Deeply Analyze Code Logic and Security

Logic Lens is a Claude Code skill that performs deep, logic-driven code review using formal reasoning frameworks, distinct from linters that only check syntax and style. It analyzes code for logical errors, race conditions, security vulnerabilities, type mismatches, and algorithmic flaws that only surface when reasoning through the code's actual behavior, applying systematic checks across 9 risk categories.

Use it for a thorough logic review before merging a PR, when a bug is hard to find and standard linters aren't helping, when reviewing security-sensitive code paths like auth, payments, or file access, when refactoring complex business logic, or when onboarding to a new codebase and needing to understand its risk areas. It is explicitly meant to complement, not replace, human review and environment-specific testing or security audits for production-critical decisions.

Install via the Claude Code plugin marketplace (search "logic-lens" under Extensions) or via NPX:

npx agentic-awesome-skills --claude

then invoke it with @logic-lens. Internally it parses code structure and builds a mental model of data flow, applies formal logic checks across the 9 risk categories, traces execution paths for edge cases and boundary conditions, identifies security anti-patterns such as injection, privilege escalation, and data leakage, and reports findings with severity levels (CRITICAL, HIGH, MEDIUM, LOW) and actionable fix suggestions. Example invocations include reviewing a single file for security issues, scanning an entire repository and prioritizing findings by severity, or reviewing every file changed in a branch before opening a PR.

The 9 risk categories are Null/Undefined (missing null checks, optional chaining gaps), Type Safety (implicit coercions, any-typed boundaries), Concurrency (race conditions, shared mutable state), Resource Management (unclosed handles, memory leaks), Security Injection (SQL/XSS/command injection, path traversal), Boundary Conditions (off-by-one errors, integer overflow), Algorithm Correctness (wrong complexity, incorrect assumptions), State Management (inconsistent state, missing rollbacks), and API Contracts (undocumented side effects, broken interfaces). It pairs with @lint-and-validate for combined style-plus-logic coverage, @security-auditor for a specialized security-only deep scan, and @debugging-strategies for tracing findings further. In testing against real-world codebases it caught issues invisible to ESLint, TypeScript strict mode, and Snyk, including 47% of critical bugs that linters missed and race conditions in async code that static analysis missed.

Developers who want a pre-merge or pre-release logic review of security-sensitive or complex code, especially authentication and payment paths, and teams onboarding into an unfamiliar codebase who need to quickly understand where its riskiest logic lives.