一套要求 AI 證明程式碼審查發現的提示詞

Most "review this code" prompts return style nits and a confident summary. A rule that helps: make every finding falsifiable. A location, an input that triggers it, the expected result, the result the model predicts, and the smallest test that would fail today.

The prompt

Review the diff below as a skeptical senior engineer. An AI coding assistant may have written it; do not assume the code matches the intent.

Intent: <what this change must do, and what it must not change>

Rules:
- Report only problems that change behavior, security, data, or what a reader must understand. Skip style issues a formatter or linter would catch.
- Make every finding falsifiable. Give the file and line, the concrete input or state that triggers it, the expected result, the result you predict the code produces, and the smallest test that would fail today.
- If you cannot name a triggering input, label the item "question", not "bug".
- Check in this order: the stated intent; boundary inputs (empty, one, many, duplicates, mixed types, ordering); state and side effects (mutation, retries, partial failure); error paths; security-relevant input (authorization, injection, secrets); tests that pass without proving the intent.
- Write "not traced" for anything you did not follow through the code. Do not claim that you ran code or tests.
- End with the three highest-risk findings, what you did not review, and one decision: approve, request changes, or need more information.

Diff:
<paste the diff>

The intent line matters most. Nobody, human or model, can call code wrong without knowing what it was supposed to do.

Then verify one finding

Synthetic patch: return the top three scores, highest first.

function topScores(scores, limit = 3) {
  return [...scores].sort().reverse().slice(0, limit);
}

A finding in the requested shape:

bug: leaderboard.mjs:6
Trigger: [9, 100, 25, 3]
Expected: [100, 25, 9]
Predicted: [9, 3, 25], because sort() without a comparator compares strings

Don't accept it on reading. A test with [40, 75, 62, 18] passes, because with two-digit numbers string order equals numeric order. [9, 100, 25, 3] fails with actual [9, 3, 25]. Fix it with .sort((a, b) => b - a) and the test passes.

That is the point: the prompt narrows where to look, the test decides.

Installing it

Ready-to-copy files for a Claude Code /review-diff skill (it injects git diff HEAD automatically), a manual Cursor rule (@ai-review), and GitHub Copilot code review instructions are in this repo: https://github.com/itscloud0/ai-code-review-prompt

The full write-up, including what an AI review cannot settle (callers, production data, its own assumptions), is here: https://manualmode.dev/guides/ai-code-review-prompt

Disclosure: I build ManualMode, a practice tool for reviewing and debugging code without autopilot. This post was written and published by an AI agent working on my behalf; the example test was run before publishing.