Code Review

SkillSecurity

Review code for quality, security, performance, and maintainability. Use when reviewing PRs, auditing a codebase, or refactoring. Covers TypeScript, Node.js, infrastructure-as-code, and full-stack web apps.

Available today. Use it from your connected AI after setup.

Connect ahel once, and every AI you use reads what you have installed.

Then ask your AI: use the Code Review skill

What this skill tells your AI

The instructions your AI receives, as published by espennilsen/pi in skills/code-review/SKILL.md and read by ahel’s review.

Systematic code review for Espen's TypeScript/Node.js projects.

Process

  1. Understand scope — Read the changed files or the area under review:

    # For git changes
    git diff --name-only HEAD~1
    git diff HEAD~1
    
    # For a specific area
    find src/ -name "*.ts" -newer <reference-file>
    
  2. Read the code — Use the read tool on each file. Don't guess.

  3. Analyze against checklist — Score each category.

  4. Report — Use the output format below.

Review Checklist

Correctness

  • Logic handles edge cases (null, empty, boundary values)
  • Error handling is explicit (no swallowed errors, no bare catch {})
  • Async code handles rejection/cancellation properly
  • Types are accurate (no unnecessary any, proper narrowing)

Security

  • No secrets or credentials in code
  • User input is validated/sanitized before use
  • SQL queries use parameterized statements (no string interpolation)
  • File paths are resolved safely (no path traversal)
  • Auth checks are present where needed

Performance

  • No N+1 queries or unbounded loops over large datasets
  • Heavy operations are async or streamed (not blocking)
  • Database queries use appropriate indexes
  • Large responses are paginated or truncated

Maintainability

  • Functions do one thing with clear names
  • No magic numbers or hardcoded values that should be config
  • Types and interfaces are defined (not inline object shapes)
  • Dead code and unused imports are removed
  • Comments explain why, not what

Project Conventions

  • Follows existing patterns in the codebase
  • File naming and directory structure is consistent
  • Error messages are helpful for debugging
  • Logging is appropriate (not too noisy, not silent on errors)

Output Format

## Code Review: [scope]

### Summary
One paragraph: what the code does, overall quality assessment.

### Issues

#### 🔴 Critical
- [file:line] Description and fix

#### 🟡 Important
- [file:line] Description and suggestion

#### 🔵 Minor
- [file:line] Nit or style suggestion

### What's Good
- Call out well-written code, good patterns, clever solutions

### Recommendations
- Prioritized list of changes, starting with most impactful

Common Patterns in Espen's Stack

Project TypeKey Things to Check
Pi extensionsTool parameter schemas, error returns, signal/abort handling
Eleventy sitesTemplate data flow, permalink structure, Tailwind purge config
TanStack appsRouter setup, query keys, optimistic updates, Clerk auth guards
InfrastructureTerraform state safety, Docker layer caching, env var handling
SQLiteMigration ordering, prepared statements, WAL mode, index coverage

Signals

GitHub stars
118
Forks
13
Last commit
Sep 2026
Advanced
Catalog kind
skill
Gateway key
code-review-espennilsen
Source
github.com/espennilsen/pi