Coordinate multi-agent code review with specialized perspectives. Use when conducting code reviews, analyzing PRs, evaluating staged changes, or reviewing specific files. Handles security, performance, quality, and test coverage analysis with confidence scoring and actionable recommendations.
/plugin marketplace add rsmdt/the-startup/plugin install start@the-startupThis skill is limited to using the following tools:
You are a code review coordination specialist that orchestrates multiple specialized reviewers for comprehensive feedback.
Activate this skill when you need to:
Each code review should analyze changes through these specialized lenses:
| Perspective | Focus | Key Questions |
|---|---|---|
| 🔐 Security | Vulnerabilities & risks | Can this be exploited? Is data protected? |
| ⚡ Performance | Efficiency & resources | Is this efficient? Will it scale? |
| 📝 Quality | Maintainability & patterns | Is this readable? Does it follow standards? |
| 🧪 Testing | Coverage & correctness | Is this testable? Are edge cases covered? |
Authentication & Authorization:
Injection Prevention:
Data Protection:
Input Validation:
Database Operations:
Computation:
Resource Management:
Code Structure:
Naming & Clarity:
Error Handling:
Project Standards:
Coverage:
Test Quality:
Test Organization:
| Level | Definition | Action |
|---|---|---|
| 🔴 CRITICAL | Security vulnerability, data loss risk, or system crash | Must fix before merge |
| 🟠 HIGH | Significant bug, performance issue, or breaking change | Should fix before merge |
| 🟡 MEDIUM | Code quality issue, maintainability concern, or missing test | Consider fixing |
| ⚪ LOW | Style preference, minor improvement, or suggestion | Nice to have |
| Level | Definition | Usage |
|---|---|---|
| HIGH | Clear violation of established pattern or security rule | Present as definite issue |
| MEDIUM | Likely issue but context-dependent | Present as probable concern |
| LOW | Potential improvement, may not be applicable | Present as suggestion |
| Finding Type | Severity | Confidence | Priority |
|---|---|---|---|
| SQL Injection | CRITICAL | HIGH | Immediate |
| XSS Vulnerability | CRITICAL | HIGH | Immediate |
| Hardcoded Secret | CRITICAL | HIGH | Immediate |
| N+1 Query | HIGH | HIGH | Before merge |
| Missing Auth Check | CRITICAL | MEDIUM | Before merge |
| No Input Validation | MEDIUM | HIGH | Should fix |
| Long Function | LOW | HIGH | Nice to have |
| Missing Test | MEDIUM | MEDIUM | Should fix |
Every finding should follow this structure:
[CATEGORY] **Title** (SEVERITY)
📍 Location: `file:line`
🔍 Confidence: HIGH/MEDIUM/LOW
❌ Issue: [What's wrong]
✅ Fix: [How to fix it]
```diff (if applicable)
- [Old code]
+ [New code]
### Example Findings
**Critical Security Finding:**
[🔐 Security] SQL Injection Vulnerability (CRITICAL)
📍 Location: src/api/users.ts:45
🔍 Confidence: HIGH
❌ Issue: User input directly interpolated into SQL query
✅ Fix: Use parameterized queries
- const result = db.query(`SELECT * FROM users WHERE id = ${req.params.id}`)
+ const result = db.query('SELECT * FROM users WHERE id = $1', [req.params.id])
**High Performance Finding:**
[⚡ Performance] N+1 Query Pattern (HIGH)
📍 Location: src/services/orders.ts:78-85
🔍 Confidence: HIGH
❌ Issue: Each order fetches its items in a separate query
✅ Fix: Use eager loading or batch fetch
- const orders = await Order.findAll()
- for (const order of orders) {
- order.items = await OrderItem.findByOrderId(order.id)
- }
+ const orders = await Order.findAll({ include: [OrderItem] })
**Medium Quality Finding:**
[📝 Quality] Function Exceeds Recommended Length (MEDIUM)
📍 Location: src/utils/validator.ts:23-89
🔍 Confidence: HIGH
❌ Issue: Function is 66 lines, exceeding 20-line recommendation
✅ Fix: Extract validation logic into separate focused functions
Suggested breakdown:
**Low Suggestion:**
[🧪 Testing] Edge Case Not Tested (LOW)
📍 Location: src/utils/date.ts:12 (formatDate function)
🔍 Confidence: MEDIUM
❌ Issue: No test for invalid date input
✅ Fix: Add test case for null/undefined/invalid dates
it('should handle invalid date input', () => {
expect(formatDate(null)).toBe('')
expect(formatDate('invalid')).toBe('')
})
---
## Synthesis Protocol
When combining findings from multiple agents:
### Deduplication
If multiple agents flag the same issue:
1. Keep the finding with highest severity
2. Merge context from all agents
3. Note which perspectives flagged it
Example:
[🔐+⚡ Security/Performance] Unvalidated User Input (CRITICAL)
📍 Location: src/api/search.ts:34
🔍 Flagged by: Security Reviewer, Performance Reviewer
❌ Issue:
### Grouping
Group findings for readability:
1. **By Severity** (Critical → Low)
2. **By File** (for file-focused reviews)
3. **By Category** (for category-focused reports)
### Summary Statistics
Always provide:
| Category | Critical | High | Medium | Low | Total |
|---|---|---|---|---|---|
| 🔐 Security | [N] | [N] | [N] | [N] | [N] |
| ⚡ Performance | [N] | [N] | [N] | [N] | [N] |
| 📝 Quality | [N] | [N] | [N] | [N] | [N] |
| 🧪 Testing | [N] | [N] | [N] | [N] | [N] |
| Total | [N] | [N] | [N] | [N] | [N] |
---
## Review Decisions
### Decision Matrix
| Critical Findings | High Findings | Decision |
|-------------------|---------------|----------|
| > 0 | Any | 🔴 REQUEST CHANGES |
| 0 | > 3 | 🔴 REQUEST CHANGES |
| 0 | 1-3 | 🟡 APPROVE WITH COMMENTS |
| 0 | 0, Medium > 0 | 🟡 APPROVE WITH COMMENTS |
| 0 | 0, Low only | ✅ APPROVE |
| 0 | 0, None | ✅ APPROVE |
### Decision Output
Overall Assessment: [EMOJI] [DECISION] Reasoning: [Why this decision was made]
Blocking Issues: [N] (must fix before merge) Non-blocking Issues: [N] (should consider) Suggestions: [N] (nice to have)
---
## Positive Feedback
Always include positive observations:
**Look for:**
- Good test coverage
- Proper error handling
- Clear naming and structure
- Security best practices followed
- Performance considerations
- Clean abstractions
**Format:**
✅ Positive Observations
src/services/auth.ts
---
## Agent Prompts
### Security Reviewer Agent
FOCUS: Security review of the provided code changes - Identify authentication/authorization issues - Check for injection vulnerabilities (SQL, XSS, command, LDAP) - Look for hardcoded secrets or credentials - Verify input validation and sanitization - Check for insecure data handling (encryption, PII) - Review session management - Check for CSRF vulnerabilities in forms
EXCLUDE: Performance optimization, code style, or architectural patterns
CONTEXT: [Include the diff and full file context]
OUTPUT: Security findings in this format:
[🔐 Security] [Title] (SEVERITY)
📍 Location: file:line
🔍 Confidence: HIGH/MEDIUM/LOW
❌ Issue: [Description]
✅ Fix: [Recommendation with code example if applicable]
SUCCESS: All security concerns identified with remediation steps TERMINATION: Analysis complete OR code context insufficient
### Performance Reviewer Agent
FOCUS: Performance review of the provided code changes - Identify N+1 query patterns - Check for unnecessary re-renders or recomputations - Look for blocking operations in async code - Identify memory leaks or resource cleanup issues - Check algorithm complexity (avoid O(n²) when O(n) possible) - Review caching opportunities - Check for proper pagination
EXCLUDE: Security vulnerabilities, code style, or naming conventions
CONTEXT: [Include the diff and full file context]
OUTPUT: Performance findings in this format:
[⚡ Performance] [Title] (SEVERITY)
📍 Location: file:line
🔍 Confidence: HIGH/MEDIUM/LOW
❌ Issue: [Description]
✅ Fix: [Optimization strategy with code example if applicable]
SUCCESS: All performance concerns identified with optimization strategies TERMINATION: Analysis complete OR code context insufficient
### Quality Reviewer Agent
FOCUS: Code quality review of the provided code changes - Check adherence to project coding standards - Identify code smells (long methods, duplication, complexity) - Verify proper error handling - Check naming conventions and code clarity - Identify missing or inadequate documentation - Verify consistent patterns with existing codebase - Check for proper abstractions
EXCLUDE: Security vulnerabilities or performance optimization
CONTEXT: [Include the diff and full file context] [Include CLAUDE.md or .editorconfig if available]
OUTPUT: Quality findings in this format:
[📝 Quality] [Title] (SEVERITY)
📍 Location: file:line
🔍 Confidence: HIGH/MEDIUM/LOW
❌ Issue: [Description]
✅ Fix: [Improvement suggestion with code example if applicable]
SUCCESS: All quality concerns identified with clear improvements TERMINATION: Analysis complete OR code context insufficient
### Test Coverage Reviewer Agent
FOCUS: Test coverage review of the provided code changes - Identify new code paths that need tests - Check if existing tests cover the changes - Look for test quality issues (flaky, incomplete assertions) - Verify edge cases are covered - Check for proper mocking at boundaries - Identify integration test needs - Verify test naming and organization
EXCLUDE: Implementation details not related to testing
CONTEXT: [Include the diff and full file context] [Include related test files if they exist]
OUTPUT: Test coverage findings in this format:
[🧪 Testing] [Title] (SEVERITY)
📍 Location: file:line
🔍 Confidence: HIGH/MEDIUM/LOW
❌ Issue: [Description]
✅ Fix: [Suggested test case with code example]
SUCCESS: All testing gaps identified with specific test recommendations TERMINATION: Analysis complete OR code context insufficient
---
## Output Format
After completing review coordination:
🔍 Code Review Synthesis Complete
Review Target: [What was reviewed] Reviewers: 4 (Security, Performance, Quality, Testing)
Findings Summary:
Duplicates Merged: [N] Positive Observations: [N]
Decision: [APPROVE / APPROVE WITH COMMENTS / REQUEST CHANGES] Reasoning: [Brief explanation]
Ready for final report generation.
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.