Use when completing tasks, implementing major features, or before merging to verify work meets requirements
git clone https://github.com/obra/superpowers.git--- name: requesting-code-review description: Use when completing tasks, implementing major features, or before merging to verify work meets requirements --- # Requesting Code Review Dispatch a code reviewer subagent to catch issues before they cascade. The reviewer gets precisely crafted context for evaluation — never your session's history. **Core principle:** Review early, review often. ## When to Request Review **Mandatory:** - After each task in subagent-driven development - After completing major feature - Before merge to main **Optional but valuable:** - When stuck (fresh perspective) - Before refactoring (baseline check) - After fixing complex bug ## How to Request **1. Get git SHAs:** ```bash BASE_SHA=$(git rev-parse HEAD~1) # or origin/main HEAD_SHA=$(git rev-parse HEAD) ``` **2. Dispatch code reviewer subagent:** Dispatch a `general-purpose` subagent, filling the template at [code-reviewer.md](code-reviewer.md) **Placeholders:** - `{DESCRIPTION}` - Brief summary of what you built - `{PLAN_OR_REQUIREMENTS}` - What it should do - `{BASE_SHA}` - Starting commit - `{HEAD_SHA}` - Ending commit **3. Act on feedback:** - Fix Critical issues immediately - Fix Important issues before proceeding - Note Minor issues for later - Push back if reviewer is wrong (with reasoning) ## Example ``` [Just completed Task 2: Add verification function] You: Let me request code review before proceeding. BASE_SHA=$(git log --oneline | grep "Task 1" | head -1 | awk '{print $1}') HEAD_SHA=$(git rev-parse HEAD) [Dispatch code reviewer subagent] DESCRIPTION: Added verifyIndex() and repairIndex() with 4 issue types PLAN_OR_REQUIREMENTS: Task 2 from docs/superpowers/plans/deployment-plan.md BASE_SHA: a7981ec HEAD_SHA: 3df7661 [Subagent returns]: Strengths: Clean architecture, real tests Issues: Important: Missing progress indicators Minor: Magic number (100) for reporting interval Assessment: Ready to proceed You: [Fix progress indicators] [Continue to Task 3] ``` ## Common Rationalizations | Excuse | Reality | |--------|---------| | "I'll just review the diff myself instead of dispatching a reviewer" | You're the coordinator — reviewing the diff inline burns the context window you need to keep driving the work. Dispatch a reviewer subagent: the diff and the evaluation live in its context, and only the findings come back to you. | | "The reviewer needs my whole session history to understand the change" | Hand it precisely crafted context, never your session's history. That keeps the reviewer on the work product, not your thought process. | ## Red Flags **Never:** - Skip review because "it's simple" - Ignore Critical issues - Proceed with unfixed Important issues - Argue with valid technical feedback **If reviewer wrong:** - Push back with technical reasoning - Show code/tests that prove it works - Request clarification See template at: [code-reviewer.md](code-reviewer.md)
1. **Prepare the code**: Paste the changes into your code review tool (e.g., GitHub PR, GitLab MR, or local diff) and ensure it’s complete (no partial commits). 2. **Specify context**: Fill in [LANGUAGE], [REPOSITORY_NAME], [PROJECT_STYLE_GUIDE], and [CODE] in the prompt. For large changes, break them into logical chunks (e.g., backend vs. frontend). 3. **Prioritize focus areas**: Add details like [SPECIFIC_FUNCTIONS] (e.g., `auth_controller.py`) or [SCALE] (e.g., "handling 10K concurrent users") to guide the review. 4. **Iterate**: Use the AI’s feedback to update the code, then re-run the review with the revised changes. For complex issues, ask the AI to suggest unit tests or refactorings. 5. **Final check**: Before merging, verify all critical issues are resolved and tests pass. Tip: Use the AI’s feedback to update your PR description (e.g., "Fixed SQL injection in refresh token update #123").
No install command available. Check the GitHub repository for manual installation instructions.
git clone https://github.com/obra/superpowers/tree/main/skills/requesting-code-reviewCopy the install command above and run it in your terminal.
Launch Claude Code, Cursor, or your preferred AI coding agent.
Use the prompt template or examples below to test the skill.
Adapt the skill to your specific use case and workflow.
Perform a code review for the following [LANGUAGE] code changes in [REPOSITORY_NAME]. Focus on: 1) Adherence to [PROJECT_STYLE_GUIDE] (e.g., PEP8, Google Style), 2) Potential bugs or edge cases in [SPECIFIC_FUNCTIONS/CLASSES], 3) Performance implications for [SCALE/USAGE_SCENARIO], 4) Security vulnerabilities (e.g., SQL injection, auth bypass), and 5) Test coverage gaps. Provide actionable feedback with code snippets showing fixes where applicable. Changes to review: ```[CODE]```
Here’s a code review for a Python feature that adds user authentication via JWT tokens in a Flask API. The changes introduce a new `/login` endpoint and modify the `User` model to store refresh tokens.
**Strengths:**
- The JWT implementation uses the `PyJWT` library with a 15-minute expiry for access tokens, which aligns with security best practices.
- Refresh token rotation is implemented correctly (old token invalidated on new login).
- Input validation for email/password is thorough, using Flask-WTF’s validators.
**Critical Issues:**
1. **SQL Injection Risk**: The `User.query.filter_by(email=email).first()` query is safe, but the `refresh_token` update uses string concatenation:
```python
# UNSAFE
query = f"UPDATE users SET refresh_token='{refresh_token}' WHERE id={user.id}"
```
**Fix**: Use parameterized queries:
```python
db.session.execute(
update(User).where(User.id == user.id).values(refresh_token=refresh_token)
)
```
2. **Missing Rate Limiting**: The `/login` endpoint lacks rate limiting, making it vulnerable to brute-force attacks. **Fix**: Add Flask-Limiter:
```python
from flask_limiter import Limiter
limiter = Limiter(app, key_func=get_remote_address)
@app.route('/login', methods=['POST'])
@limiter.limit("5 per minute")
```
3. **Insufficient Test Coverage**: Only the happy path is tested. Add tests for:
- Invalid credentials (401 response)
- Expired refresh tokens (403 response)
- Concurrent refresh token requests (should invalidate old token)
**Recommendations:**
- Add logging for failed login attempts (e.g., `logging.warning(f"Failed login for {email}")`).
- Consider using `itsdangerous` for token generation instead of PyJWT if the project avoids external dependencies.
- Document the refresh token rotation behavior in the API spec.
**Score**: 6/10 (Fix critical issues before merging).skills-collection
Take a free 3-minute scan and get personalized AI skill recommendations.
Take free scan