---
author: 'William Lino'
description:
  'Review a scoped backend change for evidenced security, reliability,
  data-access, and API-boundary risks. Use when reviewing a backend diff; do not
  install tools or modify CI unless the user asks.'
extras:
  'Create `references/rules.md`, cite the actual scanner or use existing project
  tools, and add safe test fixtures before any CI integration.'
focus:
  'Review backend changes for architecture, reliability, performance, and
  security risks.'
id: 'backend-code-reviewer'
improve:
  - 'Missing frontmatter means it is not a valid, discoverable skill.'
  - 'The referenced `dsa-reviewer` tool and curl-pipe-shell installation are
    unverified; never recommend executing them as written.'
  - 'Split generic principles from language/framework-specific detection and
    define evidence thresholds to reduce false positives.'
name: 'backend-code-reviewer'
path: '../submitted-skills/William%20Lino/skills/backend-code-reviewer/SKILL.md'
status: 'Restructure required'
title: 'Backend code reviewer'
wins:
  - 'Ambitious and relevant issue categories.'
  - 'CI reporting intent is useful.'
---

# backend-code-reviewer

## Inputs

A branch diff or changed backend paths and the project’s declared tooling.

## Workflow

1. Identify runtime, framework, and existing checks from the repository.
2. Review changed data access, async boundaries, error handling, API contracts,
   secrets, and resource limits.
3. Report findings only when a concrete path and consequence are visible; label
   hypotheses separately.
4. Run existing, approved checks and include their evidence.

## Rules

- Do not download or pipe remote installers into a shell.
- Do not claim missing indexes, retries, or architectural violations without
  repository evidence.
- Read `references/rules.md` for framework-specific checks.

## Output

Return severity, location, evidence, impact, recommendation, and checks run.
