review-code-prompt

A prompt for a thorough code review of a diff or pull request covering bugs, security, edge cases, performance and readability, with findings ranked by severity and concrete fixes. Use when the user wants code reviewed, a PR checked, a second opinion on changes, or to find bugs before merging.

Version 1.0 · Updated 2026-10-31

View raw SKILL.md

Install in Claude Code, Cursor or Codex (optional)

Only for AI coding tools that read skill folders. Run one line in a terminal, in your project folder. It downloads this skill's text files from TheSkillVault and nothing else; you can read them first with “View raw SKILL.md”.

Claude Code (all your projects)

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-code-prompt/raw' -o ~/'.claude/skills/review-code-prompt/SKILL.md'

Cursor (this project)

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-code-prompt/raw' -o '.cursor/skills/review-code-prompt/SKILL.md'

Codex and other Agent Skills tools (this project)

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-code-prompt/raw' -o '.agents/skills/review-code-prompt/SKILL.md'

Or connect the whole library over MCP

Add TheSkillVault to Cursor or add this to your app's MCP settings (read-only; help):

{
  "mcpServers": {
    "theskillvault": {
      "url": "https://theskillvault.ai/mcp"
    }
  }
}

Review code (prompt)

When to use

Before merging AI-written or human-written changes.

Prompt

Act as a strict senior engineer reviewing this change. Context: {{WHAT THE CHANGE IS FOR}}.

Review the diff below. Report findings as a table: severity (blocker/major/minor/nit), file:line, problem, suggested fix.
Check in this order:
1. Correctness: logic errors, off-by-one, null/undefined, async/await mistakes, race conditions.
2. Security: injection, missing auth checks, secrets in code, unsafe input handling, XSS.
3. Edge cases: empty, large, unicode, concurrent, network failure.
4. Tests: what is untested; propose the 3 most valuable tests.
5. Performance: N+1 queries, needless re-renders, unbounded loops.
6. Readability: naming, dead code, duplication.
Do not restate the code. If it is good, say so briefly. End with "merge / merge after fixes / do not merge".

{{DIFF}}

How to adapt

Get the diff with git diff main...HEAD or paste the PR URL into a tool that can read it.
For a security-only pass, keep step 2 and add "assume a hostile user".

Example prompt

"Can you check my PR for bugs before I merge it?"

Licence: CC BY 4.0. Attribution when you reuse it: From TheSkillVault, https://theskillvault.ai, CC BY 4.0