review-code

---
name: review-code
description: >-
  Use when the user asks for a review or what could be improved (Indonesian: kodenya bagus?,
  ada yang bisa diperbaiki?, cek kodenya, review), and before committing a larger change.
  Finds real bugs first and changes nothing until the user approves.
---
# Review code

1. Say what you review: the uncommitted diff (`git diff`, `git diff --staged`), a file, or a feature.
2. If subagents are available, ask the `code-reviewer` subagent for an independent pass on the diff,
   and do your own pass too.
3. Look in this order:
   - correctness: wrong logic, missing states, off-by-one, special values (-1, null, "") meaning two things
   - errors: unhandled promise rejections, empty catch, raw errors shown to users
   - security: secrets in code, injection (shell / SQL / HTML), missing auth or quota check before paid calls
   - data loss: destructive migrations, overwrites, races
   - performance: N+1 queries, render loops, unbounded lists / memory
   - dead code, then readability (last)
4. Every finding needs a concrete scenario: input → wrong result. No scenario → drop it.
5. Output, most severe first, max ~10:
   `[HIGH|MED|LOW] file:line — problem / Scenario: ... / Fix: ...`
   Then ask which ones to fix (in the user's language). Change NOTHING until the user picks.
6. Nothing found → "No findings" + the list of what you checked.