---

name: code-review-checklist description: "全面的代码审查清单，涵盖功能性、安全性、性能和可维护性" risk: unknown source: community date_added: "2026-02-27"

代码审查清单

概述

提供系统化的代码审查清单。此技能帮助审查者确保代码质量、发现缺陷、识别安全问题，并保持代码库的一致性。

何时使用此技能

• 审查 Pull Request 时使用
• 进行代码审计时使用
• 为团队建立代码审查标准时使用
• 培训新开发者代码审查实践时使用
• 确保审查不遗漏任何内容时使用
• 创建代码审查文档时使用

工作原理

步骤 1：理解上下文

在审查代码之前，我会帮助你理解：

• 这段代码解决什么问题？
• 需求是什么？
• 哪些文件被修改了，为什么？
• 是否有相关的 issue 或工单？
• 测试策略是什么？

步骤 2：审查功能性

检查代码是否正确工作：

• 是否解决了所述问题？
• 是否处理了边界情况？
• 错误处理是否恰当？
• 是否存在逻辑错误？
• 是否符合需求？

步骤 3：审查代码质量

评估代码可维护性：

• 代码是否可读且清晰？
• 命名是否具有描述性？
• 结构是否合理？
• 函数/方法是否职责单一？
• 是否存在不必要的复杂性？

步骤 4：审查安全性

检查安全问题：

• 输入是否经过验证？
• 敏感数据是否受到保护？
• 是否存在 SQL 注入风险？
• 身份验证/授权是否正确？
• 依赖项是否安全？

步骤 5：审查性能

查找性能问题：

• 是否存在不必要的循环？
• 数据库访问是否优化？
• 是否存在内存泄漏？
• 缓存使用是否恰当？
• 是否存在 N+1 查询问题？

步骤 6：审查测试

验证测试覆盖率：

• 新代码是否有测试？
• 测试是否覆盖边界情况？
• 测试是否有意义？
• 所有测试是否通过？
• 测试覆盖率是否充足？

示例

示例 1：功能性审查清单

## Functionality Review

### Requirements
- [ ] Code solves the stated problem
- [ ] All acceptance criteria are met
- [ ] Edge cases are handled
- [ ] Error cases are handled
- [ ] User input is validated

### Logic
- [ ] No logical errors or bugs
- [ ] Conditions are correct (no off-by-one errors)
- [ ] Loops terminate correctly
- [ ] Recursion has proper base cases
- [ ] State management is correct

### Error Handling
- [ ] Errors are caught appropriately
- [ ] Error messages are clear and helpful
- [ ] Errors don't expose sensitive information
- [ ] Failed operations are rolled back
- [ ] Logging is appropriate

### Example Issues to Catch:

**❌ Bad - Missing validation:**
\`\`\`javascript
function createUser(email, password) {
  // No validation!
  return db.users.create({ email, password });
}
\`\`\`

**✅ Good - Proper validation:**
\`\`\`javascript
function createUser(email, password) {
  if (!email || !isValidEmail(email)) {
    throw new Error('Invalid email address');
  }
  if (!password || password.length < 8) {
    throw new Error('Password must be at least 8 characters');
  }
  return db.users.create({ email, password });
}
\`\`\`

示例 2：安全性审查清单

## Security Review

### Input Validation
- [ ] All user inputs are validated
- [ ] SQL injection is prevented (use parameterized queries)
- [ ] XSS is prevented (escape output)
- [ ] CSRF protection is in place
- [ ] File uploads are validated (type, size, content)

### Authentication & Authorization
- [ ] Authentication is required where needed
- [ ] Authorization checks are present
- [ ] Passwords are hashed (never stored plain text)
- [ ] Sessions are managed securely
- [ ] Tokens expire appropriately

### Data Protection
- [ ] Sensitive data is encrypted
- [ ] API keys are not hardcoded
- [ ] Environment variables are used for secrets
- [ ] Personal data follows privacy regulations
- [ ] Database credentials are secure

### Dependencies
- [ ] No known vulnerable dependencies
- [ ] Dependencies are up to date
- [ ] Unnecessary dependencies are removed
- [ ] Dependency versions are pinned

### Example Issues to Catch:

**❌ Bad - SQL injection risk:**
\`\`\`javascript
const query = \`SELECT * FROM users WHERE email = '${email}'\`;
db.query(query);
\`\`\`

**✅ Good - Parameterized query:**
\`\`\`javascript
const query = 'SELECT * FROM users WHERE email = $1';
db.query(query, [email]);
\`\`\`

**❌ Bad - Hardcoded secret:**
\`\`\`javascript
const API_KEY = 'sk_live_abc123xyz';
\`\`\`

**✅ Good - Environment variable:**
\`\`\`javascript
const API_KEY = process.env.API_KEY;
if (!API_KEY) {
  throw new Error('API_KEY environment variable is required');
}
\`\`\`

示例 3：代码质量审查清单

## Code Quality Review