WooCommerce Code Review
woocommerce/woocommerce
Reviews WooCommerce code changes against the project's standards, flagging backend PHP architecture, naming, documentation, data integrity and testing violations.
Perform a structured security and quality audit on source code.
Install Code Review
$ npx skills add agulli/atlas-agents --skill code-review -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install agulli/atlas-agents code-review --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .claude/skills && cp -r skills-src/ch09_agent_skills/skills/code-review .claude/skills/code-review && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "code-review" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-review into .claude/skills/code-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-reviewType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add agulli/atlas-agents --skill code-review -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install agulli/atlas-agents code-review --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .agents/skills && cp -r skills-src/ch09_agent_skills/skills/code-review .agents/skills/code-review && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "code-review" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-review into .agents/skills/code-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add agulli/atlas-agents --skill code-review -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install agulli/atlas-agents code-review --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/ch09_agent_skills/skills/code-review .cursor/skills/code-review && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "code-review" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-review into .cursor/skills/code-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/agulli/atlas-agents.git --path ch09_agent_skills/skills/code-review--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add agulli/atlas-agents --skill code-review -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install agulli/atlas-agents code-review --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/ch09_agent_skills/skills/code-review .gemini/skills/code-review && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "code-review" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-review into .gemini/skills/code-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install agulli/atlas-agents code-reviewInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add agulli/atlas-agents --skill code-review -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .github/skills && cp -r skills-src/ch09_agent_skills/skills/code-review .github/skills/code-review && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "code-review" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-review into .github/skills/code-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add agulli/atlas-agents --skill code-review -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install agulli/atlas-agents code-review --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/agulli/atlas-agents.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/ch09_agent_skills/skills/code-review .opencode/skills/code-review && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "code-review" agent skill from https://github.com/agulli/atlas-agents/tree/main/ch09_agent_skills/skills/code-review into .opencode/skills/code-review/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "code-review", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
code-review- GitHub stars
- 579
- Token cost
- ~593 tokens
- SKILL.md length
- 280 words
- Files
- 1
- Skills in repo
- 12
- Repo updated
- First seen
- Licence
- MIT
At a glance
Perform a structured security and quality audit on source code.
- Works in 5 steps: Read the target files. Use file_read or… → Security pass. Check for OWASP Top 10… → Logic pass. Check for → …
- Asked to review code
- SKILL.md covers Overview, Process, Rationalizations and Verification
- Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md
What it does
Code Review is an agent skill from agulli/atlas-agents. Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
Its SKILL.md is about 590 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: Requires python 3.10+
It sits in Development, covering Code review, Code quality and Pull requests. The licence is MIT.
When your agent uses it
- Asked to review code
- Audit a pull request
- Check for vulnerabilities
- Assess code quality
Example prompts
- “/code-review”
Requirements
- Python 3
- Compatibility (from SKILL.md): Requires python 3.10+
- Pre-approved tools (allowed-tools): Bash(grep:*), Bash(rg:*), Read
Workflow steps
5 steps, taken from the first numbered list in SKILL.md.
- Read the target files. Use file_read or equivalent to load every file under review. Do not review from memory or summaries.
- Security pass. Check for OWASP Top 10 vulnerabilities in this order
- Logic pass. Check for
- Style pass. Flag only violations that affect readability or correctness
- Write the report as structured JSON with severity (critical/high/medium/low), file, line, and description for each finding.
What it can do on your machine
Read from SKILL.md and the folder at commit 2b21998. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
Bash(grep:*)Bash(rg:*)Read
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Requires python 3.10+
From compatibility in the SKILL.md frontmatter.
Context cost
Code Review loads about 593 tokens when it runs. Until then it costs about 45 tokens; SKILL.md has 280 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
The full file from agulli/atlas-agents at commit 2b21998, republished under its MIT licence (© agulli). 280 words, ~593 tokens.
Download SKILL.mdSave it as
.claude/skills/code-review/SKILL.md (or your agent's skills folder).- name
- code-review
- description
- Perform a structured security and quality audit on source code. Use when asked to review code, audit a pull request, check for vulnerabilities, or assess code quality.
- allowed-tools
- Bash(grep:*), Bash(rg:*), Read
- compatibility
- Requires python 3.10+
- license
- MIT
Overview
You are conducting a code review as a principal engineer with security expertise. This is not a courtesy scan — you are the last gate before production.
Process
- Read the target files. Use
file_reador equivalent to load every file under review. Do not review from memory or summaries. - Security pass. Check for OWASP Top 10 vulnerabilities in this order:
- SQL injection (string concatenation in queries)
- Path traversal (
../in file operations without validation) - Command injection (
os.system,subprocesswithshell=True) - Hardcoded secrets (API keys, passwords, tokens in source)
- Insecure deserialization (
pickle.loads,yaml.loadwithout SafeLoader)
- Logic pass. Check for:
- Unhandled exceptions that silently swallow errors
- Race conditions in concurrent code
- Off-by-one errors in loops and slicing
- Mutable default arguments in function signatures
- Style pass. Flag only violations that affect readability or correctness:
- Functions longer than 50 lines
- Deeply nested conditionals (>3 levels)
- Unused imports or variables
- Write the report as structured JSON with
severity(critical/high/medium/low),file,line, anddescriptionfor each finding.
Rationalizations
| Excuse | Rebuttal |
|---|---|
| "The code looks fine at a glance" | You must read every line. Glancing is not reviewing. |
| "This is just a small change" | Small changes cause production outages. Review the diff AND the surrounding context. |
| "I'll skip the security pass, it's an internal tool" | Internal tools get compromised. The security pass is mandatory. |
| "There are too many files to review" | Review them all. If there are more than 20 files, summarize findings per-directory. |
Verification
Do not mark this review as complete until you have:
- Read every file under review (not summarized, not skimmed)
- Produced a JSON report with at least one finding (even if it's "no issues found")
- Categorized every finding by severity
© agulli, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
Just SKILL.md in ch09_agent_skills/skills/code-review of agulli/atlas-agents.
Open the folder on GitHubat commit 2b21998
Compare with similar skills
Code Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Code Review this skillagulli/atlas-agents | 579 | — | ~593 | Automated safety check: Pass | MIT | |
| WooCommerce Code Reviewwoocommerce/woocommerce | 11k | 3 repos | ~1.1k | Automated safety check: Pass | Custom licence | |
| Code Review Skillawesome-skills/code-review-skill | 2.1k | — | ~2.8k | Automated safety check: Notes | MIT | |
| Code Reviewerjewbetcha/opentrace | 116 | 2 repos | ~1.1k | Automated safety check: Notes | MIT | |
| Code Review SkillRain-kl/OpenFlare | 288 | — | ~2.3k | Automated safety check: Notes | MIT | |
| Code ReviewerYikai-Liao/symusic | 189 | 1 repos | ~1.3k | Automated safety check: Pass | MIT |
Similar skills
Code Review Skill
awesome-skills/code-review-skill
Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, Java 8, PHP, Ruby, Rails, Python, Django, FastAPI, Go, C/.NET, Kotlin, Swift, Dart…
Code Reviewer
jewbetcha/opentrace
Comprehensive code review skill for TypeScript, JavaScript, Python, Swift, Kotlin, Go.
Code Review Skill
Rain-kl/OpenFlare
Provides comprehensive code review guidance for React 19, Vue 3, Angular 17+, Svelte 5, Rust, TypeScript, Java, PHP, Python, Django, Go, C/.NET, Kotlin, Swift, NestJS, C/C++, and more.
Code Reviewer
Yikai-Liao/symusic
Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then…
Code Review Specialist
lhfer/claude-howto-zh-cn
Structured code review across security, performance, code quality and maintainability, with a checklist, a finding template and two Python scripts for complexity metrics.
More from agulli/atlas-agents
All 12 skills in this repoAPI Design
agulli/atlas-agents
Design or review REST and GraphQL API interfaces. An agent skill from agulli/atlas-agents.
Data Pipeline
agulli/atlas-agents
Design, build, or debug data processing pipelines. An agent skill from agulli/atlas-agents.
Database Migration
agulli/atlas-agents
Safely run database schema migrations. An agent skill from agulli/atlas-agents.
Deploy Checklist
agulli/atlas-agents
Execute a structured deployment to staging or production. An agent skill from agulli/atlas-agents.
Documentation Writer
agulli/atlas-agents
Write or update technical documentation for code, APIs, or systems.
Git Commit
agulli/atlas-agents
Create well-structured git commits with conventional commit messages.
Related
Categories
Questions about Code Review
What does Code Review do?
Perform a structured security and quality audit on source code. Code Review is an agent skill from agulli/atlas-agents. Perform a structured security and quality audit on source code.
When should I use Code Review?
Code Review fits situations like: asked to review code; audit a pull request; check for vulnerabilities; assess code quality.
How do I install Code Review in Claude Code?
Run `npx skills add agulli/atlas-agents --skill code-review -a claude-code`. Or copy the skill folder (ch09_agent_skills/skills/code-review in agulli/atlas-agents) into .claude/skills/code-review in your project. Claude Code loads it when a task matches its description.
How do I install Code Review in Codex?
Run `npx skills add agulli/atlas-agents --skill code-review -a codex`. Or copy the skill folder (ch09_agent_skills/skills/code-review in agulli/atlas-agents) into .agents/skills/code-review in your project. Codex loads it when a task matches its description.
Can I use Code Review in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add agulli/atlas-agents --skill code-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/code-review, .gemini/skills/code-review, .github/skills/code-review and .opencode/skills/code-review in your project.
What does Code Review need to run?
SKILL.md names no scripts, command-line tools or credentials: Code Review is instructions for the agent only. Our summary lists: Python 3. Its frontmatter pre-approves these tools: Bash(grep:*), Bash(rg:*), Read. Compatibility (from SKILL.md): Requires python 3.10+.
Does Code Review access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Code Review safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Code Review use?
Code Review is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Code Review use?
About 593 tokens (SKILL.md is roughly 2.4k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Code Review?
Skills that share tags, products or a category with Code Review: WooCommerce Code Review (woocommerce/woocommerce, 11k stars), Code Review Skill (awesome-skills/code-review-skill, 2.1k stars), Code Reviewer (jewbetcha/opentrace, 116 stars) and Code Review Skill (Rain-kl/OpenFlare, 288 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Code Review?
agulli (a GitHub user) maintains it in agulli/atlas-agents, which has 579 GitHub stars. The repository holds 12 skills in this directory. The repository was last updated on July 17, 2026.
Source: agulli/atlas-agents on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.