Code Review
- 3 installs
- Updated May 25, 2026
- hermeticormus/code-review-skills
code-review is an agent skill that reviews diffs using a domain classifier so review depth matches algorithm, API, security, data, UI, or infrastructure risks.
About
code-review is an agent skill for solo builders who want PR feedback that matches what kind of code changed, not a laundry list of generic nits. You point the agent at a diff; it classifies domains such as algorithms, APIs, security, data access, UI, or infrastructure, then emphasizes the risks that domain actually ships—rate limits and validation for APIs, injection and exposure for security, N+1 and migrations for data layers, accessibility and state for frontend. The workflow keeps attention on whether the change introduced new reachability for bugs, aligning with how small teams review before merge. It deliberately defers holistic production readiness and deep security hardening to sibling skills in the same family. Intermediate complexity: you need enough context to trust domain labels, but you do not need a formal review template. Best during Ship and when iterating on fixes tied to recent merges.
- Review the diff and surrounding context, not the entire file—findings outside the diff only if newly reachable
- Six-domain classifier: algorithm, API/network, security, data, UI/frontend, infrastructure
- Per-domain review focus (complexity, OWASP, N+1, a11y, CI config failure modes)
- Explicitly scoped to everyday changes—not production-readiness (mars-skills) or hardening (vibe-proof-skills)
- Domain-first checklist instead of a single generic style pass
Code Review by the numbers
- 3 all-time installs (skills.sh)
- Ranked #923 of 1,352 Code Review & Quality skills by installs in the Skillselion catalog
- Data as of Aug 2, 2026 (Skillselion catalog sync)
npx skills add https://github.com/hermeticormus/code-review-skills --skill code-reviewAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 3 |
|---|---|
| Last updated | May 25, 2026 |
| Repository | hermeticormus/code-review-skills ↗ |
What it does
Review everyday PRs and diffs by classifying the change domain first, then checking the failure modes that domain actually has.
Who is it for?
Best when you're merging frequent small PRs and want structured, risk-aware review without running a full audit toolchain.
Skip if: Launch-day production readiness sign-off or dedicated security hardening—the skill points to mars-skills and vibe-proof-skills for those.
When should I use this skill?
When reviewing a change on an everyday diff or pull request; use mars-skills for production-readiness and vibe-proof-skills for security hardening.
What you get
You get domain-targeted review notes on the diff, with clear scope that everyday PR review is separate from production-readiness or full security hardening passes.
- Domain-labeled review findings scoped to the diff
- Risk-focused notes per algorithm/API/security/data/UI/infrastructure
By the numbers
- 6 code domains in the classifier table
Files
Code review
Review the everyday diff or pull request by classifying the code's domain first, then applying the checklist for that domain. One generic pass over all code surfaces formatting nits and misses the failure mode that ships the incident.
1. Review the change, not the file
Read the diff, not the whole file. Read enough surrounding context to judge correctness, no more. A finding outside the diff matters only if the change made it newly reachable or newly wrong.
2. Classify the code domain
| Domain | Indicators | Review focus |
|---|---|---|
| Algorithm | Loops, recursion, data structures, sorting or searching | Complexity, edge cases, correctness |
| API or network | HTTP, requests, endpoints, REST, GraphQL | Error handling, rate limiting, auth, validation |
| Security | Auth, crypto, passwords, tokens, user input | OWASP top 10, injection, data exposure |
| Data | SQL, ORM, database, queries, transactions | N+1, indexes, consistency, migrations |
| UI or frontend | React, components, DOM, CSS, events | Accessibility, performance, state |
| Infrastructure | Docker, K8s, CI/CD, configs, scripts | Security, idempotency, failure modes |
A change can span domains. Apply each matching checklist; do not pick one silently.
3. Apply the matching focus checklist
- Algorithm: correctness for all inputs, Big-O, edge cases (empty, single, max, duplicates), readability of the invariant.
- API or network: error handling on timeout and 4xx/5xx, input validation before business logic, auth and authz, rate limiting and idempotent retries.
- Security: input validation at the boundary, injection (SQL, command, XSS, template, deserialization), secret handling, server-side access control.
- Data: N+1 queries, transaction atomicity and isolation, index usage at production row counts, backward-compatible migrations.
- UI: accessibility, render performance, state correctness, effect cleanup and async races.
- Infrastructure: least privilege, idempotent apply, partial-failure and rollback path, observability.
4. Assign severity to every finding
- Critical (must fix): wrong output, data loss, security hole, broken contract. Blocks merge.
- Improvement (should fix): correct but fragile, slow at scale, missing a newly reachable edge case.
- Nitpick (optional): naming, style, clarity.
A finding you cannot assign a severity to is not yet specific enough to report.
5. Structure the feedback
## Summary
[1-2 sentence overview of what the change does]
## Domain: [detected domain(s)]
## Critical (must fix)
- [ ] [file:line] Description + concrete suggestion
## Improvements (should fix)
- [ ] [file:line] Description + concrete suggestion
## Nitpicks (optional)
- [ ] [file:line] Description
## What's correct
- Observation the author got rightEvery finding cites a location and proposes a direction, not just a complaint.
---
See full content at https://github.com/HermeticOrmus/code-review-skills.
Related skills
Improve Codebase ArchitectureSafely deepen clusters of shallow modules into cohesive, testable units while respecting their external dependencies.566k196k
Caveman ReviewGet ultra-compressed, one-line code review comments that cut noise while keeping every actionable fix.270k94.7kCodebase DesignShared vocabulary for designing deep modules: improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable.266k196kCavecrewDelegate coding tasks to specialized subagents that return compressed output, keeping the main context window usable for much longer sessions.220k94.7kCode ReviewReviews a branch or PR diff on two axes at once: conformance to coding standards plus a code-smell baseline, and whether it actually implements the original spec.201k196k
Requesting Code ReviewDispatch a consistent, high-signal code reviewer subagent that catches plan deviations and quality issues before merging or continuing development.183k264kHow it compares
Use for domain-scoped diff review on a PR, not as a replacement for automated test suites or dedicated security scanners.
FAQ
Who is code-review for?
and small-team developers using AI agents to review GitHub-style diffs before merge when they cannot afford a human reviewer on every change.
When should I use code-review?
In Ship → review on every meaningful PR; in Build when validating integration diffs; in Operate → iterate when reviewing hotfix branches for regressions.
Is code-review safe to install?
Review skill source and permissions; use the Security Audits panel on this Prism page and avoid piping secrets into review prompts.