Code Review Standards

Purpose

This skill defines the structured, severity-tagged checklist the code-critic agent applies when reviewing an implementation. Severity tagging makes review deterministic across dispatches: PM and engineer both know exactly which findings block delivery and which are advisory. Engineers may load it for self-review before requesting a critic pass.

The Severity-Tagged Checklist

CRITICAL (must fix — blocks delivery)

• No secrets, API keys, or credentials hardcoded
• No injection vectors (parameterized queries only; no unsafe shell/template interpolation)
• No arbitrary code execution paths (eval, exec, unrestricted deserialization)
• Authentication/authorization not bypassable
• No data-loss or silent-corruption paths