What are the best code review skills for Claude Code?

AI writes more of the code, which makes review the bottleneck - and the place agents help most. The requesting-code-review skill leads the category at 159,110 installs (skills.sh registry).

Key takeaways

• requesting-code-review (159,110 installs) and receiving-code-review (131,069 installs) from obra/superpowers (249,358 GitHub stars) model review as two roles, not one; the field is ranked at best skills for testing and review.
• code-review by mattpocock is the top standalone reviewer at 43,778 installs and 160,485 stars (skills.sh registry, GitHub).
• Specialist reviewers exist per layer: sql-code-review (11,740 installs), frontend-code-review from langgenius/dify (8,652 installs), and security-review (11,295 installs).
• The pattern ports across agents - google-gemini/gemini-cli ships its own code-reviewer at 8,141 installs and 105,837 stars.
• Skillselion's Code Review & Quality shelf sits in the testing and review category within a 60,702-skill live catalog.

Why use a skill instead of just asking for a review?

A bare "review this" prompt produces unfocused nitpicks; a review skill encodes what to look for, in what order, and what to ignore. That is the same reason human teams write review guidelines - Google's engineering practices codify theirs publicly - and the adoption numbers show developers agree: the two superpowers review skills alone account for 290,179 combined installs (159,110 + 131,069, skills.sh registry). The skills also standardize output, so a review reads the same whether it ran today or last month.

What is the best code review skill for Claude Code?

requesting-code-review from obra/superpowers is the best pick at 159,110 installs, backed by the repo's 249,358 GitHub stars (skills.sh registry, GitHub). Install it with:

npx skills add obra/superpowers

Its insight is splitting the workflow: requesting-code-review packages the diff with context so a reviewer agent can judge it, while its sibling receiving-code-review (131,069 installs) governs how the author agent triages and applies the feedback instead of blindly accepting every note. Strong alternatives: code-review by mattpocock (43,778 installs) as a direct single-pass reviewer, and code-review-excellence (24,356 installs) for a rubric-driven pass. The full ranking is on the best skills for testing and review pillar.

Should you use specialist reviewers per layer?

Yes, once the general pass is in place - a generic reviewer misses layer-specific failure modes. sql-code-review (11,740 installs) knows about injection patterns and index use; postgresql-code-review from the same repo (11,099 installs) goes deeper on one engine; frontend-code-review from langgenius/dify (8,652 installs, 148,161 stars) checks component and state concerns (all skills.sh registry, GitHub). Chain them: general review first, then the specialist for whichever layer the diff touches. The dev tools category holds the adjacent linting and CI skills these compose with.

How does a security review fit in?

Run it as a separate pass with a separate skill, because security review optimizes for different findings than quality review. security-review (11,295 installs, 227,216 stars, skills.sh registry, GitHub) checks the diff for injection, authentication gaps, and secret leakage rather than style and structure. Keeping the passes separate also keeps the reports honest - a combined review buries one critical security finding under twenty style notes. Related tooling lives in the security category.

Do code review skills work with Codex and Gemini CLI?

The pattern is agent-portable, and the ecosystems have converged on it. google-gemini/gemini-cli ships code-reviewer (8,141 installs, 105,837 stars, skills.sh registry, GitHub) for Gemini users, and skills written as plain SKILL.md instructions - like the superpowers pair - run under any agent that reads the format, Codex included. Developers building review into a Codex SDK pipeline typically wire the same request-review, receive-review split as a pair of agent roles.

A complete starter stack

• requesting-code-review (159,110 installs) - packages diffs for a reviewer agent.
• receiving-code-review (131,069 installs) - triages feedback instead of auto-accepting it.
• code-review (43,778 installs) - fast single-pass reviews for small diffs.
• security-review (11,295 installs) - the dedicated security pass.
• sql-code-review (11,740 installs) - the database-layer specialist.

Common pitfalls

• Letting the author agent review its own diff in the same session - it defends its choices; use a fresh reviewer context.
• Auto-applying every review note; receiving-code-review exists (131,069 installs, skills.sh registry) because triage is half the workflow.
• Running only the security pass on "risky" diffs - the injection bug is always in the diff nobody flagged.

Split the roles, add specialists per layer, and keep security as its own pass.

Common questions