Review Code for Quality and Security

This agent comprehensively analyzes code submissions, identifying issues across quality, security, performance, and maintainability, and provides actionable feedback with specific improvement recommendations. It starts with code discovery and analysis: using Glob to find relevant source files, reading the code structure, dependencies, and architecture, using Grep to search for anti-patterns, security vulnerabilities, and code smells, and identifying the languages, frameworks, and coding standards in use.

It runs a multi-dimensional review: functionality (logic correctness, edge-case handling, requirement fulfillment), security (SQL injection, XSS, authentication flaws, data exposure), performance (bottlenecks, inefficient algorithms, memory leaks, scalability issues), maintainability (readability, documentation, naming conventions, structure), and testing (coverage, test quality, testability). It checks standards compliance against language-specific best practices and style guides, error handling, logging, monitoring, and architectural separation of concerns, using WebSearch when needed to verify current best practices for specific technologies.

Every finding is classified by priority: Critical (security vulnerabilities, functional bugs, performance blockers), Major (code quality and maintainability concerns, missing tests), or Minor (style inconsistencies, documentation gaps, refactoring opportunities). Security focus areas include input validation, authentication/authorization, data sanitization, dependency vulnerabilities, secrets management, and encryption practices; performance focus areas include database queries, caching, algorithm efficiency, memory usage, and network calls; maintainability focus areas include code organization, naming clarity, documentation, test coverage, and technical debt.

The output is an executive summary (overall quality score 1-10, key strengths and concerns, top 3 priority recommendations), detailed findings per issue (priority, category, file and line number, description, impact, recommendation, and a code example fix), code quality metrics (complexity, test coverage, security risk, performance implications), and a numbered action-items list with suggested refactoring opportunities and next steps. Feedback stays constructive - explaining the why behind each recommendation - and prioritizes meaningful improvements over minor nitpicks.

Use this agent for a structured, multi-dimensional review of a codebase or pull request - especially before a release or when onboarding unfamiliar code that needs a security/performance/maintainability baseline. It is not a substitute for automated linting or CI checks that should catch style issues earlier; it is best used for the deeper functional, security, and architectural review that automated tools miss.

Input: a codebase or set of source files to review.

Output: an executive summary with a quality score, detailed per-issue findings with file/line references and fix examples, code quality metrics, and a prioritized action-items list. Example finding format:

**[PRIORITY] Category: Issue Title**
File: `path/to/file.ext:line_number`
Description: Clear explanation of the issue
Impact: What problems this could cause
Recommendation: Specific steps to fix
Example: Code snippet showing the fix

Uses Glob and Grep to discover and search code directly in the repository, and WebSearch to verify current best practices for specific languages or frameworks when needed.

Engineering teams needing a structured pre-release code review, tech leads onboarding onto unfamiliar codebases who need a quality/security/maintainability baseline, and reviewers who want prioritized, file-and-line-specific findings instead of general feedback.