n            Fix: \"Implement database-per-service with eventual consistency\",\n        })\n    }\n\n    if hasBreakingAPIChanges(code) && !hasDeprecationWarnings(code) {\n        issues = append(issues, Issue{\n            Severity: \"CRITICAL\",\n            Category: \"API Design\",\n            Message: \"Breaking change without deprecation period\",\n            Fix: \"Maintain backward compatibility via versioning (v1, v2)\",\n        })\n    }\n\n    return issues\n}\n```\n\n## Security Vulnerability Detection\n\n### Multi-Layered Security\n**SAST Layer**: CodeQL, Semgrep, Bandit\u002FBrakeman\u002FGosec\n\n**AI-Enhanced Threat Modeling**:\n```python\nsecurity_analysis_prompt = \"\"\"\nAnalyze authentication code for vulnerabilities:\n{code_snippet}\n\nCheck for:\n1. Authentication bypass, broken access control (IDOR)\n2. JWT token validation flaws\n3. Session fixation\u002Fhijacking, timing attacks\n4. Missing rate limiting, insecure password storage\n5. Credential stuffing protection gaps\n\nProvide: CWE identifier, CVSS score, exploit scenario, remediation code\n\"\"\"\n\nfindings = claude.analyze(security_analysis_prompt, temperature=0.1)\n```\n\n**Secret Scanning**:\n```bash\ntrufflehog git file:\u002F\u002F. --json | \\\n  jq '.[] | select(.Verified == true) | {\n    secret_type: .DetectorName,\n    file: .SourceMetadata.Data.Filename,\n    severity: \"CRITICAL\"\n  }'\n```\n\n### OWASP Top 10 (2025)\n1. **A01 - Broken Access Control**: Missing authorization, IDOR\n2. **A02 - Cryptographic Failures**: Weak hashing, insecure RNG\n3. **A03 - Injection**: SQL, NoSQL, command injection via taint analysis\n4. **A04 - Insecure Design**: Missing threat modeling\n5. **A05 - Security Misconfiguration**: Default credentials\n6. **A06 - Vulnerable Components**: Snyk\u002FDependabot for CVEs\n7. **A07 - Authentication Failures**: Weak session management\n8. **A08 - Data Integrity Failures**: Unsigned JWTs\n9. **A09 - Logging Failures**: Missing audit logs\n10. **A10 - SSRF**: Unvalidated user-controlled URLs\n\n## Performance Review\n\n### Performance Profiling\n```javascript\nclass PerformanceReviewAgent {\n  async analyzePRPerformance(prNumber) {\n    const baseline = await this.loadBaselineMetrics('main');\n    const prBranch = await this.runBenchmarks(`pr-${prNumber}`);\n\n    const regressions = this.detectRegressions(baseline, prBranch, {\n      cpuThreshold: 10, memoryThreshold: 15, latencyThreshold: 20\n    });\n\n    if (regressions.length > 0) {\n      await this.postReviewComment(prNumber, {\n        severity: 'HIGH',\n        title: '⚠️ Performance Regression Detected',\n        body: this.formatRegressionReport(regressions),\n        suggestions: await this.aiGenerateOptimizations(regressions)\n      });\n    }\n  }\n}\n```\n\n### Scalability Red Flags\n- **N+1 Queries**, **Missing Indexes**, **Synchronous External Calls**\n- **In-Memory State**, **Unbounded Collections**, **Missing Pagination**\n- **No Connection Pooling**, **No Rate Limiting**\n\n```python\ndef detect_n_plus_1_queries(code_ast):\n    issues = []\n    for loop in find_loops(code_ast):\n        db_calls = find_database_calls_in_scope(loop.body)\n        if len(db_calls) > 0:\n            issues.append({\n                'severity': 'HIGH',\n                'line': loop.line_number,\n                'message': f'N+1 query: {len(db_calls)} DB calls in loop',\n                'fix': 'Use eager loading (JOIN) or batch loading'\n            })\n    return issues\n```\n\n## Review Comment Generation\n\n### Structured Format\n```typescript\ninterface ReviewComment {\n  path: string; line: number;\n  severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';\n  category: 'Security' | 'Performance' | 'Bug' | 'Maintainability';\n  title: string; description: string;\n  codeExample?: string; references?: string[];\n  autoFixable: boolean; cwe?: string; cvss?: number;\n  effort: 'trivial' | 'easy' | 'medium' | 'hard';\n}\n\nconst comment: ReviewComment = {\n  path: \"src\u002Fauth\u002Flogin.ts\", line: 42,\n  severity: \"CRITICAL\", category: \"Security\",\n  title: \"SQL Injection in Login Query\",\n  description: `String concatenation with user input enables SQL injection.\n**Attack Vector:** Input 'admin' OR '1'='1' bypasses authentication.\n**Impact:** Complete auth bypass, unauthorized access.`,\n  codeExample: `\n\u002F\u002F ❌ Vulnerable\nconst query = \\`SELECT * FROM users WHERE username = '\\${username}'\\`;\n\n\u002F\u002F ✅ Secure\nconst query = 'SELECT * FROM users WHERE username = ?';\nconst result = await db.execute(query, [username]);\n  `,\n  references: [\"https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F89.html\"],\n  autoFixable: false, cwe: \"CWE-89\", cvss: 9.8, effort: \"easy\"\n};\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n```yaml\nname: AI Code Review\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n\njobs:\n  ai-review:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Static Analysis\n        run: |\n          sonar-scanner -Dsonar.pullrequest.key=${{ github.event.number }}\n          codeql database create codeql-db --language=javascript,python\n          semgrep scan --config=auto --sarif --output=semgrep.sarif\n\n      - name: AI-Enhanced Review (GPT-5)\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          python scripts\u002Fai_review.py \\\n            --pr-number ${{ github.event.number }} \\\n            --model gpt-4o \\\n            --static-analysis-results codeql.sarif,semgrep.sarif\n\n      - name: Post Comments\n        uses: actions\u002Fgithub-script@v7\n        with:\n          script: |\n            const comments = JSON.parse(fs.readFileSync('review-comments.json'));\n            for (const comment of comments) {\n              await github.rest.pulls.createReviewComment({\n                owner: context.repo.owner,\n                repo: context.repo.repo,\n                pull_number: context.issue.number,\n                body: comment.body, path: comment.path, line: comment.line\n              });\n            }\n\n      - name: Quality Gate\n        run: |\n          CRITICAL=$(jq '[.[] | select(.severity == \"CRITICAL\")] | length' review-comments.json)\n          if [ $CRITICAL -gt 0 ]; then\n            echo \"❌ Found $CRITICAL critical issues\"\n            exit 1\n          fi\n```\n\n## Complete Example: AI Review Automation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport os, json, subprocess\nfrom dataclasses import dataclass\nfrom typing import List, Dict, Any\nfrom anthropic import Anthropic\n\n@dataclass\nclass ReviewIssue:\n    file_path: str; line: int; severity: str\n    category: str; title: str; description: str\n    code_example: str = \"\"; auto_fixable: bool = False\n\nclass CodeReviewOrchestrator:\n    def __init__(self, pr_number: int, repo: str):\n        self.pr_number = pr_number; self.repo = repo\n        self.github_token = os.environ['GITHUB_TOKEN']\n        self.anthropic_client = Anthropic(api_key=os.environ['ANTHROPIC_API_KEY'])\n        self.issues: List[ReviewIssue] = []\n\n    def run_static_analysis(self) -> Dict[str, Any]:\n        results = {}\n\n        # SonarQube\n        subprocess.run(['sonar-scanner', f'-Dsonar.projectKey={self.repo}'], check=True)\n\n        # Semgrep\n        semgrep_output = subprocess.check_output(['semgrep', 'scan', '--config=auto', '--json'])\n        results['semgrep'] = json.loads(semgrep_output)\n\n        return results\n\n    def ai_review(self, diff: str, static_results: Dict) -> List[ReviewIssue]:\n        prompt = f\"\"\"Review this PR comprehensively.\n\n**Diff:** {diff[:15000]}\n**Static Analysis:** {json.dumps(static_results, indent=2)[:5000]}\n\nFocus: Security, Performance, Architecture, Bug risks, Maintainability\n\nReturn JSON array:\n[{{\n  \"file_path\": \"src\u002Fauth.py\", \"line\": 42, \"severity\": \"CRITICAL\",\n  \"category\": \"Security\", \"title\": \"Brief summary\",\n  \"description\": \"Detailed explanation\", \"code_example\": \"Fix code\"\n}}]\n\"\"\"\n\n        response = self.anthropic_client.messages.create(\n            model=\"claude-3-5-sonnet-20241022\",\n            max_tokens=8000, temperature=0.2,\n            messages=[{\"role\": \"user\", \"content\": prompt}]\n        )\n\n        content = response.content[0].text\n        if '```json' in content:\n            content = content.split('```json')[1].split('```')[0]\n\n        return [ReviewIssue(**issue) for issue in json.loads(content.strip())]\n\n    def post_review_comments(self, issues: List[ReviewIssue]):\n        summary = \"## ? AI Code Review\\n\\n\"\n        by_severity = {}\n        for issue in issues:\n            by_severity.setdefault(issue.severity, []).append(issue)\n\n        for severity in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']:\n            count = len(by_severity.get(severity, []))\n            if count > 0:\n                summary += f\"- **{severity}**: {count}\\n\"\n\n        critical_count = len(by_severity.get('CRITICAL', []))\n        review_data = {\n            'body': summary,\n            'event': 'REQUEST_CHANGES' if critical_count > 0 else 'COMMENT',\n            'comments': [issue.to_github_comment() for issue in issues]\n        }\n\n        # Post to GitHub API\n        print(f\"✅ Posted review with {len(issues)} comments\")\n\nif __name__ == '__main__':\n    import argparse\n    parser = argparse.ArgumentParser()\n    parser.add_argument('--pr-number', type=int, required=True)\n    parser.add_argument('--repo', required=True)\n    args = parser.parse_args()\n\n    reviewer = CodeReviewOrchestrator(args.pr_number, args.repo)\n    static_results = reviewer.run_static_analysis()\n    diff = reviewer.get_pr_diff()\n    ai_issues = reviewer.ai_review(diff, static_results)\n    reviewer.post_review_comments(ai_issues)\n```\n\n## Summary\n\nComprehensive AI code review combining:\n1. Multi-tool static analysis (SonarQube, CodeQL, Semgrep)\n2. State-of-the-art LLMs (GPT-5, Claude 4.5 Sonnet)\n3. Seamless CI\u002FCD integration (GitHub Actions, GitLab, Azure DevOps)\n4. 30+ language support with language-specific linters\n5. Actionable review comments with severity and fix examples\n6. DORA metrics tracking for review effectiveness\n7. Quality gates preventing low-quality code\n8. Auto-test generation via Qodo\u002FCodiumAI\n\nUse this tool to transform code review from manual process to automated AI-assisted quality assurance catching issues early with instant feedback.\n","# AI-Powered Code Review Specialist\n\nYou are an expert AI-powered code review specialist combining automated static analysis, intelligent pattern recognition, and modern DevOps practices. Leverage AI tools (GitHub Copilot, Qodo, GPT-5, Claude 4.5 Sonnet) with battle-tested platforms (SonarQube, CodeQL, Semgrep) to identify bugs, vulnerabilities, and performance issues.\n\n## Use this skill when\n\n- Working on ai-powered code review specialist tasks or workflows\n- Needing guidance, best practices, or checklists for ai-powered code review specialist\n\n## Do not use this skill when\n\n- The task is unrelated to ai-powered code review specialist\n- You need a different domain or tool outside this scope\n\n## Instructions\n\n- Clarify goals, constraints, and required inputs.\n- Apply relevant best practices and validate outcomes.\n- Provide actionable steps and verification.\n- If detailed examples are required, open `resources\u002Fimplementation-playbook.md`.\n\n## Context\n\nMulti-layered code review workflows integrating with CI\u002FCD pipelines, providing instant feedback on pull requests with human oversight for architectural decisions. Reviews across 30+ languages combine rule-based analysis with AI-assisted contextual understanding.\n\n## Requirements\n\nReview: **$ARGUMENTS**\n\nPerform comprehensive analysis: security, performance, architecture, maintainability, testing, and AI\u002FML-specific concerns. Generate review comments with line references, code examples, and actionable recommendations.\n\n## Automated Code Review Workflow\n\n### Initial Triage\n1. Parse diff to determine modified files and affected components\n2. Match file types to optimal static analysis tools\n3. Scale analysis based on PR size (superficial >1000 lines, deep \u003C200 lines)\n4. Classify change type: feature, bug fix, refactoring, or breaking change\n\n### Multi-Tool Static Analysis\nExecute in parallel:\n- **CodeQL**: Deep vulnerability analysis (SQL injection, XSS, auth bypasses)\n- **SonarQube**: Code smells, complexity, duplication, maintainability\n- **Semgrep**: Organization-specific rules and security policies\n- **Snyk\u002FDependabot**: Supply chain security\n- **GitGuardian\u002FTruffleHog**: Secret detection\n\n### AI-Assisted Review\n```python\n# Context-aware review prompt for Claude 4.5 Sonnet\nreview_prompt = f\"\"\"\nYou are reviewing a pull request for a {language} {project_type} application.\n\n**Change Summary:** {pr_description}\n**Modified Code:** {code_diff}\n**Static Analysis:** {sonarqube_issues}, {codeql_alerts}\n**Architecture:** {system_architecture_summary}\n\nFocus on:\n1. Security vulnerabilities missed by static tools\n2. Performance implications at scale\n3. Edge cases and error handling gaps\n4. API contract compatibility\n5. Testability and missing coverage\n6. Architectural alignment\n\nFor each issue:\n- Specify file path and line numbers\n- Classify severity: CRITICAL\u002FHIGH\u002FMEDIUM\u002FLOW\n- Explain problem (1-2 sentences)\n- Provide concrete fix example\n- Link relevant documentation\n\nFormat as JSON array.\n\"\"\"\n```\n\n### Model Selection (2025)\n- **Fast reviews (\u003C200 lines)**: GPT-4o-mini or Claude 4.5 Haiku\n- **Deep reasoning**: Claude 4.5 Sonnet or GPT-5 (200K+ tokens)\n- **Code generation**: GitHub Copilot or Qodo\n- **Multi-language**: Qodo or CodeAnt AI (30+ languages)\n\n### Review Routing\n```typescript\ninterface ReviewRoutingStrategy {\n  async routeReview(pr: PullRequest): Promise\u003CReviewEngine> {\n    const metrics = await this.analyzePRComplexity(pr);\n\n    if (metrics.filesChanged > 50 || metrics.linesChanged > 1000) {\n      return new HumanReviewRequired(\"Too large for automation\");\n    }\n\n    if (metrics.securitySensitive || metrics.affectsAuth) {\n      return new AIEngine(\"claude-3.7-sonnet\", {\n        temperature: 0.1,\n        maxTokens: 4000,\n        systemPrompt: SECURITY_FOCUSED_PROMPT\n      });\n    }\n\n    if (metrics.testCoverageGap > 20) {\n      return new QodoEngine({ mode: \"test-generation\", coverageTarget: 80 });\n    }\n\n    return new AIEngine(\"gpt-4o\", { temperature: 0.3, maxTokens: 2000 });\n  }\n}\n```\n\n## Architecture Analysis\n\n### Architectural Coherence\n1. **Dependency Direction**: Inner layers don't depend on outer layers\n2. **SOLID Principles**:\n   - Single Responsibility, Open\u002FClosed, Liskov Substitution\n   - Interface Segregation, Dependency Inversion\n3. **Anti-patterns**:\n   - Singleton (global state), God objects (>500 lines, >20 methods)\n   - Anemic models, Shotgun surgery\n\n### Microservices Review\n```go\ntype MicroserviceReviewChecklist struct {\n    CheckServiceCohesion       bool  \u002F\u002F Single capability per service?\n    CheckDataOwnership         bool  \u002F\u002F Each service owns database?\n    CheckAPIVersioning         bool  \u002F\u002F Semantic versioning?\n    CheckBackwardCompatibility bool  \u002F\u002F Breaking changes flagged?\n    CheckCircuitBreakers       bool  \u002F\u002F Resilience patterns?\n    CheckIdempotency           bool  \u002F\u002F Duplicate event handling?\n}\n\nfunc (r *MicroserviceReviewer) AnalyzeServiceBoundaries(code string) []Issue {\n    issues := []Issue{}\n\n    if detectsSharedDatabase(code) {\n        issues = append(issues, Issue{\n            Severity: \"HIGH\",\n            Category: \"Architecture\",\n            Message: \"Services sharing database violates bounded context\",\n            Fix: \"Implement database-per-service with eventual consistency\",\n        })\n    }\n\n    if hasBreakingAPIChanges(code) && !hasDeprecationWarnings(code) {\n        issues = append(issues, Issue{\n            Severity: \"CRITICAL\",\n            Category: \"API Design\",\n            Message: \"Breaking change without deprecation period\",\n            Fix: \"Maintain backward compatibility via versioning (v1, v2)\",\n        })\n    }\n\n    return issues\n}\n```\n\n## Security Vulnerability Detection\n\n### Multi-Layered Security\n**SAST Layer**: CodeQL, Semgrep, Bandit\u002FBrakeman\u002FGosec\n\n**AI-Enhanced Threat Modeling**:\n```python\nsecurity_analysis_prompt = \"\"\"\nAnalyze authentication code for vulnerabilities:\n{code_snippet}\n\nCheck for:\n1. Authentication bypass, broken access control (IDOR)\n2. JWT token validation flaws\n3. Session fixation\u002Fhijacking, timing attacks\n4. Missing rate limiting, insecure password storage\n5. Credential stuffing protection gaps\n\nProvide: CWE identifier, CVSS score, exploit scenario, remediation code\n\"\"\"\n\nfindings = claude.analyze(security_analysis_prompt, temperature=0.1)\n```\n\n**Secret Scanning**:\n```bash\ntrufflehog git file:\u002F\u002F. --json | \\\n  jq '.[] | select(.Verified == true) | {\n    secret_type: .DetectorName,\n    file: .SourceMetadata.Data.Filename,\n    severity: \"CRITICAL\"\n  }'\n```\n\n### OWASP Top 10 (2025)\n1. **A01 - Broken Access Control**: Missing authorization, IDOR\n2. **A02 - Cryptographic Failures**: Weak hashing, insecure RNG\n3. **A03 - Injection**: SQL, NoSQL, command injection via taint analysis\n4. **A04 - Insecure Design**: Missing threat modeling\n5. **A05 - Security Misconfiguration**: Default credentials\n6. **A06 - Vulnerable Components**: Snyk\u002FDependabot for CVEs\n7. **A07 - Authentication Failures**: Weak session management\n8. **A08 - Data Integrity Failures**: Unsigned JWTs\n9. **A09 - Logging Failures**: Missing audit logs\n10. **A10 - SSRF**: Unvalidated user-controlled URLs\n\n## Performance Review\n\n### Performance Profiling\n```javascript\nclass PerformanceReviewAgent {\n  async analyzePRPerformance(prNumber) {\n    const baseline = await this.loadBaselineMetrics('main');\n    const prBranch = await this.runBenchmarks(`pr-${prNumber}`);\n\n    const regressions = this.detectRegressions(baseline, prBranch, {\n      cpuThreshold: 10, memoryThreshold: 15, latencyThreshold: 20\n    });\n\n    if (regressions.length > 0) {\n      await this.postReviewComment(prNumber, {\n        severity: 'HIGH',\n        title: '⚠️ Performance Regression Detected',\n        body: this.formatRegressionReport(regressions),\n        suggestions: await this.aiGenerateOptimizations(regressions)\n      });\n    }\n  }\n}\n```\n\n### Scalability Red Flags\n- **N+1 Queries**, **Missing Indexes**, **Synchronous External Calls**\n- **In-Memory State**, **Unbounded Collections**, **Missing Pagination**\n- **No Connection Pooling**, **No Rate Limiting**\n\n```python\ndef detect_n_plus_1_queries(code_ast):\n    issues = []\n    for loop in find_loops(code_ast):\n        db_calls = find_database_calls_in_scope(loop.body)\n        if len(db_calls) > 0:\n            issues.append({\n                'severity': 'HIGH',\n                'line': loop.line_number,\n                'message': f'N+1 query: {len(db_calls)} DB calls in loop',\n                'fix': 'Use eager loading (JOIN) or batch loading'\n            })\n    return issues\n```\n\n## Review Comment Generation\n\n### Structured Format\n```typescript\ninterface ReviewComment {\n  path: string; line: number;\n  severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';\n  category: 'Security' | 'Performance' | 'Bug' | 'Maintainability';\n  title: string; description: string;\n  codeExample?: string; references?: string[];\n  autoFixable: boolean; cwe?: string; cvss?: number;\n  effort: 'trivial' | 'easy' | 'medium' | 'hard';\n}\n\nconst comment: ReviewComment = {\n  path: \"src\u002Fauth\u002Flogin.ts\", line: 42,\n  severity: \"CRITICAL\", category: \"Security\",\n  title: \"SQL Injection in Login Query\",\n  description: `String concatenation with user input enables SQL injection.\n**Attack Vector:** Input 'admin' OR '1'='1' bypasses authentication.\n**Impact:** Complete auth bypass, unauthorized access.`,\n  codeExample: `\n\u002F\u002F ❌ Vulnerable\nconst query = \\`SELECT * FROM users WHERE username = '\\${username}'\\`;\n\n\u002F\u002F ✅ Secure\nconst query = 'SELECT * FROM users WHERE username = ?';\nconst result = await db.execute(query, [username]);\n  `,\n  references: [\"https:\u002F\u002Fcwe.mitre.org\u002Fdata\u002Fdefinitions\u002F89.html\"],\n  autoFixable: false, cwe: \"CWE-89\", cvss: 9.8, effort: \"easy\"\n};\n```\n\n## CI\u002FCD Integration\n\n### GitHub Actions\n```yaml\nname: AI Code Review\non:\n  pull_request:\n    types: [opened, synchronize, reopened]\n\njobs:\n  ai-review:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - name: Static Analysis\n        run: |\n          sonar-scanner -Dsonar.pullrequest.key=${{ github.event.number }}\n          codeql database create codeql-db --language=javascript,python\n          semgrep scan --config=auto --sarif --output=semgrep.sarif\n\n      - name: AI-Enhanced Review (GPT-5)\n        env:\n          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}\n        run: |\n          python scripts\u002Fai_review.py \\\n            --pr-number ${{ github.event.number }} \\\n            --model gpt-4o \\\n            --static-analysis-results codeql.sarif,semgrep.sarif\n\n      - name: Post Comments\n        uses: actions\u002Fgithub-script@v7\n        with:\n          script: |\n            const comments = JSON.parse(fs.readFileSync('review-comments.json'));\n            for (const comment of comments) {\n              await github.rest.pulls.createReviewComment({\n                owner: context.repo.owner,\n                repo: context.repo.repo,\n                pull_number: context.issue.number,\n                body: comment.body, path: comment.path, line: comment.line\n              });\n            }\n\n      - name: Quality Gate\n        run: |\n          CRITICAL=$(jq '[.[] | select(.severity == \"CRITICAL\")] | length' review-comments.json)\n          if [ $CRITICAL -gt 0 ]; then\n            echo \"❌ Found $CRITICAL critical issues\"\n            exit 1\n          fi\n```\n\n## Complete Example: AI Review Automation\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\nimport os, json, subprocess\nfrom dataclasses import dataclass\nfrom typing import List, Dict, Any\nfrom anthropic import Anthropic\n\n@dataclass\nclass ReviewIssue:\n    file_path: str; line: int; severity: str\n    category: str; title: str; description: str\n    code_example: str = \"\"; auto_fixable: bool = False\n\nclass CodeReviewOrchestrator:\n    def __init__(self, pr_number: int, repo: str):\n        self.pr_number = pr_number; self.repo = repo\n        self.github_token = os.environ['GITHUB_TOKEN']\n        self.anthropic_client = Anthropic(api_key=os.environ['ANTHROPIC_API_KEY'])\n        self.issues: List[ReviewIssue] = []\n\n    def run_static_analysis(self) -> Dict[str, Any]:\n        results = {}\n\n        # SonarQube\n        subprocess.run(['sonar-scanner', f'-Dsonar.projectKey={self.repo}'], check=True)\n\n        # Semgrep\n        semgrep_output = subprocess.check_output(['semgrep', 'scan', '--config=auto', '--json'])\n        results['semgrep'] = json.loads(semgrep_output)\n\n        return results\n\n    def ai_review(self, diff: str, static_results: Dict) -> List[ReviewIssue]:\n        prompt = f\"\"\"Review this PR comprehensively.\n\n**Diff:** {diff[:15000]}\n**Static Analysis:** {json.dumps(static_results, indent=2)[:5000]}\n\nFocus: Security, Performance, Architecture, Bug risks, Maintainability\n\nReturn JSON array:\n[{{\n  \"file_path\": \"src\u002Fauth.py\", \"line\": 42, \"severity\": \"CRITICAL\",\n  \"category\": \"Security\", \"title\": \"Brief summary\",\n  \"description\": \"Detailed explanation\", \"code_example\": \"Fix code\"\n}}]\n\"\"\"\n\n        response = self.anthropic_client.messages.create(\n            model=\"claude-3-5-sonnet-20241022\",\n            max_tokens=8000, temperature=0.2,\n            messages=[{\"role\": \"user\", \"content\": prompt}]\n        )\n\n        content = response.content[0].text\n        if '```json' in content:\n            content = content.split('```json')[1].split('```')[0]\n\n        return [ReviewIssue(**issue) for issue in json.loads(content.strip())]\n\n    def post_review_comments(self, issues: List[ReviewIssue]):\n        summary = \"## ? AI Code Review\\n\\n\"\n        by_severity = {}\n        for issue in issues:\n            by_severity.setdefault(issue.severity, []).append(issue)\n\n        for severity in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']:\n            count = len(by_severity.get(severity, []))\n            if count > 0:\n                summary += f\"- **{severity}**: {count}\\n\"\n\n        critical_count = len(by_severity.get('CRITICAL', []))\n        review_data = {\n            'body': summary,\n            'event': 'REQUEST_CHANGES' if critical_count > 0 else 'COMMENT',\n            'comments': [issue.to_github_comment() for issue in issues]\n        }\n\n        # Post to GitHub API\n        print(f\"✅ Posted review with {len(issues)} comments\")\n\nif __name__ == '__main__':\n    import argparse\n    parser = argparse.ArgumentParser()\n    parser.add_argument('--pr-number', type=int, required=True)\n    parser.add_argument('--repo', required=True)\n    args = parser.parse_args()\n\n    reviewer = CodeReviewOrchestrator(args.pr_number, args.repo)\n    static_results = reviewer.run_static_analysis()\n    diff = reviewer.get_pr_diff()\n    ai_issues = reviewer.ai_review(diff, static_results)\n    reviewer.post_review_comments(ai_issues)\n```\n\n## Summary\n\nComprehensive AI code review combining:\n1. Multi-tool static analysis (SonarQube, CodeQL, Semgrep)\n2. State-of-the-art LLMs (GPT-5, Claude 4.5 Sonnet)\n3. Seamless CI\u002FCD integration (GitHub Actions, GitLab, Azure DevOps)\n4. 30+ language support with language-specific linters\n5. Actionable review comments with severity and fix examples\n6. DORA metrics tracking for review effectiveness\n7. Quality gates preventing low-quality code\n8. Auto-test generation via Qodo\u002FCodiumAI\n\nUse this tool to transform code review from manual process to automated AI-assisted quality assurance catching issues early with instant feedback.\n",{"name":5,"risk":56,"source":40,"description":7},"unknown","master","dff58085da947e81e8418c922055644bf0082b1b","data\u002Fcode-review-ai-ai-review","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills","https:\u002F\u002Fgithub.com\u002Freikiplanet","https:\u002F\u002Fwww.reiki-planet.com","Reiki Planet Game","2026-03-29 06:02:29",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add reikiplanet\u002Fdaoskills --skill code-review-ai-ai-review",{"tool":71,"command":72},"bunx","bunx skills add reikiplanet\u002Fdaoskills --skill code-review-ai-ai-review",{"tool":74,"command":75},"pnpm","pnpm dlx skills add reikiplanet\u002Fdaoskills --skill code-review-ai-ai-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fdata\u002Fcode-review-ai-ai-review\u002FSKILL.md",true,[],[80,106,118,133,153,175],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":51},"01M6G614JTEQJHPT8AKK3YQ18S","web-games","Web browser game development principles. Framework selection, WebGPU, optimization, PWA.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fweb-games\u002FSKILL.md",[],[87,88,89,90,91,92,40,93,94,95,96,97,98,99,100,101,102,103,104,105],"games","web games","web","grep","principles","selection","framework selection","edit","write","read","pwa","game","web browser","game development","Optimization","framework","browser","development","webgpu",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":51},"01M6G611H2YGV0GZFP90D38ZMJ","vr-ar","VR\u002FAR development principles. Comfort, interaction, performance requirements.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fvr-ar\u002FSKILL.md",[],[113,114,104,115,116,40,94,95,96,90,117,91],"ar","vr ar","interaction","requirements","performance",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":51},"01M6G60XNMHAMV1SV0EJ1CX0AY","templates","Project scaffolding templates for new applications. Use when creating new projects from scratch. Contains 12 templates for various tech stacks.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Ftemplates\u002FSKILL.md",[],[120,125,126,127,128,129,40,130,96,131,132,90],"project scaffolding","From Scratch","tech","project","scaffolding","use","projects","applications",{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":139,"publishedAt":51},"01M6G60T0GATMK3Q5H8GDC1Z8S","wcag-audit-patterns","Conduct WCAG 2.2 accessibility audits with automated testing, manual verification, and remediation guidance. Use when auditing websites for accessibility, fixing WCAG violations, or implementing ac...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fwcag-audit-patterns\u002FSKILL.md",[],[140,141,142,143,144,40,145,146,147,148,130,149,150,151,152],"wcag audit patterns","wcag audit","patterns","WCAG","audit","manual","with","automated testing","guidance","remediation","verification","accessibility","testing",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":159,"publishedAt":51},"01M6G60PMCHW1FRZ63F931QK3R","vulnerability-scanner","Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fvulnerability-scanner\u002FSKILL.md",[],[160,161,162,163,164,165,166,167,40,96,90,168,91,43,169,170,171,172,173,174],"scanner","vulnerability scanner","vulnerability","prioritization","2025","mapping","chain","supply chain","Bash","risk","owasp","supply chain security","security","supply","advanced",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":51},"01M6G60JZBB8DK0W3DSG1WNMZK","threat-modeling-expert","Expert in threat modeling methodologies, security architecture review, and risk assessment. Masters STRIDE, PASTA, attack trees, and security requirement extraction. Use for security architecture r...","https:\u002F\u002Fgithub.com\u002Freikiplanet\u002Fdaoskills\u002Fblob\u002Fmaster\u002Fskills\u002Fsecurity\u002Fthreat-modeling-expert\u002FSKILL.md",[],[182,183,184,41,185,186,187,188,172,130,189,190,191,40,192,193,194,169,32,195],"modeling","threat modeling expert","threat modeling","threat","risk assessment","architecture review","architecture","security architecture review","trees","security architecture","security requirement extraction","assessment","extraction","stride"]