Now liveThe Skillselion MCP - thousands of ranked skills, loaded into your agent mid-task. No install.Get it →
aiskillstore avatar

Code Review

aiskillstore/marketplace

  • 4 installs
  • 404 repo stars
  • Updated August 5, 2026
  • aiskillstore/marketplace

This is a copy of code-review by akillness - installs and ranking accrue to the original listing.

code-review is a Claude Code skill that conducts thorough, constructive code reviews for quality and security across pull requests.

About

code-review is a Claude Code skill that conducts thorough code reviews of pull requests. It walks through context, high-level design, detailed code checks, security, performance, testing, and documentation. A developer uses it when reviewing a PR, checking code quality, or auditing for security and bugs. It ends by providing constructive, specific feedback.

  • Runs a multi-step code review across correctness, security, performance, and testing
  • Includes explicit checklists for naming, SOLID, error handling, and input validation
  • Frames feedback constructively with good-versus-bad examples

Code Review by the numbers

  • 4 all-time installs (skills.sh)
  • Data as of Aug 5, 2026 (Skillselion catalog sync)
At a glance

code-review capabilities & compatibility

Capabilities
code review · security audit · performance review · test coverage review
Use cases
code review · security audit · testing
From the docs

What code-review says it does

Conduct thorough, constructive code reviews for quality and security. Use when reviewing pull requests, checking code quality, identifying bugs, or auditing security.
SKILL.md
allowed-tools: Read Grep Glob
SKILL.md
npx skills add https://github.com/aiskillstore/marketplace --skill code-review

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

Listed on Skillselion
Installs4
repo stars★ 404
Last updatedAugust 5, 2026
Repositoryaiskillstore/marketplace ↗

What it does

Review a pull request for correctness, security, performance, and test coverage with structured feedback.

Who is it for?

Reviewing pull requests and auditing code quality, security, and performance.

Skip if: Refactoring code or explaining it to non-technical stakeholders.

When should I use this skill?

You are reviewing a pull request, checking code quality, or auditing security.

What you get

A prioritized, constructive review covering correctness, security, performance, testing, and docs.

  • Structured code review
  • Security findings
  • Constructive line-level feedback

Files

SKILL.mdMarkdownGitHub ↗

Code Review

When to use this skill

  • Reviewing pull requests
  • Checking code quality
  • Providing feedback on implementations
  • Identifying potential bugs
  • Suggesting improvements
  • Security audits
  • Performance analysis

Instructions

Step 1: Understand the context

Read the PR description:

  • What is the goal of this change?
  • Which issues does it address?
  • Are there any special considerations?

Check the scope:

  • How many files changed?
  • What type of changes? (feature, bugfix, refactor)
  • Are tests included?

Step 2: High-level review

Architecture and design:

  • Does the approach make sense?
  • Is it consistent with existing patterns?
  • Are there simpler alternatives?
  • Is the code in the right place?

Code organization:

  • Clear separation of concerns?
  • Appropriate abstraction levels?
  • Logical file/folder structure?

Step 3: Detailed code review

Naming:

  • [ ] Variables: descriptive, meaningful names
  • [ ] Functions: verb-based, clear purpose
  • [ ] Classes: noun-based, single responsibility
  • [ ] Constants: UPPER_CASE for true constants
  • [ ] Avoid abbreviations unless widely known

Functions:

  • [ ] Single responsibility
  • [ ] Reasonable length (< 50 lines ideally)
  • [ ] Clear inputs and outputs
  • [ ] Minimal side effects
  • [ ] Proper error handling

Classes and objects:

  • [ ] Single responsibility principle
  • [ ] Open/closed principle
  • [ ] Liskov substitution principle
  • [ ] Interface segregation
  • [ ] Dependency inversion

Error handling:

  • [ ] All errors caught and handled
  • [ ] Meaningful error messages
  • [ ] Proper logging
  • [ ] No silent failures
  • [ ] User-friendly errors for UI

Code quality:

  • [ ] No code duplication (DRY)
  • [ ] No dead code
  • [ ] No commented-out code
  • [ ] No magic numbers
  • [ ] Consistent formatting

Step 4: Security review

Input validation:

  • [ ] All user inputs validated
  • [ ] Type checking
  • [ ] Range checking
  • [ ] Format validation

Authentication & Authorization:

  • [ ] Proper authentication checks
  • [ ] Authorization for sensitive operations
  • [ ] Session management
  • [ ] Password handling (hashing, salting)

Data protection:

  • [ ] No hardcoded secrets
  • [ ] Sensitive data encrypted
  • [ ] SQL injection prevention
  • [ ] XSS prevention
  • [ ] CSRF protection

Dependencies:

  • [ ] No vulnerable packages
  • [ ] Dependencies up-to-date
  • [ ] Minimal dependency usage

Step 5: Performance review

Algorithms:

  • [ ] Appropriate algorithm choice
  • [ ] Reasonable time complexity
  • [ ] Reasonable space complexity
  • [ ] No unnecessary loops

Database:

  • [ ] Efficient queries
  • [ ] Proper indexing
  • [ ] N+1 query prevention
  • [ ] Connection pooling

Caching:

  • [ ] Appropriate caching strategy
  • [ ] Cache invalidation handled
  • [ ] Memory usage reasonable

Resource management:

  • [ ] Files properly closed
  • [ ] Connections released
  • [ ] Memory leaks prevented

Step 6: Testing review

Test coverage:

  • [ ] Unit tests for new code
  • [ ] Integration tests if needed
  • [ ] Edge cases covered
  • [ ] Error cases tested

Test quality:

  • [ ] Tests are readable
  • [ ] Tests are maintainable
  • [ ] Tests are deterministic
  • [ ] No test interdependencies
  • [ ] Proper test data setup/teardown

Test naming:

# Good
def test_user_creation_with_valid_data_succeeds():
    pass

# Bad
def test1():
    pass

Step 7: Documentation review

Code comments:

  • [ ] Complex logic explained
  • [ ] No obvious comments
  • [ ] TODOs have tickets
  • [ ] Comments are accurate

Function documentation:

def calculate_total(items: List[Item], tax_rate: float) -> Decimal:
    """
    Calculate the total price including tax.

    Args:
        items: List of items to calculate total for
        tax_rate: Tax rate as decimal (e.g., 0.1 for 10%)

    Returns:
        Total price including tax

    Raises:
        ValueError: If tax_rate is negative
    """
    pass

README/docs:

  • [ ] README updated if needed
  • [ ] API docs updated
  • [ ] Migration guide if breaking changes

Step 8: Provide feedback

Be constructive:

✅ Good:
"Consider extracting this logic into a separate function for better
testability and reusability:

def validate_email(email: str) -> bool:
    return '@' in email and '.' in email.split('@')[1]

This would make it easier to test and reuse across the codebase."

❌ Bad:
"This is wrong. Rewrite it."

Be specific:

✅ Good:
"On line 45, this query could cause N+1 problem. Consider using
.select_related('author') to fetch related objects in a single query."

❌ Bad:
"Performance issues here."

Prioritize issues:

  • 🔴 Critical: Security, data loss, major bugs
  • 🟡 Important: Performance, maintainability
  • 🟢 Nice-to-have: Style, minor improvements

Acknowledge good work:

"Nice use of the strategy pattern here! This makes it easy to add
new payment methods in the future."

Review checklist

Functionality

  • [ ] Code does what it's supposed to do
  • [ ] Edge cases handled
  • [ ] Error cases handled
  • [ ] No obvious bugs

Code Quality

  • [ ] Clear, descriptive naming
  • [ ] Functions are small and focused
  • [ ] No code duplication
  • [ ] Consistent with codebase style
  • [ ] No code smells

Security

  • [ ] Input validation
  • [ ] No hardcoded secrets
  • [ ] Authentication/authorization
  • [ ] No SQL injection vulnerabilities
  • [ ] No XSS vulnerabilities

Performance

  • [ ] No obvious bottlenecks
  • [ ] Efficient algorithms
  • [ ] Proper database queries
  • [ ] Resource management

Testing

  • [ ] Tests included
  • [ ] Good test coverage
  • [ ] Tests are maintainable
  • [ ] Edge cases tested

Documentation

  • [ ] Code is self-documenting
  • [ ] Comments where needed
  • [ ] Docs updated
  • [ ] Breaking changes documented

Common issues

Anti-patterns

God class:

# Bad: One class doing everything
class UserManager:
    def create_user(self): pass
    def send_email(self): pass
    def process_payment(self): pass
    def generate_report(self): pass

Magic numbers:

# Bad
if user.age > 18:
    pass

# Good
MINIMUM_AGE = 18
if user.age > MINIMUM_AGE:
    pass

Deep nesting:

# Bad
if condition1:
    if condition2:
        if condition3:
            if condition4:
                # deeply nested code

# Good (early returns)
if not condition1:
    return
if not condition2:
    return
if not condition3:
    return
if not condition4:
    return
# flat code

Security vulnerabilities

SQL Injection:

# Bad
query = f"SELECT * FROM users WHERE id = {user_id}"

# Good
query = "SELECT * FROM users WHERE id = %s"
cursor.execute(query, (user_id,))

XSS:

// Bad
element.innerHTML = userInput;

// Good
element.textContent = userInput;

Hardcoded secrets:

# Bad
API_KEY = "sk-1234567890abcdef"

# Good
API_KEY = os.environ.get("API_KEY")

Best practices

1. Review promptly: Don't make authors wait 2. Be respectful: Focus on code, not the person 3. Explain why: Don't just say what's wrong 4. Suggest alternatives: Show better approaches 5. Use examples: Code examples clarify feedback 6. Pick your battles: Focus on important issues 7. Acknowledge good work: Positive feedback matters 8. Review your own code first: Catch obvious issues 9. Use automated tools: Let tools catch style issues 10. Be consistent: Apply same standards to all code

Tools to use

Linters:

  • Python: pylint, flake8, black
  • JavaScript: eslint, prettier
  • Go: golint, gofmt
  • Rust: clippy, rustfmt

Security:

  • Bandit (Python)
  • npm audit (Node.js)
  • OWASP Dependency-Check

Code quality:

  • SonarQube
  • CodeClimate
  • Codacy

References

Examples

Example 1: Basic usage

<!-- Add example content here -->

Example 2: Advanced usage

<!-- Add advanced example content here -->

Related skills

mattpocockImprove Codebase ArchitectureSafely deepen clusters of shallow modules into cohesive, testable units while respecting their external dependencies.566k196kjuliusbrusseeCaveman ReviewGet ultra-compressed, one-line code review comments that cut noise while keeping every actionable fix.270k94.7kmattpocockCodebase DesignShared vocabulary for designing deep modules: improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable.266k196kjuliusbrusseeCavecrewDelegate coding tasks to specialized subagents that return compressed output, keeping the main context window usable for much longer sessions.220k94.7kmattpocockCode ReviewReviews a branch or PR diff on two axes at once: conformance to coding standards plus a code-smell baseline, and whether it actually implements the original spec.201k196kobraRequesting Code ReviewDispatch a consistent, high-signal code reviewer subagent that catches plan deviations and quality issues before merging or continuing development.183k264k

FAQ

What does the review cover?

Best practices, SOLID principles, security vulnerabilities, performance analysis, and testing coverage.

What tools does it use?

Its allowed tools are Read, Grep, and Glob for reading and searching code.

Code Review & Qualitygittesting
Browse by category
AI & AgentsFrontend & DesignBackend & DataDev ToolsAutomationTesting & ReviewSecurityMonitoring & CloudDocs & Planning
Design & frontend
Design systemsAnimation & motionAccessibility (a11y)CSS & TailwindUI designUXDesign to codeshadcn/uiLanding pagesBest design skills
Most searched skills
find-skillscavemanfrontend-designbrainstormingsystematic-debuggingstop-slopemil-design-engui-ux-pro-maxkarpathy-guidelinesweb-design-guidelinesreact-best-practicesgrill-meimprovemicrosoft-foundryagent-browser
Browse all listings
All agent skillsAll MCP serversAll marketplacesAll plugins

This week in AI coding

Five minutes, every Monday - the tools, releases and tactics for developers.

unsubscribe anytime.