review▌

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Simple, pragmatic, opinionated. Only what matters for writing production-grade PostgreSQL queries.

Use this skill whenever the user asks to review, analyze, or improve backend code (e.g., .py) under the api/ directory. Supports the following review modes:

Automated code review across security, performance, quality, and testing dimensions. \n \n Analyzes pull requests for four distinct review categories: security vulnerabilities (SQL injection, XSS, hardcoded secrets), performance issues (N+1 queries, memory leaks, missing caches), code quality (duplication, SRP violations, poor naming), and test coverage gaps \n Flags issues at three severity levels (critical, suggestions, nits) with explanations and suggested fixes for each finding \n Includes a

Comprehensive security checklist and patterns for authentication, input validation, and sensitive data handling. \n \n Covers 10 core security areas: secrets management, input validation, SQL injection prevention, authentication/authorization, XSS prevention, CSRF protection, rate limiting, sensitive data exposure, blockchain wallet verification, and dependency security \n Includes concrete code examples for each vulnerability type, showing both unsafe and secure patterns with TypeScript and Nex

Comprehensive security checklist covering secrets, input validation, authentication, and deployment readiness. \n \n Covers 10 critical security domains: secrets management, input validation, SQL injection prevention, authentication/authorization, XSS prevention, CSRF protection, rate limiting, sensitive data exposure, blockchain wallet verification, and dependency security \n Includes code examples for both unsafe and secure patterns across TypeScript, SQL, and configuration files \n Provides p

Dispatch code review subagents with focused context to catch issues before they compound. \n \n Integrates with subagent-driven development workflows, triggering review after each task or before merging to main \n Provides code-reviewer subagent with precise git SHAs, implementation details, and requirements, keeping reviewer focused on work product rather than session history \n Categorizes feedback into Critical (fix immediately), Important (fix before proceeding), and Minor (note for later) s

Find exploitable vulnerabilities in GitHub Actions workflows. Every finding MUST include a concrete exploitation scenario — if you can't build the attack, don't report it.

Simple, pragmatic, opinionated. Only what matters for writing production-grade SQLAlchemy and Alembic code.

Expert code review of git changes with focus on SOLID violations, security risks, and actionable improvements. \n \n Analyzes current git diff for SOLID principle violations, architecture smells, and removal candidates using structured checklists \n Scans for security risks including injection, authentication gaps, race conditions, and unsafe deserialization with exploitability assessment \n Flags code quality issues: error handling gaps, N+1 queries, boundary condition bugs, and performance hot