code-review
- Use it when:
- You're reviewing a pull request or code change and want a short, general checklist.
- It does:
- Checks for runtime errors, quadratic or N+1 performance problems, side effects, breaking API changes, security gaps, test coverage and fit with the architecture.
- You get:
- Polite, actionable comments, phrased as questions when unsure, with approval once only minor issues remain.
- Flags for a senior:
- Schema changes, API contract changes, new frameworks or libraries, performance-critical paths and security-sensitive code.
- Unlike find-bugs:
- That one, Sentry's branch review, has an 11-item security checklist and evidence for every finding; this one is a lighter reviewer's guide.
TL;DR
Sentry's code review guidelines, condensed for agents. They're written for Sentry projects, though nothing in them needs Sentry. The checklist covers problems to look for, from exceptions and out-of-bounds access to unbounded quadratic operations, N+1 queries, complex Django ORM queries, injection and exposed secrets; a design check of whether the change fits the architecture and current requirements; and test coverage at functional, integration and end-to-end level, without heavy branching in tests. The feedback rules say to be polite and specific, not to block a PR over style, and to remember the goal is reducing risk, not perfect code. Short examples show an N+1 query fixed with prefetch_related, a missing useEffect dependency, and SQL injection fixed with a parameterized query. It links to Sentry's published code review guide.
Summarizes the skill at e94f222.
npx skills add https://github.com/getsentry/skills --skill code-review skills.sh pageSource on GitHubAll skills from getsentry/skills
- Total Downloads
- 5,700 on skills.sh, Nov 9, 2026
- Repo stars
- 1,135 getsentry/skills
- First seen
- Jan 20, 2026 on skills.sh
Weekly values
| Week to | Installs |
|---|---|
| Sep 21 | 63 |
| Sep 28 | 39 |
| Oct 5 | 368 |
| Oct 12 | 68 |
| Oct 19 | 146 |
| Oct 26 | 78 |
| Nov 2 | 122 |
| Nov 9 | 94 |
| Category |
Find root causes, review code and test what you built. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills. |
|---|---|
| Type |
Knowledge and rules the agent applies while it works: best practices, design principles, API references. |
| Effect |
Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code. |
| Needs |
Instructions only. Works in any agent that supports skills. |
| Publisher |
A verified publisher on skills.sh, or the company or maintainer behind the product the skill operates. |
| Topics |
SKILL.md
From getsentry/skills at e94f222. Checked daily, last changed Nov 7, 2026.
Frontmatter
name: code-review
description: Perform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.Sentry Code Review
Follow these guidelines when reviewing code for Sentry projects.
Review Checklist
Identifying Problems
Look for these issues in code changes:
- Runtime errors: Potential exceptions, null pointer issues, out-of-bounds access
- Performance: Unbounded O(n²) operations, N+1 queries, unnecessary allocations
- Side effects: Unintended behavioral changes affecting other components
- Backwards compatibility: Breaking API changes without migration path
- ORM queries: Complex Django ORM with unexpected query performance
- Security vulnerabilities: Injection, XSS, access control gaps, secrets exposure
Design Assessment
- Do component interactions make logical sense?
- Does the change align with existing project architecture?
- Are there conflicts with current requirements or goals?
Test Coverage
Every PR should have appropriate test coverage:
- Functional tests for business logic
- Integration tests for component interactions
- End-to-end tests for critical user paths
Verify tests cover actual requirements and edge cases. Avoid excessive branching or looping in test code.
Long-Term Impact
Flag for senior engineer review when changes involve:
- Database schema modifications
- API contract changes
- New framework or library adoption
- Performance-critical code paths
- Security-sensitive functionality
Feedback Guidelines
Tone
- Be polite and empathetic
- Provide actionable suggestions, not vague criticism
- Phrase as questions when uncertain: "Have you considered...?"
Approval
- Approve when only minor issues remain
- Don't block PRs for stylistic preferences
- Remember: the goal is risk reduction, not perfect code
Common Patterns to Flag
Python/Django
# Bad: N+1 query
for user in users:
print(user.profile.name) # Separate query per user
# Good: Prefetch related
users = User.objects.prefetch_related('profile')
TypeScript/React
// Bad: Missing dependency in useEffect
useEffect(() => {
fetchData(userId);
}, []); // userId not in deps
// Good: Include all dependencies
useEffect(() => {
fetchData(userId);
}, [userId]);
Security
# Bad: SQL injection risk
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")
# Good: Parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", [user_id])