---
name: review
description: "Identifies static, security, logic, and memory defects in code"
---

## Applicable Scenarios

- User requests code review, code audit, or defect scanning
- User mentions PR review, MR review, or merge request review
- User wants to find bugs, vulnerabilities, or code quality issues
- User uses /review

## Core Principles

| Principle | Requirement |
|-----------|-------------|
| **Scan Types** | Static defects, security vulnerabilities, logical defects, memory issues, loaded by matching trigger signals |
| **Data-Flow Driven** | Security vulnerability and logical defect detection use data-flow analysis as the backbone, tracing from input sources (API parameters, database queries, external calls) to sensitive operation points (database writes, permission checks, state changes). Static defect detection primarily uses structural analysis, and memory issue detection primarily uses language-specific analysis |
| **Code Evidence** | Every finding must be traceable to `file:line`, evidence chain represented as Mermaid diagrams showing call relationships |
| **Adversarial Validation** | Validation subtasks default to refuting; promote only when no refutation evidence is found |
| **On-Demand Loading** | Single file read per invocation; loads detection modules by matching trigger signals against routing.md; no indiscriminate scanning |
| **Scan Scope Constraint** | Must not perform repository-wide keyword searches; must not recursively read all related files. Data-flow tracing (at most 5 call levels up/down) and LSP tools (find_definition, find_references) are exempt from this constraint |

## Review Workflow

**Warning (mandatory): Use the TodoWrite tool to track task progress across all stages**

1. Target Filtering
2. Defect Detection (per-file subtask)
3. Validation (per-defect subtask)
4. Management (Wave orchestration subtask)
5. Generate Review Report

### Stage 1: Target Filtering

Orchestration strategy: read `<skill-root>/references/strategy/filtering-strategy.md`, execute output directory confirmation, scan target acquisition, exclusion determination, and draft saving.

### Stage 2: Defect Detection

Execute **only when** the scan file list is non-empty.

Orchestration strategy: read `<skill-root>/references/strategy/detection-strategy.md`, follow its guidance to read the project environment, execute detection type assignment, and per-file subtask scheduling (perform data-flow analysis first, then defect detection for each file).

**After completion**: confirm `.draft-02-detection/manifest.json` status = "completed".

### Stage 3: Validation

**Before starting**: read `.draft-02-detection/manifest.json` to restore the defect list.

Orchestration strategy: read `<skill-root>/references/strategy/validation-strategy.md`, follow its guidance to schedule per-defect Agent subtasks for adversarial validation.

**After completion**: confirm `.draft-03-validation/manifest.json` status = "completed".

### Stage 4: Management

**Before starting**: read `.draft-03-validation/manifest.json` to restore the promoted defect list.

Orchestration strategy: read `<skill-root>/references/strategy/management-strategy.md`, follow its guidance to schedule Agent subtasks by Wave for metadata management (deduplication, scope validation, noise filtering, severity calibration, defect clustering).

**After completion**: confirm `.draft-04-management/manifest.json` status = "completed".

### Stage 5: Generate Review Report

Orchestration strategy: read `<skill-root>/references/report/routing.md`, follow its guidance to aggregate data from all stage drafts, and generate JSON report and Markdown report.
