AI 驱动代码审查专家

技能文档

---
name: boisenoise-antigravity-performance-testing-review-ai-review
title: AI 驱动代码审查专家
category: 开发工具
description: 结合静态分析与 AI 辅助理解的代码审查方法库，覆盖安全漏洞检测、性能回归分析、架构合理性评估与 CI/CD 流水线集成，输出带行号、严重级别和修复示例的结构化审查意见。当用户需要审查代码、做 PR 代码评审、扫描安全漏洞、检测性能回归、搭建自动化代码审查流水线时触发。触发词：代码审查、代码评审、安全扫描、性能回归、CI 集成。
---

# AI 驱动代码审查专家

结合自动化静态分析、智能模式识别与现代 DevOps 实践的代码审查方法：用 SonarQube、CodeQL、Semgrep 等成熟引擎配合大模型上下文理解，识别缺陷、漏洞与性能问题，在 CI/CD 流水线中对 PR 即时反馈，架构决策保留人工把关。

## 适用场景

- 执行 AI 辅助代码审查相关任务或工作流
- 需要代码审查的最佳实践、方法论或检查清单
- 搭建多工具静态分析 + AI 复核的自动化评审流水线
- 对 PR 做安全、性能、架构、可维护性综合评估

不适用：与代码审查无关的任务，或需要本范围之外领域/工具的场景。

## 技能工作流

### 步骤1：初步分诊

1. 解析 diff，确定修改文件与受影响组件
2. 按文件类型匹配最合适的静态分析工具
3. 按 PR 规模调整分析深度（>1000 行做表层审查，<200 行做深度审查）
4. 分类变更类型：新功能、缺陷修复、重构或破坏性变更

### 步骤2：多工具静态分析（并行执行）

- **CodeQL**：深度漏洞分析（SQL 注入、XSS、鉴权绕过）
- **SonarQube**：代码异味、复杂度、重复度、可维护性
- **Semgrep**：组织自定义规则与安全策略
- **Snyk/Dependabot**：供应链安全
- **GitGuardian/TruffleHog**：密钥泄露检测

### 步骤3：AI 辅助复核

```python
# Context-aware review prompt
review_prompt = f"""
You are reviewing a pull request for a {language} {project_type} application.

**Change Summary:** {pr_description}
**Modified Code:** {code_diff}
**Static Analysis:** {sonarqube_issues}, {codeql_alerts}
**Architecture:** {system_architecture_summary}

Focus on:
1. Security vulnerabilities missed by static tools
2. Performance implications at scale
3. Edge cases and error handling gaps
4. API contract compatibility
5. Testability and missing coverage
6. Architectural alignment

For each issue:
- Specify file path and line numbers
- Classify severity: CRITICAL/HIGH/MEDIUM/LOW
- Explain problem (1-2 sentences)
- Provide concrete fix example
- Link relevant documentation

Format as JSON array.
"""
```

模型选择参考：
- **快速审查（<200 行）**：轻量快速模型
- **深度推理**：长上下文旗舰模型
- **代码生成**：GitHub Copilot 或 Qodo
- **多语言**：Qodo 或 CodeAnt AI（30+ 语言）

### 步骤4：审查路由

```typescript
interface ReviewRoutingStrategy {
  async routeReview(pr: PullRequest): Promise<ReviewEngine> {
    const metrics = await this.analyzePRComplexity(pr);

    if (metrics.filesChanged > 50 || metrics.linesChanged > 1000) {
      return new HumanReviewRequired("Too large for automation");
    }

    if (metrics.securitySensitive || metrics.affectsAuth) {
      return new AIEngine("security-model", {
        temperature: 0.1,
        maxTokens: 4000,
        systemPrompt: SECURITY_FOCUSED_PROMPT
      });
    }

    if (metrics.testCoverageGap > 20) {
      return new QodoEngine({ mode: "test-generation", coverageTarget: 80 });
    }

    return new AIEngine("general-model", { temperature: 0.3, maxTokens: 2000 });
  }
}
```

审查对象：待评审的 PR/diff。

综合分析安全、性能、架构、可维护性、测试与 AI/ML 特有问题，生成带行号引用、代码示例和可执行建议的审查意见。

## 架构分析

### 架构一致性

1. **依赖方向**：内层不依赖外层
2. **SOLID 原则**：单一职责、开闭原则、里氏替换、接口隔离、依赖倒置
3. **反模式**：单例（全局状态）、上帝对象（>500 行、>20 个方法）、贫血模型、霰弹式修改

### 微服务审查

```go
type MicroserviceReviewChecklist struct {
    CheckServiceCohesion       bool  // Single capability per service?
    CheckDataOwnership         bool  // Each service owns database?
    CheckAPIVersioning         bool  // Semantic versioning?
    CheckBackwardCompatibility bool  // Breaking changes flagged?
    CheckCircuitBreakers       bool  // Resilience patterns?
    CheckIdempotency           bool  // Duplicate event handling?
}

func (r *MicroserviceReviewer) AnalyzeServiceBoundaries(code string) []Issue {
    issues := []Issue{}

    if detectsSharedDatabase(code) {
        issues = append(issues, Issue{
            Severity: "HIGH",
            Category: "Architecture",
            Message: "Services sharing database violates bounded context",
            Fix: "Implement database-per-service with eventual consistency",
        })
    }

    if hasBreakingAPIChanges(code) && !hasDeprecationWarnings(code) {
        issues = append(issues, Issue{
            Severity: "CRITICAL",
            Category: "API Design",
            Message: "Breaking change without deprecation period",
            Fix: "Maintain backward compatibility via versioning (v1, v2)",
        })
    }

    return issues
}
```

## 安全漏洞检测

### 多层安全

**SAST 层**：CodeQL、Semgrep、Bandit/Brakeman/Gosec

**AI 增强威胁建模**：

```python
security_analysis_prompt = """
Analyze authentication code for vulnerabilities:
{code_snippet}

Check for:
1. Authentication bypass, broken access control (IDOR)
2. JWT token validation flaws
3. Session fixation/hijacking, timing attacks
4. Missing rate limiting, insecure password storage
5. Credential stuffing protection gaps

Provide: CWE identifier, CVSS score, exploit scenario, remediation code
"""
```

**密钥扫描**：

```bash
trufflehog git file://. --json | \
  jq '.[] | select(.Verified == true) | {
    secret_type: .DetectorName,
    file: .SourceMetadata.Data.Filename,
    severity: "CRITICAL"
  }'
```

### OWASP Top 10

1. **A01 失效的访问控制**：越权、IDOR
2. **A02 加密失败**：弱哈希、不安全随机数
3. **A03 注入**：经污点分析的 SQL/NoSQL/命令注入
4. **A04 不安全设计**：缺失威胁建模
5. **A05 安全配置错误**：默认凭据
6. **A06 易受漏洞影响的组件**：用 Snyk/Dependabot 跟踪 CVE
7. **A07 身份认证失败**：会话管理薄弱
8. **A08 数据完整性失败**：未签名 JWT
9. **A09 日志记录失败**：缺失审计日志
10. **A10 SSRF**：未校验用户可控 URL

## 性能审查

### 性能剖析

```javascript
class PerformanceReviewAgent {
  async analyzePRPerformance(prNumber) {
    const baseline = await this.loadBaselineMetrics('main');
    const prBranch = await this.runBenchmarks(`pr-${prNumber}`);

    const regressions = this.detectRegressions(baseline, prBranch, {
      cpuThreshold: 10, memoryThreshold: 15, latencyThreshold: 20
    });

    if (regressions.length > 0) {
      await this.postReviewComment(prNumber, {
        severity: 'HIGH',
        title: '⚠️ Performance Regression Detected',
        body: this.formatRegressionReport(regressions),
        suggestions: await this.aiGenerateOptimizations(regressions)
      });
    }
  }
}
```

### 扩展性红旗

- **N+1 查询**、**缺失索引**、**同步外部调用**
- **内存态状态**、**无界集合**、**缺失分页**
- **无连接池**、**无限流**

```python
def detect_n_plus_1_queries(code_ast):
    issues = []
    for loop in find_loops(code_ast):
        db_calls = find_database_calls_in_scope(loop.body)
        if len(db_calls) > 0:
            issues.append({
                'severity': 'HIGH',
                'line': loop.line_number,
                'message': f'N+1 query: {len(db_calls)} DB calls in loop',
                'fix': 'Use eager loading (JOIN) or batch loading'
            })
    return issues
```

## 审查意见生成

### 结构化格式

```typescript
interface ReviewComment {
  path: string; line: number;
  severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
  category: 'Security' | 'Performance' | 'Bug' | 'Maintainability';
  title: string; description: string;
  codeExample?: string; references?: string[];
  autoFixable: boolean; cwe?: string; cvss?: number;
  effort: 'trivial' | 'easy' | 'medium' | 'hard';
}

const comment: ReviewComment = {
  path: "src/auth/login.ts", line: 42,
  severity: "CRITICAL", category: "Security",
  title: "SQL Injection in Login Query",
  description: `String concatenation with user input enables SQL injection.
**Attack Vector:** Input 'admin' OR '1'='1' bypasses authentication.
**Impact:** Complete auth bypass, unauthorized access.`,
  codeExample: `
// ❌ Vulnerable
const query = \`SELECT * FROM users WHERE username = '\${username}'\`;

// ✅ Secure
const query = 'SELECT * FROM users WHERE username = ?';
const result = await db.execute(query, [username]);
  `,
  references: ["https://cwe.mitre.org/data/definitions/89.html"],
  autoFixable: false, cwe: "CWE-89", cvss: 9.8, effort: "easy"
};
```

## CI/CD 集成

### GitHub Actions 示例

```yaml
name: AI Code Review
on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  ai-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Static Analysis
        run: |
          sonar-scanner -Dsonar.pullrequest.key=${{ github.event.number }}
          codeql database create codeql-db --language=javascript,python
          semgrep scan --config=auto --sarif --output=semgrep.sarif

      - name: AI-Enhanced Review
        env:
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: |
          python scripts/ai_review.py \
            --pr-number ${{ github.event.number }} \
            --static-analysis-results codeql.sarif,semgrep.sarif

      - name: Post Comments
        uses: actions/github-script@v7
        with:
          script: |
            const comments = JSON.parse(fs.readFileSync('review-comments.json'));
            for (const comment of comments) {
              await github.rest.pulls.createReviewComment({
                owner: context.repo.owner,
                repo: context.repo.repo,
                pull_number: context.issue.number,
                body: comment.body, path: comment.path, line: comment.line
              });
            }

      - name: Quality Gate
        run: |
          CRITICAL=$(jq '[.[] | select(.severity == "CRITICAL")] | length' review-comments.json)
          if [ $CRITICAL -gt 0 ]; then
            echo "❌ Found $CRITICAL critical issues"
            exit 1
          fi
```

## 完整示例：AI 审查自动化

```python
#!/usr/bin/env python3
import os, json, subprocess
from dataclasses import dataclass
from typing import List, Dict, Any

@dataclass
class ReviewIssue:
    file_path: str; line: int; severity: str
    category: str; title: str; description: str
    code_example: str = ""; auto_fixable: bool = False

class CodeReviewOrchestrator:
    def __init__(self, pr_number: int, repo: str):
        self.pr_number = pr_number; self.repo = repo
        self.github_token = os.environ['GITHUB_TOKEN']
        self.issues: List[ReviewIssue] = []

    def run_static_analysis(self) -> Dict[str, Any]:
        results = {}

        # SonarQube
        subprocess.run(['sonar-scanner', f'-Dsonar.projectKey={self.repo}'], check=True)

        # Semgrep
        semgrep_output = subprocess.check_output(['semgrep', 'scan', '--config=auto', '--json'])
        results['semgrep'] = json.loads(semgrep_output)

        return results

    def ai_review(self, diff: str, static_results: Dict, llm_client) -> List[ReviewIssue]:
        prompt = f"""Review this PR comprehensively.

**Diff:** {diff[:15000]}
**Static Analysis:** {json.dumps(static_results, indent=2)[:5000]}

Focus: Security, Performance, Architecture, Bug risks, Maintainability

Return JSON array:
[{{
  "file_path": "src/auth.py", "line": 42, "severity": "CRITICAL",
  "category": "Security", "title": "Brief summary",
  "description": "Detailed explanation", "code_example": "Fix code"
}}]
"""

        response = llm_client.create(
            max_tokens=8000, temperature=0.2,
            messages=[{"role": "user", "content": prompt}]
        )

        content = response["content"]
        if '```json' in content:
            content = content.split('```json')[1].split('```')[0]

        return [ReviewIssue(**issue) for issue in json.loads(content.strip())]

    def post_review_comments(self, issues: List[ReviewIssue]):
        summary = "## 🤖 AI Code Review\n\n"
        by_severity = {}
        for issue in issues:
            by_severity.setdefault(issue.severity, []).append(issue)

        for severity in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']:
            count = len(by_severity.get(severity, []))
            if count > 0:
                summary += f"- **{severity}**: {count}\n"

        critical_count = len(by_severity.get('CRITICAL', []))
        review_data = {
            'body': summary,
            'event': 'REQUEST_CHANGES' if critical_count > 0 else 'COMMENT',
            'comments': [issue.to_github_comment() for issue in issues]
        }

        # Post to GitHub API
        print(f"✅ Posted review with {len(issues)} comments")

if __name__ == '__main__':
    import argparse
    parser = argparse.ArgumentParser()
    parser.add_argument('--pr-number', type=int, required=True)
    parser.add_argument('--repo', required=True)
    args = parser.parse_args()

    reviewer = CodeReviewOrchestrator(args.pr_number, args.repo)
    static_results = reviewer.run_static_analysis()
    # diff 获取与大模型客户端接入按实际运行环境实现
```

## 能力总结

1. 多工具静态分析（SonarQube、CodeQL、Semgrep）
2. 大模型上下文复核，弥补规则引擎的语义盲区
3. 无缝 CI/CD 集成（GitHub Actions、GitLab、Azure DevOps）
4. 30+ 语言支持与语言专属 linter
5. 带严重级别和修复示例的可执行审查意见
6. DORA 指标跟踪审查效能
7. 质量门禁拦截低质量代码
8. 自动测试生成补齐覆盖缺口

## 限制

- 仅在任务明确匹配上述范围时使用本技能
- 输出不能替代环境特定的验证、测试或专家评审
- 缺少必要输入、权限、安全边界或成功标准时，先停下来澄清

使用说明

# AI 驱动代码审查专家

静态分析引擎 + 大模型复核的代码审查方法论：分诊 PR、并行多工具扫描、AI 上下文复核、结构化意见输出，并可集成进 CI/CD 质量门禁。

## 使用

```text
帮我审查这个 PR 的安全与性能问题
搭建一条 PR 自动代码审查流水线，含 SonarQube 和质量门禁
```

提供待审查的代码或 PR diff，技能按「初步分诊 → 静态分析 → AI 复核 → 意见生成」流程输出结构化审查结果。

## 工作原理

技能按 PR 规模与变更类型选择审查深度，并行调度 CodeQL/SonarQube/Semgrep 等静态分析引擎，再用大模型对静态结果做上下文复核（遗漏漏洞、性能影响、边界情况），生成带严重级别、CWE 编号和修复示例的结构化意见，并可配置 CRITICAL 阻断的质量门禁。

如何安装此技能？

访问技能市场，点击「安装」按钮，按提示将技能包放入 AI 编程助手的 skills 目录即可。