thechandanbhagat/claude-skills/code-review

# Search for SQL injection risks
grep -r "execute.*\+" . --include="*.py" --include="*.js" --include="*.php"
grep -r "query.*\+" . --include="*.py" --include="*.js"
grep -r "SELECT.*%" . --include="*.py"

# Check for unescaped output
grep -r "innerHTML\s*=" . --include="*.js" --include="*.jsx"
grep -r "dangerouslySetInnerHTML" . --include="*.jsx" --include="*.tsx"
grep -r "render_template_string" . --include="*.py"

# Check for command injection
grep -r "exec\|eval\|system\|shell_exec" . --include="*.py" --include="*.js" --include="*.php"
grep -r "os\.system\|subprocess\.call" . --include="*.py"
grep -r "child_process\.exec" . --include="*.js"

# Find potential secrets
grep -r "password\s*=\s*['\"]" . --include="*.py" --include="*.js" --include="*.java"
grep -r "api_key\s*=\s*['\"]" . --include="*.py" --include="*.js"
grep -r "secret\s*=\s*['\"]" . --include="*.py" --include="*.js"
grep -r "Bearer\s\+[A-Za-z0-9]" . --include="*.py" --include="*.js"

# Check for insecure deserialization
grep -r "pickle\.loads\|yaml\.load\|eval\|exec" . --include="*.py"
grep -r "JSON\.parse.*localStorage" . --include="*.js"
grep -r "unserialize" . --include="*.php"

# Find long functions (potential complexity issues)
grep -n "def \|function " . -r --include="*.py" --include="*.js" | while read line; do
    echo "$line"
done
 
# Find files with too many lines
find . -name "*.py" -o -name "*.js" | xargs wc -l | sort -rn | head -20

# Find duplicate code patterns
# God classes (too many methods)
grep -c "def \|function " **/*.py **/*.js
 
# Long parameter lists
grep "def.*,.*,.*,.*,.*," . -r --include="*.py"
grep "function.*,.*,.*,.*,.*," . -r --include="*.js"
 
# Magic numbers
grep -r "\s[0-9]\{3,\}" . --include="*.py" --include="*.js" | grep -v "test"

# Check naming conventions
# Python: snake_case for functions
grep "def [A-Z]" . -r --include="*.py"
 
# JavaScript: camelCase for functions
grep "function [a-z_]" . -r --include="*.js"
 
# Constants should be UPPER_CASE
grep "const [a-z]" . -r --include="*.js" --include="*.ts"

# Find bare except clauses (Python)
grep -r "except:" . --include="*.py"
 
# Find empty catch blocks (JavaScript)
grep -A2 "catch\s*(" . -r --include="*.js" | grep -A1 "{\s*}"
 
# Find TODO/FIXME comments
grep -r "TODO\|FIXME\|HACK\|XXX" . --include="*.py" --include="*.js" --include="*.java"

# Find files opened without 'with' statement (Python)
grep -r "open(" . --include="*.py" | grep -v "with"
 
# Find potential memory leaks
grep -r "addEventListener" . --include="*.js" | grep -v "removeEventListener"

# Find functions without docstrings (Python)
grep -B1 "def " . -r --include="*.py" | grep -v '"""' | grep -v "'''" | grep -v "#"
 
# Find exported functions without JSDoc (JavaScript)
grep "export function" . -r --include="*.js" | grep -B3 -v "/\*\*"

# Find potential N+1 queries
grep -r "for.*in\|forEach" . --include="*.py" --include="*.js" -A5 | grep "query\|find\|get"

# Nested loops (potential O(n²))
grep -r "for.*in" . --include="*.py" --include="*.js" -A3 | grep "for.*in"
 
# Multiple database calls in loops
grep -r "for\|while" . --include="*.py" --include="*.js" -A5 | grep "query\|execute\|find"

# Check for files read entirely into memory
grep -r "read()\|readlines()\|readFile" . --include="*.py" --include="*.js"

# Check for outdated npm packages
npm outdated
 
# Check for Python package updates
pip list --outdated
 
# Security vulnerabilities
npm audit
pip-audit

# Python unused imports
grep -r "^import\|^from" . --include="*.py" | cut -d: -f2 | sort | uniq
 
# JavaScript unused imports
grep -r "^import" . --include="*.js" --include="*.jsx" | cut -d: -f2 | sort | uniq

# Find source files without corresponding test files
for file in src/**/*.py; do
    testfile="tests/test_$(basename $file)"
    [ ! -f "$testfile" ] && echo "Missing test: $testfile for $file"
done
 
# Find functions without tests
grep "def test_" tests/ -r | cut -d: -f2 | sort

# Find tests without assertions
grep -r "def test_" . --include="test_*.py" -A10 | grep -v "assert"
 
# Find disabled tests
grep -r "@skip\|@unittest.skip\|test.skip" . --include="*.py" --include="*.js"

# Linting
pylint src/
flake8 src/
black --check src/
 
# Security
bandit -r src/
safety check
 
# Complexity
radon cc src/ -a
radon mi src/

# Linting
eslint .
prettier --check .
 
# Security
npm audit
snyk test
 
# Complexity
npx complexity-report src/

# Python
mypy src/
 
# TypeScript
tsc --noEmit
 
# JavaScript (with JSDoc)
npx typescript --allowJs --checkJs --noEmit src/**/*.js

# Code Review Report
 
## Summary
-Files reviewed: X
-Critical issues: X
-Warnings: X
-Suggestions: X
 
## Critical Issues
1.[File:Line] Security: SQL Injection risk in user input
2.[File:Line] Security: Hardcoded API key
 
## Warnings
1.[File:Line] Performance: N+1 query in loop
2.[File:Line] Code Quality: Function too complex (CC: 15)
 
## Suggestions
1.[File:Line] Consider extracting method for better readability
2.[File:Line] Add error handling for edge case
 
## Positive Observations
-Good test coverage
-Well-documented functions
-Proper error handling

# Check for mutable default arguments
grep "def.*=\[\]" . -r --include="*.py"
grep "def.*={}" . -r --include="*.py"
 
# Check for string concatenation in loops
grep -A5 "for.*in" . -r --include="*.py" | grep "+="

# Check for var instead of let/const
grep "\svar\s" . -r --include="*.js"
 
# Check for == instead of ===
grep "==\|!=" . -r --include="*.js" | grep -v "===" | grep -v "!=="
 
# Check for missing 'use strict'
head -5 src/**/*.js | grep -L "use strict"