What this prompt does
This prompt runs a structured AI code review in Cursor as a first pass before human eyes are on the PR. You set the [language]/[framework] and describe the change with [pr_description], and the AI checks correctness against that description including edge cases from [edge_case_scenarios], runs a security scan for [security_concerns] such as injection and auth bypasses, analyzes performance for N+1 queries and unnecessary re-renders and blocking operations, verifies your [style_rules], assesses test coverage and names untested branches, flags naming and readability issues, and formats everything as a structured comment you can post directly on the PR.
The structure works because it follows a sensible review order: correctness first, then security, then performance. Checking whether the code actually does what [pr_description] claims catches the most expensive mistakes early, before anyone debates style. The [edge_case_scenarios] and [security_concerns] variables focus the scan on the risks that genuinely matter for this specific change rather than asking for a vague, generic pass that surfaces noise. The request for concrete code-example fixes rather than bare problem descriptions is what makes the output immediately actionable. And the structured-comment format is the difference between a usable review and a wall of prose you would have to reformat by hand before posting.
When to use it
- You want an AI first pass on a PR before you read it yourself
- The change has known
[edge_case_scenarios]you want checked explicitly rather than hoped about - Security matters and you want a focused scan for
[security_concerns]like injection or auth bypass - You suspect performance issues such as N+1 queries, unnecessary re-renders, or blocking operations
- You want test-coverage gaps and untested branches identified with suggested cases
- You need the review formatted as a comment that is ready to post on the PR without editing
Example output
You get a structured review comment: a correctness section measuring the code against [pr_description] and [edge_case_scenarios], a security section covering [security_concerns], a performance section flagging N+1 queries and re-renders, a style section against [style_rules], a test-coverage assessment with suggested cases, readability notes, and concrete code-example fixes — all formatted to paste directly onto the PR.
Pro tips
- Write
[pr_description]accurately; the correctness check is only meaningful against what the PR really claims to do - List the real
[edge_case_scenarios]for this change so the scan targets your actual risk surface, not generic cases - Name concrete
[security_concerns]rather than asking for a generic security pass that returns noise - Treat the output as a first pass, not a verdict; the AI misses the broader context a human reviewer has
- Ask for code-example fixes, not just problem descriptions, so every suggestion is immediately actionable
- Keep the structured-comment format; it is what makes the review usable directly on the PR without rework
