Seven-Dimension Code Review

What It Solves

Code review is critical for software quality, but two common pitfalls undermine its effectiveness. First, reviewers often mix diagnosis with remediation—"making quick fixes" during review—which blurs problem tracking and can introduce new bugs. Second, with the rise of AI-assisted coding, generated code might "look correct" but harbor issues unique to AI, such as hallucinated API calls or silent degradations. Traditional checklists often miss these dimensions.

The code-review skill is a read-only, structured AI coding agent designed to address these challenges. Its core value lies in enforcing a strict separation between audit and remediation, while introducing unique inspection dimensions tailored for AI-generated code.

How It Works

Core Principle: Audit-Remediation Separation

This is the skill's iron rule. When triggered by commands like review/check/diagnose, it enters a read-only mode. It performs a comprehensive audit and outputs a structured issue list, then stops. It never附带任何代码修改 (appends any code fixes) during the review. The decision to fix rests entirely with the user. Each item in the issue list strictly follows a five-field format: Location (file:line_number), Root Cause, Impact, Dimension + Severity, and Remediation Direction (a one-line suggestion, not an implementation).

Key Steps: From Environment Probing to Seven-Dimension Review

Before auditing, the skill conducts environment probing: determining if the target is a single file, directory, or git diff; forcibly reading the entire target file for context; performing project-wide searches for suspected dead code; and recording runtime environment versions (OS, language, dependencies). This ensures accurate conclusions and avoids fragmented analysis.

The review itself is guided by its core Seven-Dimension Checklist, covering traditional bugs to AI-specific issues:
- ① Correctness Bugs: Tests edge cases (empty集合/None/单元素/0/极值/NaN/跨日/停牌) and cross-environment traps (paths, encoding, timezones).
- ② AI-Specific: Hallucinations & Silent Degradations: Validates API signatures against official docs, hunts for except: pass error-swallowing code, and requires quality flags for any degradation.
- ③ Performance & Resources: Identifies inefficient loops, resource leaks, uncached computations, and unguarded external calls.
- ④ Redundancy & Consistency: Finds dead code (verified via project-wide grep), debug leftovers, duplicate logic (following the rule of three), and orphaned variables.
- ⑤ Security & Leaks: Scans for hardcoded secrets, SQL injection, and sensitive info in logs.
- ⑥ Product & Over-Engineering: Assesses if functionality is unnecessary or over-abstracted, and suggests simplifications.
- ⑦ Verifiability & Rollback: Ensures changes have a baseline and critical paths have test coverage.

The entire process adheres to a strict evidence discipline: Conclusions must be based on actual verification (e.g., running code, checking official docs). When verification isn't directly possible, it only flags a "most likely cause + verification action needed." For performance advice, without before/after profiling data, it only states "expected" improvement, never "will be faster."

Boundaries and Caveats

This skill is an audit specialist, not a remediation executor. Its capability boundaries are clear:
- Audit Only, No Fixing: If a user requests fixes after reviewing the list, it must hand off to a normal coding workflow.
- No Performance Tuning Implementation: It only reports performance issues and their required baselines.
- No Professional Penetration Testing: It only scans for common leak patterns.

When using it, note that for large repositories, you should layer analysis by import dependencies, reviewing one module at a time. For AI code that "looks correct," always verify via documentation or local testing. If unsure whether an issue is stylistic or substantive, apply the "deletion test"—if removing the code has no visible effect, it's low-priority or should not be reported.