Code Review Prompt — the Review Contract
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Best-practices review with JavaScript's own traps added: equality coercion, floating promises, this-binding, shared-object mutation.
JavaScript review needs JavaScript questions. This setup runs the best-practices focus — idioms, framework conventions, deprecated APIs, ecosystem-style error handling, standard library over reinvention — with the JavaScript language pack adding the four traps that generic reviews miss: == comparisons that should be ===, unhandled promise rejections and floating promises, "this" binding in callbacks and class methods, and mutation of shared objects or function arguments. Balanced style keeps the findings prioritized.
Review file by file
Single File scope judges structure and imports too — where JavaScript codebases usually drift first.
Take the promise findings seriously
Unhandled rejections are the JavaScript failure mode that skips every test and hits every user.
Escalate to Strict for shared libraries
Code many teams import deserves every finding, including the nits.
Checklist items 11-14 add the JavaScript traps generic reviews miss: == comparisons that should be ===, unhandled or floating promise rejections, wrong "this" binding in callbacks and class methods, and mutation of shared objects or function arguments. It generates a review prompt you run in your own assistant, which reports findings — you still confirm each one against the real code.
This setup is fixed to Language: JavaScript, so checklist items target JS traps like === and floating promises, not TypeScript's any-leaks and assertions. The notFor line says to switch the language mode in the code-review-prompt-generator for TypeScript, since the traps differ. The generator outputs a prompt; the FINAL VERDICT and any fixes remain your call.
It doesn't — the prompt says "Review only — report findings; do not rewrite the code," so each item comes back tagged [CRITICAL], [MAJOR], [MINOR], or [NIT] with its location, plus a FINAL VERDICT of APPROVED, APPROVED WITH COMMENTS, or CHANGES REQUIRED. Refactoring the flagged patterns is a separate step — notFor points to the Refactor Prompt Builder; treat findings as notes to verify.
"Review this code" gets shallow comments. The review contract gets findings with severities, a checklist, and a verdict.
Twelve security checks — injection, auth, secrets, SSRF, privilege escalation — reviewed the way an attacker would read the code.
Architecture review for the public surface: abstractions that earn their place, dependency direction, seams, and the patterns the codebase already has.
"Refactor this code" invites silent behavior changes. The refactoring contract preserves business rules, outputs, and side effects — and flags uncertainty instead of deciding it.
getByRole over CSS chains, auto-wait over sleep, web-first assertions — Playwright tests written the way Playwright wants.
A side-by-side way to decide between two ChatGPT prompt drafts — scored on clarity, specificity, output control, and risk instead of gut feeling.
Generate code review prompts for any scope — snippet, file, diff, or full pull request — with focused review rules.