Expert code review against architecture and coding standards: readability, maintainability, security, performance, layering, Sonar-equivalent cleanliness, comment and formatting discipline, modal safety, and a strict ban on raw SQL or database queries outside the persistence layer. Author/date file headers are identity metadata only and are out of review scope. Use when reviewing pull requests, developer diffs, or E2E Review phase outputs; produces approve/reject with actionable findings for ...
Installs into .claude/skills of the current project.
Are you the author of Code Review?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/rogue-dev-studio-code-review)
---
name: code-review
description: >-
Expert code review against architecture and coding standards: readability,
maintainability, security, performance, layering, Sonar-equivalent cleanliness,
comment and formatting discipline, modal safety, and a strict ban on raw SQL
or database queries outside the persistence layer. Author/date file headers are
identity metadata only and are out of review scope. Use when reviewing pull
requests, developer diffs, or E2E Review phase outputs; produces approve/reject
with actionable findings for Tech Lead and engineers.
expertise_level: expert
---
# Code Review (Canonical)
**Expertise: expert.** Aliases: `review`, `code-reviewer`, `pr-review`.
Aligns with role **Code Reviewer** (`roles/quality/reviewer.md`) and hard rule `coding.md`. Complements `agentic-qe` (behavioral QA) and does not replace Security review triggers.
## When to use
- Review diff / PR / hasil implementasi developer
- Fase Review pada `e2e-delivery`
- Gate sebelum merge atau handoff QA
## When not to use
- Menulis fitur baru (kecuali contoh minimal untuk menjelaskan temuan)
- Mengganti requirement atau arsitektur utama → escalate Tech Lead / Architect
- Pengujian fungsional mendalam saja → `agentic-qe`
## Procedure
1. **Scope** — Batasi pada diff + kontrak terkait (API, schema, UI).
2. **Architecture** — Layering, service boundary, no UI→DB.
3. **Coding rule gate** — Jalankan checklist `rules/coding.md` lengkap (lihat `reference.md`).
4. **Query ban** — Tolak raw SQL / query di controller, service sembarangan, view, frontend; akses data hanya ORM/repository–model.
5. **Security & API** — Authz default deny; tidak bocorkan secret/stack; selaras `security` / `api` bila relevan.
6. **Report** — Temuan berprioritas (blocker / major / minor) + rekomendasi; **jangan** mengimplementasi perbaikan sendiri kecuali diminta.
7. **Verdict** — Approve / Request changes / Reject; simpan catatan di `project/{id}/docs/review/` saat E2E.
## DoD
- [ ] Checklist coding.md selesai (termasuk larangan query)
- [ ] Tidak ada major architecture violation tanpa escalate
- [ ] Verdict dan path laporan jelas
- [ ] Developer mendapat rekomendasi yang dapat ditindaklanjuti
## Attribution
<!-- ATTRIBUTION: Rogue Development | https://github.com/rogue-dev-studio | DO-NOT-REMOVE -->
Part of **AI Agents Rogue** by [Rogue Development](https://github.com/rogue-dev-studio) (`@rogue-dev-studio`).
Do not remove, hide, rename, or replace this attribution.
