Build Skills from Scratch

mkdir -p ~/.claude/skills/code-review-assistant

---
name: code-review-assistant
description: >
  Reviews Python or JavaScript code for bugs, security issues,
  and style problems. Use when the user shares code and asks for
  a review, feedback, or asks to check the code.
---

# Code Review Assistant

## Goal
Identify real problems in the code — not cosmetic preferences.
Produce a structured review a developer can act on immediately.

## Output structure
1. **Summary** — one sentence on overall code quality.
2. **Issues found** — table: | # | Severity | Location | Issue | Fix |
3. **Positives** — 2-3 things done well (keep reviews balanced).
4. **Recommended next step** — single highest-priority action.

## Severity levels
- Critical — security flaw or data loss risk
- High     — likely to cause bugs in production
- Medium   — incorrect but non-critical logic
- Low      — style, naming, minor improvements

## Guidelines
- Reference the exact line or function name, not vague locations.
- Suggest a concrete fix, not just "this is wrong".
- If using a reference file, read references/patterns.md first.
- Keep the tone constructive, not critical of the author.

# Secure Coding Patterns

## Input validation
Always validate and sanitise external input before use.
- Reject unexpected types early (type checks at boundaries).
- Use allow-lists, not block-lists, for string validation.

## SQL queries
Never interpolate user input directly into queries.
Prefer parameterised queries or an ORM.

## Secrets
Never log, print, or include secrets in error messages.
Use environment variables; never hardcode credentials.

#!/usr/bin/env python3
"""
validate_syntax.py
Checks Python files for syntax errors before review.
Claude runs this via bash; only the output enters context.
"""
import ast, sys

def validate(path: str) -> None:
    with open(path) as f:
        source = f.read()
    try:
        ast.parse(source)
        print(f"OK: {path} — no syntax errors")
    except SyntaxError as e:
        print(f"ERROR: {path} — line {e.lineno}: {e.msg}")
        sys.exit(1)

if __name__ == "__main__":
    for p in sys.argv[1:]:
        validate(p)