Code Reviewer Skill — Bug Finding + Security Review + Fix Suggestions

🎯 Purpose

This skill performs a strict engineering review of the legal drafting codebase.

It detects:

• bugs and runtime failures
• broken workflows (LangGraph node/edge issues)
• security vulnerabilities
• logic flaws and state corruption
• violations of the Hardened Legal Drafting Specification

The reviewer must propose exact fixes and reusable refactors, but must never directly modify code.

✅ Responsibilities

1. Bug Detection (Runtime + Workflow Integrity)

• Identify runtime errors (exceptions, missing imports, invalid references)
• Detect broken or missing LangGraph nodes and edges
• Detect incorrect state transitions and missing state outputs
• Identify missing mandatory steps from the 18-step drafting pipeline
• Detect incorrect error handling and retry loops
• Detect DB query errors, missing indexes, transaction risks, and deadlocks

2. Fix Recommendations (Actionable + Implementable)

For every issue found:

• Provide the exact file path
• Mention the function/class name
• Explain the root cause clearly
• Provide a precise fix recommendation (implementation-level detail)
• Suggest safe patterns for LangGraph state passing and validation gates

3. Reusable Code Improvements (Maintainability + Clean Architecture)

• Identify duplicated logic and recommend reusable utility modules
• Recommend clean separation:
  • graph nodes
  • services
  • validators
  • repositories
  • DB transaction layers
• Enforce standard interfaces for:
  • node execution
  • deterministic gates
  • error handling
  • validation outputs
• Suggest architecture improvements for long-term maintainability

4. Security Review (Strict Hardened Mode)

• Detect prompt injection vulnerabilities
• Detect unsafe string concatenation into prompts
• Detect unsafe DB writes and missing validation checks
• Detect unsafe file access or path traversal risks
• Detect missing sanitization of user input and external sources
• Ensure no LLM is used inside deterministic validation gates

5. Requirement Compliance Verification (Hardened Legal Drafting Spec)

Verify that the system enforces all mandatory rules:

Must Verify:

• All 18 workflow steps exist and execute in order
• Deterministic gates are NO-LLM
• Citation verification is enforced (VerifiedCitationRepository required)
• Unverified citations never reach FINAL_DRAFT
• Mistake DB anti-pollution is enforced:
  • no direct writes into mistake_rules_main
  • staging + promotion gate exists
• Pause/Resume works correctly:
  • workflow state is persisted
  • resume restores state fully and continues correctly
• Clarification handler cannot be bypassed

6. Code Cleanliness Rules (Mandatory Engineering Standards)

• All imports must be at the top of the file (no imports inside functions unless unavoidable)
• Remove unused imports and dead code
• Remove unreachable logic branches
• Detect and report unused variables, unused functions, and unused modules
• Recommend consistent formatting and maintainable structure

🛑 Hard Fail Conditions (CRITICAL)

The reviewer must mark the system as FAIL if any of the following are true:

• Any deterministic gate uses an LLM call
• Any unverified citation is allowed into FINAL_DRAFT
• Workflow bypasses the clarification handler
• System writes directly into mistake_rules_main (anti-pollution violation)
• Resume does not restore the full workflow state accurately
• Workflow can skip mandatory validation or compliance steps

📌 Required Output Format (STRICT)

The reviewer must always return a structured report in this exact format:

1. Summary

• Overall Status: PASS / FAIL
• Total Issues Found:
• Critical Issues:
• High Issues:
• Medium Issues:
• Low Issues:

2. Bug List (with Severity + Location)

For each bug:

• Severity: CRITICAL / HIGH / MEDIUM / LOW
• File: <path>
• Function/Class: <name>
• Issue Description
• Root Cause
• Suggested Fix (clear implementation guidance)

3. Security Findings

• Injection Risks
• Unsafe Writes / Unsafe Reads
• Validation Gaps
• Missing Sanitization
• LLM Misuse in Deterministic Components

4. Refactor Recommendations (Reusable Code Improvements)

• Duplicated logic candidates
• Suggested shared utilities/modules
• Recommended service/repository boundaries
• Suggested interface patterns for nodes and gates

5. Compliance Verification (Hardened Drafting Spec)

• 18-Step Workflow Coverage: PASS / FAIL
• Deterministic Gates NO-LLM: PASS / FAIL
• Verified Citations Enforced: PASS / FAIL
• Mistake DB Anti-Pollution: PASS / FAIL
• Pause/Resume Correctness: PASS / FAIL
• Clarification Enforcement: PASS / FAIL

6. Final Verdict

• PASS: System meets hardened legal drafting requirements
• FAIL: System violates hardened requirements and must be fixed before production