Code Reviewer

What it does

When your agent uses it

• Reviewing pull requests
• Conducting code quality audits
• Identifying refactoring opportunities
• Checking for security issues

Example prompts

• “Use the code-reviewer skill to analyz code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure…”
• “/code-reviewer”

Requirements

• Python 3
• Pre-approved tools (allowed-tools): Read, Grep, Glob

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1Context — Read PR description, understand the problem being solved. Checkpoint: Summarize the PR's intent in one sentence before…
2. 2Structure — Review architecture and design decisions. Ask: Does this follow existing patterns in the codebase? Are new abstractions…
3. 3Details — Check code quality, security, and performance. Apply the checks in the Reference Guide below. Ask: Are there N+1 queries…
4. 4Tests — Validate test coverage and quality. Ask: Are edge cases covered? Do tests assert behavior, not implementation?
5. 5Feedback — Produce a categorized report using the Output Template. If critical issues are found in step 3, note them immediately and do…

What it can do on your machine

Read from SKILL.md and the folder at commit 3cdd0ee. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Grep
  • Glob

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  No scripts in the folder and no shell commands in SKILL.md (its code samples are python).

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names no API keys, tokens, secrets or passwords.

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Code Reviewer loads about 1.3k tokens when it runs, and up to ~8.2k if it reads all its reference files. Until then it costs about 175 tokens; SKILL.md has 413 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~175

When it runs · the whole SKILL.md, loaded when a task matches

~1.3k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~8.2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from Yikai-Liao/symusic at commit 3cdd0ee, republished under its MIT licence (© Yikai-Liao). 413 words, ~1,265 tokens.

name

code-reviewer

description

Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass.

allowed-tools

Read, Grep, Glob

license

MIT

metadata.author

https://github.com/Jeffallan

metadata.version

1.1.0

metadata.domain

quality

metadata.triggers

code review, PR review, pull request, review code, code quality

metadata.role

specialist

metadata.scope

review

metadata.output-format

report

metadata.related-skills

security-reviewer, test-master, architecture-designer

<!-- Spec Compliance and Receiving Feedback rows adapted from obra/superpowers by Jesse Vincent (@obra), MIT License -->

# BAD: query inside loop
for user in users:
    orders = Order.objects.filter(user=user)  # N+1

# GOOD: prefetch in bulk
users = User.objects.prefetch_related('orders').all()

# BAD
if status == 3:
    ...

# GOOD
ORDER_STATUS_SHIPPED = 3
if status == ORDER_STATUS_SHIPPED:
    ...

# BAD: string interpolation in query
cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

# GOOD: parameterized query
cursor.execute("SELECT * FROM users WHERE id = %s", [user_id])

© Yikai-Liao, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (references) in .agents/skills/code-reviewer of Yikai-Liao/symusic.

• SKILL.md
• references/common-issues.md
• references/feedback-examples.md
• references/receiving-feedback.md
• references/report-template.md
• references/review-checklist.md
• references/spec-compliance-review.md

Open the folder on GitHubat commit 3cdd0ee

Used in 1 other repository

We found 1 copy of this SKILL.md (exact, near-identical or edited) in other folders, from 1 other GitHub owner. This page covers the copy in Yikai-Liao/symusic, which our catalogue first saw on October 7, 2026.

• Jeffallan/claude-skillsskills/code-reviewer