Local Diff Code Review

This skill reviews your local git changes (staged or unstaged) with project-aware analysis. It gathers project context - lint rules, conventions, framework patterns - then produces structured [MAJOR] / [MINOR] findings you can work through interactively.

---

When to use this skill

Trigger this skill when the user:

• Asks to review their local changes, staged changes, or unstaged changes
• Says "review my diff", "check my code", "code review before commit"
• Wants a quality check on what they're about to commit or push
• Asks "what's wrong with my changes" or "anything I should fix before committing"

Do NOT trigger this skill for:

• Reviewing remote PRs or GitHub links (use a PR review tool instead)
• Writing or refactoring code from scratch
• Architecture discussions not tied to a specific set of changes
• General code quality advice without a concrete diff to review

---

Key principles

1. Review the code, not the person - Findings are about the change, not the author. Frame issues as observations, not judgments.

2. Prioritize by impact - Security > Correctness > Performance > Design > Readability > Convention. Spend most analysis time at the top of this list.

3. Two-tier severity - Every finding is either [MAJOR] (must fix) or [MINOR] (consider fixing). No ambiguity, no middle ground.

4. Respect project conventions - Read configs and surrounding code before judging. What looks wrong in isolation may be the project's established pattern.

5. Present, don't preach - Structured findings with file locations and suggested fixes. Not essays about best practices.

---

[MAJOR] vs [MINOR] definitions

Severity	Criteria	Examples
[MAJOR]	Must be fixed. Would block a PR in a professional code review.	Bugs, security vulnerabilities, data loss risks, missing error handling for critical paths, violations of explicit project rules (lint configs, CLAUDE.md), missing tests for new behavior
[MINOR]	Improves quality but code works without it. Reviewer would approve anyway.	Naming improvements, readability tweaks, minor performance gains, style inconsistencies, documentation gaps, implicit convention deviations

Decision rule

Ask: "Would a staff engineer block a PR on this?"

• Yes - [MAJOR]
• No, but they'd leave a comment - [MINOR]
• No, they wouldn't mention it - Don't report it

When in doubt, downgrade to [MINOR]. False positives at [MAJOR] erode trust in the review.

---

The review workflow

Work through these four phases in order. Each phase feeds the next, so skipping one typically degrades review quality.

Phase 1: DETECT

Determine what changes exist and what to review.

1. Run git diff --stat (unstaged) and git diff --cached --stat (staged)
2. If both have changes, ask the user which set to review (or "both")
3. If neither has changes, inform the user: "No local changes to review." Stop.
4. Identify languages from file extensions in the diff
5. Count files changed, insertions, and deletions for the report header
6. If the diff exceeds 500 lines, warn the user and suggest focusing on [MAJOR] findings only to keep the review actionable

Phase 2: CONTEXT

Gather project context to calibrate the review. See references/context-detection.md for the full detection guide.

1. Read CLAUDE.md, AGENT.md, README.md if they exist in the project root
2. Read relevant lint and format configs (ESLint, Prettier, Ruff, tsconfig, etc.)
3. Scan 2-3 existing files in the same directories as changed files to detect naming, import, and error handling conventions
4. Note the framework and language from config files
5. Store context mentally - do not output it to the user. Use it to calibrate severity and skip findings that linters already enforce.

Phase 3: ANALYZE

Review the actual diff using the review pyramid (bottom-up).

1. Get the full diff with git diff or git diff --cached
2. For large diffs (>500 lines), process file-by-file with git diff -- <file>
3. Walk through each file's changes with these passes:
   1. Security pass - injection, auth, data exposure, secrets
   2. Correctness pass - null safety, edge cases, async/await, off-by-one
   3. Performance pass - N+1, missing indexes, memory leaks, unbounded queries
   4. Design pass - coupling, SRP violations, abstraction levels
   5. Readability pass - naming, dead code, magic numbers, nesting depth
   6. Convention pass - check against detected project rules and patterns
   7. Testing pass - new behavior untested, skipped tests, flaky patterns
4. For each finding: classify [MAJOR] or [MINOR], assign a category, note the file and line number

See references/review-checklist.md for the detailed per-category checklist.

Phase 4: REPORT

Present the structured review and offer to fix.

1. Output the review using the format specification below
2. After presenting, ask: "Would you like me to fix any of these? Tell me which items or say 'fix all MAJOR' / 'fix all'."

---

The review pyramid

Allocate attention proportionally to impact. Start at the bottom:

         [Convention]       <- least critical; check against project rules
        [Readability]       <- naming, clarity, dead code
      [Design]              <- structure, patterns, coupling
    [Performance]           <- N+1, memory, blocking I/O
  [Correctness]             <- bugs, edge cases, logic errors
[Security / Safety]         <- the most critical layer

A diff with a SQL injection vulnerability does not need a naming discussion - it needs the security fix flagged first.

---

Analysis passes

Condensed checklist per pass. See references/review-checklist.md for the full version.

Security (all [MAJOR])

• Injection: SQL, HTML/XSS, command injection, path traversal
• Auth: missing auth middleware, IDOR, privilege escalation
• Data exposure: logging secrets/PII, over-broad API responses
• Secrets: API keys, tokens, or credentials in code
• CSRF: missing token validation on state-changing endpoints

Correctness (mostly [MAJOR])

• Null/undefined safety: unhandled null paths
• Edge cases: empty input, zero, negative, boundary values
• Async: missing await, unhandled promise rejections, race conditions
• Off-by-one: loop bounds, array indices, pagination
• Type safety: == vs ===, implicit coercion, any casts

Performance ([MAJOR] if in hot path, [MINOR] otherwise)

• N+1 queries: database calls inside loops
• Missing indexes: new WHERE/ORDER BY columns without index
• Memory leaks: listeners/intervals without cleanup
• Unbounded queries: no LIMIT on large table queries
• Blocking I/O: synchronous operations in request handlers

Design ([MINOR] unless architectural)

• Tight coupling between unrelated modules
• Single Responsibility violations
• Mixed abstraction levels within a function
• Overly complex conditionals that should be extracted

Readability ([MINOR])

• Vague names: data, temp, flag, single letters outside tight loops
• Dead code: unreachable branches, unused variables, obsolete imports
• Magic numbers/strings not extracted to named constants
• Deep nesting: more than 3 levels of indentation

Convention ([MAJOR] if explicit rule, [MINOR] if implicit pattern)

• Violates configured lint rules (ESLint, Ruff, clippy, etc.)
• Deviates from naming convention in surrounding files
• Import style inconsistent with project pattern
• Breaks a rule stated in CLAUDE.md or AGENT.md

Testing ([MAJOR] for missing tests)

• New behavior without corresponding tests
• Tests that don't assert meaningful behavior
• Skipped tests without explanation
• Test names that don't describe the behavior being verified

---

Output format specification

Use this exact structure for the review output:

## Code Review: [staged|unstaged] changes

**Files changed**: N | **Insertions**: +X | **Deletions**: -Y

### [MAJOR] Issues (N)

- [ ] **file.ts:42** [Security] Description of the issue.
  Suggested fix or approach.

- [ ] **file.ts:87** [Correctness] Description of the issue.
  Suggested fix or approach.

### [MINOR] Suggestions (N)

- [ ] **file.ts:15** [Readability] Description of the suggestion.
  Suggested improvement.

- [ ] **file.ts:99** [Convention] Description of the deviation.
  Project convention reference.

### Summary
N major issues to resolve, M minor suggestions to consider.
Would you like me to fix any of these? Tell me which items or say "fix all MAJOR" / "fix all".

Rules for the output:

• Group all [MAJOR] findings first, then all [MINOR] findings
• Within each group, order by file path, then line number
• Each finding is a checkbox (- [ ]) so the user can track progress
• Each finding includes: file:line, category tag, one-line description, one-line suggested fix
• If there are zero [MAJOR] findings, say so explicitly: "No major issues found."
• If there are zero findings at all: "No issues found. Code looks good to commit."
• Always end with the offer to fix

---

Handling special cases

Scenario	How to handle
Large diffs (>500 lines)	Warn the user. Process file-by-file. Focus on [MAJOR] only unless user requests full review.
Binary files	Skip with a note: "Skipping binary file: path/to/file"
Generated/lock files	Skip package-lock.json, yarn.lock, pnpm-lock.yaml, *.min.js, *.generated.*, and similar. Note skipped files.
No changes	Inform user "No local changes to review." and stop.
Mixed staged/unstaged	Ask user: "You have both staged and unstaged changes. Which would you like me to review? (staged / unstaged / both)"
Merge conflicts	Note conflict markers as [MAJOR] and suggest resolving before review.
Only deletions	Review for missing cleanup (dangling references, broken imports, orphaned tests).

---

Anti-patterns

Avoid these mistakes when producing a review:

Anti-pattern	Why it's wrong	What to do instead
Flagging what linters already catch	Wastes attention if CI enforces the rule	Check if a linter config exists and CI runs it; skip those findings
Ignoring CLAUDE.md / project conventions	Misses the project's actual standards	Always read project configs in Phase 2 before analyzing
Writing essay-length findings	Hard to action, loses signal in noise	One-line description + one-line suggested fix per finding
Marking style preferences as [MAJOR]	Erodes trust in severity classification	Only [MAJOR] for bugs, security, explicit rule violations, missing tests
Reviewing files not in the diff	Scope creep; confuses the user	Only analyze lines present in the diff output
Inventing project rules	Flagging violations of standards the project doesn't have	Only flag Convention [MAJOR] when you found an explicit config/rule
Skipping the offer to fix	Misses the interactive value of this skill	Always end with the fix offer

---

Gotchas

1. Reviewing files not in the diff - It's easy to open related files for context and then accidentally include findings from those files in the review. Only report issues on lines that appear in the actual diff output - scope creep confuses authors and erodes trust.

2. Flagging what linters already enforce - If the project has ESLint, Prettier, or Ruff configured and CI runs them, reporting style violations in the review duplicates automated feedback. Check for linter configs in Phase 2 and skip findings that existing tooling will catch.

3. Severity inflation - Marking every finding [MAJOR] to signal thoroughness causes authors to lose trust in severity ratings and start ignoring the review. Apply the staff engineer test strictly: only block-worthy issues are [MAJOR]. When in doubt, downgrade to [MINOR].

4. Missing context before judging - A pattern that looks wrong in isolation (e.g., a .catch(() => {}) that swallows errors) may be intentional and documented elsewhere. Phase 2 context gathering exists to prevent false positives. Read CLAUDE.md, surrounding files, and lint config before flagging anything as a violation.

5. Large diff, no focus strategy - Reviewing a 1,000-line diff end-to-end produces an overwhelming output that authors can't action. For large diffs, warn the user and focus exclusively on [MAJOR] findings. Offer to do a second pass for [MINOR] items if wanted.

---

References

For detailed content on specific topics, read the relevant file from references/:

• references/review-checklist.md - Full per-category review checklist with detailed items for correctness, security, performance, readability, testing, documentation, and convention checks

• references/context-detection.md - Guide for gathering project context before reviewing: config file detection, framework heuristics, convention sampling, and language-specific focus areas

Load references/review-checklist.md when performing a thorough multi-pass review. Load references/context-detection.md when the project uses an unfamiliar framework or you need to identify conventions systematically.