Code Review
OfficialFreeAutomate your code review process for security and performance.
Free · Opens the source repo
What Code Review does
The Code Review skill enables developers to efficiently assess code changes through a structured analysis focusing on security, performance, correctness, and maintainability. By providing a PR URL or a diff, users can receive detailed feedback on their code before merging it into the main branch. This skill is particularly useful for teams looking to ensure high-quality code and minimize the risk of introducing vulnerabilities or performance issues.
When invoked, the skill evaluates the provided code against a comprehensive set of criteria. It checks for common security vulnerabilities such as SQL injection and XSS, performance concerns like N+1 queries and memory leaks, and correctness issues including edge cases and error handling. The output includes actionable suggestions with code examples, helping developers understand how to improve their code effectively.
This skill is designed for software developers and teams who want to enhance their code review process. By integrating security and performance checks into the review workflow, it helps maintain high standards of code quality. Additionally, when connected to source control or project management tools, it can pull PR diffs automatically and link findings to relevant tickets, making it an even more powerful tool in a developer's toolkit.
Overall, the Code Review skill streamlines the review process, ensuring that code changes are not only functional but also secure and efficient. It supports the goal of delivering robust software while reducing the likelihood of post-deployment issues.
When to use it
Use this skill when you want to review a code change for security, performance, or correctness, especially before merging it into the main branch.
When not to use it
This skill is not suitable for reviewing code that is already in production or for assessing non-code artifacts like documentation or design.
What you can build with it
Pre-Merge Code Review
Use this skill to review a pull request before merging, ensuring security and performance standards are met.
Performance Optimization
Invoke the skill to analyze code for performance issues like N+1 queries or memory leaks during development.
Security Assessment
Utilize the skill to check for common security vulnerabilities in code changes, helping to safeguard your application.
How to install Code Review
View source1. Install with the skills CLI
npx skills add anthropics/knowledge-work-plugins/code-review --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by anthropics/code-review
If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.
Review code changes with a structured lens on security, performance, correctness, and maintainability.
Usage
/code-review <PR URL or file path>
Review the provided code changes: @$1
If no specific file or URL is provided, ask what to review.
How It Works
┌─────────────────────────────────────────────────────────────────┐
│ CODE REVIEW │
├─────────────────────────────────────────────────────────────────┤
│ STANDALONE (always works) │
│ ✓ Paste a diff, PR URL, or point to files │
│ ✓ Security audit (OWASP top 10, injection, auth) │
│ ✓ Performance review (N+1, memory leaks, complexity) │
│ ✓ Correctness (edge cases, error handling, race conditions) │
│ ✓ Style (naming, structure, readability) │
│ ✓ Actionable suggestions with code examples │
├─────────────────────────────────────────────────────────────────┤
│ SUPERCHARGED (when you connect your tools) │
│ + Source control: Pull PR diff automatically │
│ + Project tracker: Link findings to tickets │
│ + Knowledge base: Check against team coding standards │
└─────────────────────────────────────────────────────────────────┘
Review Dimensions
Security
- SQL injection, XSS, CSRF
- Authentication and authorization flaws
- Secrets or credentials in code
- Insecure deserialization
- Path traversal
- SSRF
Performance
- N+1 queries
- Unnecessary memory allocations
- Algorithmic complexity (O(n²) in hot paths)
- Missing database indexes
- Unbounded queries or loops
- Resource leaks
Correctness
- Edge cases (empty input, null, overflow)
- Race conditions and concurrency issues
- Error handling and propagation
- Off-by-one errors
- Type safety
Maintainability
- Naming clarity
- Single responsibility
- Duplication
- Test coverage
- Documentation for non-obvious logic
Output
## Code Review: [PR title or file]
### Summary
[1-2 sentence overview of the changes and overall quality]
### Critical Issues
| # | File | Line | Issue | Severity |
|---|------|------|-------|----------|
| 1 | [file] | [line] | [description] | 🔴 Critical |
### Suggestions
| # | File | Line | Suggestion | Category |
|---|------|------|------------|----------|
| 1 | [file] | [line] | [description] | Performance |
### What Looks Good
- [Positive observations]
### Verdict
[Approve / Request Changes / Needs Discussion]
If Connectors Available
If ~~source control is connected:
- Pull the PR diff automatically from the URL
- Check CI status and test results
If ~~project tracker is connected:
- Link findings to related tickets
- Verify the PR addresses the stated requirements
If ~~knowledge base is connected:
- Check changes against team coding standards and style guides
Tips
- Provide context — "This is a hot path" or "This handles PII" helps me focus.
- Specify concerns — "Focus on security" narrows the review.
- Include tests — I'll check test coverage and quality too.
Frequently asked questions about Code Review
Similar skills
Quality Playbook Generator
Run comprehensive quality audits on any codebase.
PR Draft Summary
Automate PR summary generation for openai-agents-python.
Final Release Review
Streamline your release candidate audits with ease.
Unit Test Vue Pinia
Efficiently write and review unit tests for Vue 3 applications.
Slang Shader Expert
Optimize and integrate Slang shaders with ease.
Telemetry Standards
Ensure consistent event tracking in Supabase Studio.