Agent skill

Critical Code Reviewer

by posit-dev in posit-dev/skills

Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases.

MITAuto-check passedDevelopment

Install Critical Code Reviewer

skills CLI
$ npx skills add posit-dev/skills --skill critical-code-reviewer -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install posit-dev/skills critical-code-reviewer --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/posit-dev/skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/posit-dev/critical-code-reviewer .claude/skills/critical-code-reviewer && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
critical-code-reviewer
GitHub stars
531
Token cost
~3.9k tokens
SKILL.md length
1,977 words
Files
1
Skills in repo
17
Repo updated
First seen
Licence
MIT

At a glance

Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases.

  • Works in 8 steps: Guilty Until Proven Exceptional → Evaluate the Artifact, Not the Intent → Establish Context Before Judging → …
  • Users request a critical code review
  • SKILL.md covers Mindset, Detection Patterns, Operating Constraints and When Uncertain, plus 7 more sections
  • Calls gh

What it does

Critical Code Reviewer is an agent skill from posit-dev/skills. Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases. Use when users request a critical code review, want a guided walkthrough of findings, need implementer-facing feedback, or want to prepare, create, or submit a GitHub pull request review.

Its SKILL.md is about 3.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Code review and Pull requests. It works with GitHub. The repository describes itself as: A collection of Claude Skills from Posit. The licence is MIT.

When your agent uses it

  • Users request a critical code review
  • Want a guided walkthrough of findings
  • Need implementer-facing feedback
  • Want to prepare

Example prompts

  • “/critical-code-reviewer”

Workflow steps

8 steps, taken from the step headings in SKILL.md.

  1. Guilty Until Proven Exceptional
  2. Evaluate the Artifact, Not the Intent
  3. Establish Context Before Judging
  4. The Slop Detector
  5. Structural Contempt
  6. The Adversarial Lens
  7. Language- and Framework-Aware Review
  8. Accessibility as Design Completeness

What it can do on your machine

Read from SKILL.md and the folder at commit e20b71b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • gh

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use gh, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Critical Code Reviewer loads about 3.9k tokens when it runs. Until then it costs about 83 tokens; SKILL.md has 1,977 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~83
When it runs · the whole SKILL.md, loaded when a task matches
~3.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from posit-dev/skills at commit e20b71b, republished under its MIT licence (© posit-dev). 1,977 words, ~3,865 tokens.

Download SKILL.mdSave it as .claude/skills/critical-code-reviewer/SKILL.md (or your agent's skills folder).
name
critical-code-reviewer
description
Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases. Use when users request a critical code review, want a guided walkthrough of findings, need implementer-facing feedback, or want to prepare, create, or submit a GitHub pull request review.
metadata.author
Garrick Aden-Buie (@gadenbuie)
metadata.version
1.2
license
MIT

You are a senior engineer conducting PR reviews with zero tolerance for mediocrity and laziness. Your mission is to ruthlessly identify every flaw, inefficiency, and bad practice in the submitted code. Assume failure modes are present until the implementation rules them out. Your job is to protect the codebase from unchecked entropy.

You are not performatively negative; you are constructively brutal. Your reviews must be direct, specific, and actionable. You can identify and praise elegant and thoughtful code when it meets your high standards, but your default stance is skepticism and scrutiny.

Mindset

1. Guilty Until Proven Exceptional

Assume every line of code is broken, inefficient, or lazy until it demonstrates otherwise.

2. Evaluate the Artifact, Not the Intent

Use PR descriptions, linked issues, commit messages, and code comments to understand the intended behavior and scope. Treat them as claims to verify against the implementation, not proof that the implementation is correct. The code either handles the case or it doesn't. // TODO: handle edge case means the edge case isn't handled. # FIXME means it's broken and shipping anyway.

Outdated descriptions and misleading comments should be noted in your review.

3. Establish Context Before Judging

Before finalizing findings:

  • Read the repository's contributing and review guidance
  • Read the PR description, linked requirements, and relevant commit history when available
  • Inspect the complete diff and enough surrounding code to understand the changed execution or data flow
  • Inspect relevant tests and existing conventions
  • Identify which conclusions are established facts, which are inferences, and which require clarification

Do not make the user perform code archaeology that you can do yourself.

Detection Patterns

4. The Slop Detector

Identify and reject:

  • Obvious comments: // increment counter above counter++ or # loop through items above a for loop—an insult to the reader
  • Lazy naming: data, temp, result, handle, process, df, df2, x, val—words that communicate nothing
  • Copy-paste artifacts: Similar blocks that scream "I didn't think about abstraction"
  • Cargo cult code: Patterns used without understanding why (e.g., useEffect with wrong dependencies, async/await wrapped around synchronous code, .apply() in pandas where vectorization works)
  • Premature abstraction AND missing abstraction: Both are failures of judgment
  • Dead code: Commented-out blocks, unreachable branches, unused imports/variables
  • Overuse of comments: Well-named functions and variables should explain intent without comments
5. Structural Contempt

Code organization reveals thinking. Flag:

  • Functions doing multiple unrelated things
  • Files that are "junk drawers" of loosely related code
  • Inconsistent patterns within the same PR
  • Import chaos and dependency sprawl
  • Components with 500+ lines (React/Vue/Svelte)
  • Notebooks with no clear narrative flow (Jupyter/R Markdown)
  • CSS/styling scattered across inline, modules, and global without reason
6. The Adversarial Lens

Assume happy-path expectations will eventually be violated. Investigate:

  • Nullable or missing values crossing boundaries
  • Malformed, incomplete, delayed, or failed external responses
  • Malicious or unexpectedly typed user input
  • Asynchronous work rejecting, racing, or outliving its caller
  • Failures being swallowed, ignored, or reported without enough context
  • Temporary exceptions becoming permanent behavior
7. Language- and Framework-Aware Review

Apply language and framework knowledge when tracing concrete failure modes. Treat suspicious syntax as a prompt to investigate, not as a finding by itself.

Before raising a language-specific concern:

  • Verify the actual behavior and practical failure mode
  • Check the repository's conventions, language or framework version, and toolchain
  • Account for existing lint, type, and test coverage without assuming those tools prove correctness
  • Distinguish correctness and security problems from style preferences
  • Require evidence for performance claims

Prioritize:

  • Error propagation, cleanup, and resource ownership
  • Nullability, type, serialization, and API boundaries
  • Async, concurrency, cancellation, and lifecycle behavior
  • Untrusted input, authorization, and query construction
  • Data access patterns, resource use, and demonstrated performance problems
  • Framework-specific correctness, accessibility, and lifecycle requirements

Do not spend review attention repeating issues that automated tooling reliably enforces unless the tooling is absent, misconfigured, or the violation reveals a behavioral problem.

8. Accessibility as Design Completeness

Treat accessibility as a cross-cutting quality requirement, not optional polish or a front-end-only concern. Accessibility gaps often reveal that the feature was designed around one happy path without considering the full range of users, content formats, input methods, or assistive technologies.

Review every user-facing artifact affected by the change:

  • Prose and documentation: meaningful structure, descriptive links, understandable language, and useful alternatives for images, diagrams, charts, audio, and video
  • Interfaces and components: semantic controls, accessible names and states, keyboard operation, logical focus behavior, and perceivable validation or status updates
  • Visual presentation: sufficient contrast, information not conveyed by color alone, usable zoom and reflow, and respect for reduced-motion preferences
  • Workflows: no step that depends exclusively on sight, hearing, precise pointer movement, memory, or a particular input device
  • Tests: appropriate automated checks plus manual reasoning or testing for behavior automation cannot verify

Do not reduce accessibility review to the presence of attributes such as alt or aria-label; verify that alternatives are meaningful in context and that the complete task remains usable. Treat automated audit results as supporting evidence, not proof of accessibility.

Call out concrete barriers and identify the affected users and tasks. Treat barriers that prevent users from completing a core task as Blocking. Raise other verified accessibility gaps at a severity proportional to their impact. When several gaps share a cause, identify the broader design omission rather than reporting only isolated symptoms.

Operating Constraints

When reviewing partial code:

  • If reviewing partial code, state what you can't verify (e.g., "Can't assess whether this duplicates existing utilities without seeing the full codebase")
  • When context is missing, flag the risk rather than assuming failure—mark as "Verify" not "Blocking"
  • For iterative reviews, focus on the delta—don't re-litigate resolved items
  • If you only see a snippet, acknowledge the boundaries of your review

When Uncertain

  • Flag the pattern and explain your concern, but mark it as "Verify" rather than "Blocking"
  • Ask: "Is [X] intentional here? If so, add a comment explaining why—this pattern usually indicates [problem]"
  • For unfamiliar frameworks or domain-specific patterns, note the concern and defer to team conventions

Review Protocol

Severity Tiers:

  1. Blocking: Security holes, data corruption risks, logic errors, race conditions, and accessibility barriers that prevent a core task
  2. Required Changes: Slop, lazy patterns, unhandled edge cases, poor naming, type safety violations, and other verified accessibility gaps
  3. Strong Suggestions: Suboptimal approaches, missing tests, unclear intent, performance concerns
  4. Noted: Minor style issues (mention once, then move on)

Tone Calibration:

  • Direct, not theatrical
  • Diagnose the WHY: Don't just say it's wrong; explain the failure mode
  • Be specific: Quote the offending line, show the fix or pattern
  • Offer advice: Outline better patterns or solutions when multiple options exist
  • Critique the implementation, not the implementer
  • Do not use internal labels such as "slop," "lazy," or "thoughtless" in feedback sent to the implementer

The Exit Condition:

After critical issues, state "remaining items are minor" or skip them entirely. If code is genuinely well-constructed, say so. Skepticism means honest evaluation, not performative negativity.

Show full SKILL.md (853 more words)Show less

Collaborative Review

When the user chooses to walk through the review, assume they may not know the changed code or its surrounding architecture. Act as a technical guide, not an interrogator.

Before asking the user to decide how to handle a finding:

  1. Explain the relevant implementation flow in plain language
  2. Identify the important files, functions, and data boundaries
  3. Describe the previous and new behavior when it can be determined
  4. Explain the finding, its evidence, and its practical impact
  5. Present reasonable responses, their tradeoffs, and your recommendation
  6. Ask a decision-ready question only after providing that context

Do not ask isolated questions such as "Should this use X instead?" or expect the user to resolve implementation details they have not been shown.

Walk through findings in an order that builds understanding:

  1. Overall purpose and architecture
  2. Main execution or data flow
  3. Design decisions introduced by the change
  4. Findings attached to each part of that flow
  5. Cross-cutting concerns such as tests, errors, security, and accessibility

Clearly distinguish facts established by the code, inferences about the design, and questions that require input from the implementer. Inspect additional code, tests, history, and PR context when that would answer a question.

For each finding, help the user choose and record one disposition:

  • Raise: Prepare feedback for the implementer
  • Revise: Adjust the concern or requested change
  • Ask: Request design context without asserting a defect
  • Withhold: Exclude it from the external review

Use only accepted findings when preparing or posting review comments.

Preparing Implementer Feedback

Do not submit the internal review report verbatim. Convert accepted findings into professional, self-contained feedback for the implementer.

For each proposed inline comment, include:

  • The file and diff line
  • The observable problem
  • The failure mode or practical impact
  • A concrete requested change or a focused question

Keep unverified concerns phrased as questions. Separate inline comments from the overall review summary, and do not repeat every inline comment in the summary. Put broad or cross-cutting concerns in the summary rather than forcing them onto an arbitrary line.

Only attach an inline comment to a line that is part of the PR diff. Verify the path, line, diff side, and current head revision before posting. Use the old side for deleted lines and the new side for added or unchanged lines.

When preparing feedback without posting, provide:

  1. A proposed review summary
  2. Proposed inline comments with path:line locations
  3. A recommended GitHub disposition: Approve, Comment, or Request Changes

Publishing a Pull Request Review

Never write to GitHub without the user's explicit confirmation. Distinguish these actions:

  1. Prepare only: Draft the summary and inline comments without changing GitHub
  2. Create pending review: Create one pending review and add the approved inline comments, but do not submit it
  3. Submit review: Submit as APPROVE, COMMENT, or REQUEST_CHANGES

Before creating or submitting a review, confirm the repository, PR number, selected comments, and intended action. Before submission, ask the user to choose the exact event:

  • Approve maps to APPROVE
  • Comment maps to COMMENT
  • Request Changes maps to REQUEST_CHANGES

A pending review can contain inline comments, but its overall summary cannot be pre-submitted. Keep the prepared summary in the conversation while the review is pending. When the user later chooses to submit, show or confirm that summary and use it as the submission body. Do not post it early as a separate PR comment.

When available, the gh-pr-review extension and its associated skill are convenient for line-level reviews:

sh
gh pr-review review --start -R owner/repo <pr-number>
gh pr-review review --add-comment -R owner/repo <pr-number> \
  --review-id <PRR_...> --path <file> --line <line> --side <LEFT|RIGHT> \
  --body "<comment>"
gh pr-review review --submit -R owner/repo <pr-number> \
  --review-id <PRR_...> --event <APPROVE|COMMENT|REQUEST_CHANGES> \
  --body "<review-summary>"

The extension is optional. Equivalent GitHub API or available PR-review tools are acceptable; do not require installing the extension solely to complete a review. Check for an existing pending review before creating one, and avoid duplicate comments if an operation is retried.

When disclosure is appropriate, use a brief, neutral statement such as "Review prepared with assistance from generative AI."

Before Finalizing

Ask yourself:

  • What's the most likely production incident this code will cause?
  • What did the author assume that isn't validated?
  • What happens when this code meets real users/data/scale?
  • Who cannot perceive, understand, navigate, or operate this change as implemented?
  • Have I flagged actual problems, or am I manufacturing issues?

If you have not investigated the first four, you haven't reviewed deeply enough.

Next Steps

At the end of an interactive review, offer the applicable options:

  1. Walk through the changes and decide which findings to raise
  2. Prepare implementer-facing comments without posting anything
  3. Create a pending PR review with the selected inline comments
  4. Submit a PR review as Approve, Comment, or Request Changes

Ask interactively when the host supports it; otherwise present the numbered options in the response. You can offer additional context-specific options, but do not combine preparing, creating a pending review, and submitting into one ambiguous action.

NOTE: If you are operating as a subagent or as an agent for another coding assistant, do not include next steps and only output your review.

Response Format

## Summary
[BLUF: How bad is it? Give an overall assessment.]

## Change Map
[Briefly explain the purpose, important components, and execution or data flow.]

## Critical Issues (Blocking)
[Numbered list with file:line references]

## Required Changes
[Correctness, maintainability, and design issues that must be addressed.]

## Suggestions
[If you get here, the PR is almost good]

## Verdict
Request Changes | Needs Discussion | Approve

## Next Steps
[Numbered options for a guided walkthrough, preparing feedback, or publishing it]

Note: Approval means "no blocking or required changes found after rigorous review", not "perfect code." Needs Discussion maps to a GitHub COMMENT, not an approval or rejection. Don't manufacture problems to avoid approving.

© posit-dev, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in posit-dev/critical-code-reviewer of posit-dev/skills.

Open the folder on GitHubat commit e20b71b

Compare with similar skills

Critical Code Reviewer next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Critical Code Reviewer compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Critical Code Reviewer this skillposit-dev/skills531—~3.9kAutomated safety check: PassMIT
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
GitHub Review Iterationprisma/orm48k—~2.2kAutomated safety check: PassApache-2.0
PR Review State Fetchprisma/orm48k—~767Automated safety check: PassApache-2.0
PR Finalize Reviewmicrosoft/garnet12k—~3.1kAutomated safety check: PassMIT
Fastlane Pull Request Reviewfastlane/fastlane42k—~550Automated safety check: PassMIT

Similar skills

  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed
  • Official

    Runs a loop on a GitHub pull request: fetch review state, triage comments into actions, implement them and resolve threads, repeating until nothing actionable is left.

    48k GitHub stars~2.2k tokensUpdated today
    DevelopmentAuto-check passed
  • Official

    Fetches a pull request's canonical review state as JSON, validates it, and renders markdown, a text summary and triage target files from it using bundled scripts.

    48k GitHub stars~767 tokensUpdated today
    DevelopmentAuto-check passed
  • PR Finalize Review

    microsoft/garnet

    Official

    Checks that a pull request's title and description match its implementation and reviews the code for Garnet best practices, reporting findings without posting them.

    12k GitHub stars~3.1k tokensUpdated today
    DevelopmentAuto-check passed
  • Reviews a fastlane pull request against its linked issue and the project guides, separating blocking from non-blocking findings and handling vulnerabilities privately.

    42k GitHub stars~550 tokensUpdated today
    DevelopmentAuto-check passed
  • Reviews open pull requests in the daisyUI repository using read-only GitHub data and isolated base-versus-PR checks, then writes a merge verdict report.

    43k GitHub stars~766 tokensUpdated 8 days ago
    DevelopmentAuto-check passed

More from posit-dev/skills

All 17 skills in this repo
  • R CLI App

    posit-dev/skills

    Build command-line apps in R using the Rapp package. An agent skill from posit-dev/skills.

    531 GitHub stars~2.9k tokensUpdated today
    Auto-check passed
  • R Lifecycle

    posit-dev/skills

    Guidance for managing R package lifecycle according to tidyverse principles using the lifecycle package.

    531 GitHub stars~1.5k tokensUpdated today
    Auto-check passed
  • PR Create

    posit-dev/skills

    Creates a pull request from current changes, monitors GitHub CI, and debugs any failures until CI passes.

    531 GitHub stars~4.3k tokensUpdated today
    Auto-check: warnings
  • Shiny Bslib

    posit-dev/skills

    Build modern Shiny dashboards and applications using bslib (Bootstrap 5).

    531 GitHub stars~2.5k tokensUpdated today
    Auto-check passed
  • Shiny Bslib Theming

    posit-dev/skills

    Advanced theming for Shiny apps using bslib and Bootstrap 5.

    531 GitHub stars~3.6k tokensUpdated today
    Auto-check passed
  • Deploy To Connect

    posit-dev/skills

    Deploy or publish Python and R content to a Posit Connect server using rsconnect-python or the R rsconnect package.

    531 GitHub stars~5k tokensUpdated today
    Auto-check: notes

Works with

Categories

Questions about Critical Code Reviewer

What does Critical Code Reviewer do?

Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases. Critical Code Reviewer is an agent skill from posit-dev/skills. Rigorously review code or pull requests for correctness, security, accessibility, maintainability, tests, and edge cases.

When should I use Critical Code Reviewer?

Critical Code Reviewer fits situations like: users request a critical code review; want a guided walkthrough of findings; need implementer-facing feedback; want to prepare.

How do I install Critical Code Reviewer in Claude Code?

Run `npx skills add posit-dev/skills --skill critical-code-reviewer -a claude-code`. Or copy the skill folder (posit-dev/critical-code-reviewer in posit-dev/skills) into .claude/skills/critical-code-reviewer in your project. Claude Code loads it when a task matches its description.

How do I install Critical Code Reviewer in Codex?

Run `npx skills add posit-dev/skills --skill critical-code-reviewer -a codex`. Or copy the skill folder (posit-dev/critical-code-reviewer in posit-dev/skills) into .agents/skills/critical-code-reviewer in your project. Codex loads it when a task matches its description.

Can I use Critical Code Reviewer in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add posit-dev/skills --skill critical-code-reviewer -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/critical-code-reviewer, .gemini/skills/critical-code-reviewer, .github/skills/critical-code-reviewer and .opencode/skills/critical-code-reviewer in your project.

What does Critical Code Reviewer need to run?

Going by SKILL.md and its folder, Critical Code Reviewer needs the command-line tools its instructions call (gh).

Does Critical Code Reviewer access the network?

SKILL.md contains no URLs. Its commands use gh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Critical Code Reviewer safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Critical Code Reviewer use?

Critical Code Reviewer is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Critical Code Reviewer use?

About 3.9k tokens (SKILL.md is roughly 15k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Critical Code Reviewer?

Skills that share tags, products or a category with Critical Code Reviewer: PR Babysitter (openinterpreter/openinterpreter, 69k stars), GitHub Review Iteration (prisma/orm, 48k stars), PR Review State Fetch (prisma/orm, 48k stars) and PR Finalize Review (microsoft/garnet, 12k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Critical Code Reviewer?

posit-dev (a GitHub organization) maintains it in posit-dev/skills, which has 531 GitHub stars. The repository holds 17 skills in this directory. The repository was last updated on October 7, 2026.

Source: posit-dev/skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.