Agent skill

Code Review

by timwuhaotian in timwuhaotian/the-pair

Comprehensive code review with security and performance checks

MITAuto-check passedDevelopment

Install Code Review

skills CLI
$ npx skills add timwuhaotian/the-pair --skill code-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install timwuhaotian/the-pair code-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/timwuhaotian/the-pair.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.opencode/skills/code-review .claude/skills/code-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
code-review
GitHub stars
378
Token cost
~250 tokens
SKILL.md length
97 words
Files
1
Skills in repo
1
Repo updated
First seen
Licence
MIT

At a glance

Comprehensive code review with security and performance checks

  • Works in 5 steps: Severity (Critical/High/Medium/Low) → Location (file:line) → Description of the issue → …
  • Tasks that involve Code review
  • SKILL.md covers What I do, Review checklist and Output format
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Code Review is an agent skill from timwuhaotian/the-pair. Comprehensive code review with security and performance checks

Its SKILL.md is about 250 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts. Compatibility notes: opencode

It sits in Development, covering Code review. It works with Google Gemini, Kimi, MiniMax and Qwen. The repository describes itself as: Open-source AI pair programming for desktop: a Mentor + Executor agent cross-check each other's code to catch AI hallucinations. Works with Claude Code, Codex, Gemini & opencode… The licence is MIT.

When your agent uses it

  • Tasks that involve Code review

Example prompts

  • “/code-review”

Requirements

  • Compatibility (from SKILL.md): opencode

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Severity (Critical/High/Medium/Low)
  2. Location (file:line)
  3. Description of the issue
  4. Specific code fix
  5. Explanation of why the fix works

What it can do on your machine

Read from SKILL.md and the folder at commit e2241b4. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md.

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

  • Compatibility

    opencode

    From compatibility in the SKILL.md frontmatter.

Context cost

Code Review loads about 250 tokens when it runs. Until then it costs about 19 tokens; SKILL.md has 97 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~19
When it runs · the whole SKILL.md, loaded when a task matches
~250

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from timwuhaotian/the-pair at commit e2241b4, republished under its MIT licence (© timwuhaotian). 97 words, ~250 tokens.

Download SKILL.mdSave it as .claude/skills/code-review/SKILL.md (or your agent's skills folder).
name
code-review
description
Comprehensive code review with security and performance checks
compatibility
opencode
license
MIT
metadata.audience
developers
metadata.workflow
review

What I do

  • Review code changes for bugs, security issues, and performance problems
  • Check code style and best practices
  • Identify potential edge cases
  • Suggest specific improvements with code examples

Review checklist

Security
  • SQL injection vulnerabilities
  • XSS vulnerabilities
  • Authentication/authorization issues
  • Sensitive data exposure
  • Input validation
Performance
  • Inefficient algorithms
  • Unnecessary database queries
  • Missing indexes
  • Memory leaks
  • Blocking operations
Code Quality
  • Error handling
  • Edge cases
  • Code duplication
  • Naming clarity
  • Test coverage

Output format

For each issue found, provide:

  1. Severity (Critical/High/Medium/Low)
  2. Location (file:line)
  3. Description of the issue
  4. Specific code fix
  5. Explanation of why the fix works

© timwuhaotian, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .opencode/skills/code-review of timwuhaotian/the-pair.

Open the folder on GitHubat commit e2241b4

Compare with similar skills

Code Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Code Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Code Review this skilltimwuhaotian/the-pair378—~250Automated safety check: PassMIT
Deep Reviewdyad-sh/dyad22k—~1.4kAutomated safety check: PassCustom licence
Paper ReviewRapidAI/MaClaw146—~1kAutomated safety check: PassMIT
Subagentethanhq/cc-fleet215—~4.9kAutomated safety check: PassApache-2.0
Subagentethanhq/cc-fleet215—~4.3kAutomated safety check: PassApache-2.0
LLM Council on Fireworks AIdair-ai/dair-academy-plugins614—~5kAutomated safety check: NotesMIT

Similar skills

  • Deep Review

    dyad-sh/dyad

    Deep multi-agent code review run locally — a fleet of parallel finder agents reviews the diff from independent angles, then adversarial verifier agents reproduce each finding before it is reported.

    22k GitHub stars~1.4k tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Paper Review

    RapidAI/MaClaw

    论文深度解读 Skill — 下载论文PDF → LLM深度解读(问题/创新点/方法原理/实验分析)→ PDF图片提取 → 生成组会PPT → 生成解读音频MP3。端到端学术论文解读工具。

    146 GitHub stars~1k tokensUpdated today
    Documents & OfficeAuto-check passed
  • Subagent

    ethanhq/cc-fleet

    Fan out a one-shot or flat parallel batch of cc-fleet PROVIDER subagents (headless cc-fleet subagent) that return a result — DeepSeek / GLM / Kimi / Qwen / MiniMax, or a Codex/Claude subscription.

    215 GitHub stars~4.9k tokensUpdated 9 days ago
    Agent WorkflowsAuto-check passed
  • Subagent

    ethanhq/cc-fleet

    Run a one-shot or flat parallel batch of provider LLM subagents (headless cc-fleet subagent) that return a result.

    215 GitHub stars~4.3k tokensUpdated 9 days ago
    Agent WorkflowsAuto-check passed
  • LLM Council on Fireworks AI

    dair-ai/dair-academy-plugins

    Has several open-weight models answer a question, rank each other's anonymized answers, then lets a chairman model write the final response through Fireworks AI.

    614 GitHub stars~5k tokensUpdated 2 mo ago
    AI & LLM EngineeringAuto-check: notes
  • OmniRoute Chat CLI

    diegosouzapw/OmniRoute

    Sends chat completions, streams responses, and opens an interactive REPL against any OmniRoute-routed model provider.

    74k GitHub starsUsed in 1 repo~345 tokens
    AI & LLM EngineeringAuto-check passed

Categories

Questions about Code Review

What does Code Review do?

Comprehensive code review with security and performance checks. Code Review is an agent skill from timwuhaotian/the-pair.

When should I use Code Review?

Code Review fits situations like: tasks that involve Code review.

How do I install Code Review in Claude Code?

Run `npx skills add timwuhaotian/the-pair --skill code-review -a claude-code`. Or copy the skill folder (.opencode/skills/code-review in timwuhaotian/the-pair) into .claude/skills/code-review in your project. Claude Code loads it when a task matches its description.

How do I install Code Review in Codex?

Run `npx skills add timwuhaotian/the-pair --skill code-review -a codex`. Or copy the skill folder (.opencode/skills/code-review in timwuhaotian/the-pair) into .agents/skills/code-review in your project. Codex loads it when a task matches its description.

Can I use Code Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add timwuhaotian/the-pair --skill code-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/code-review, .gemini/skills/code-review, .github/skills/code-review and .opencode/skills/code-review in your project.

What does Code Review need to run?

SKILL.md names no scripts, command-line tools or credentials: Code Review is instructions for the agent only. Compatibility (from SKILL.md): opencode.

Does Code Review access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Code Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Code Review use?

Code Review is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Code Review use?

About 250 tokens (SKILL.md is roughly 1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Code Review?

Skills that share tags, products or a category with Code Review: Deep Review (dyad-sh/dyad, 22k stars), Paper Review (RapidAI/MaClaw, 146 stars), Subagent (ethanhq/cc-fleet, 215 stars) and Subagent (ethanhq/cc-fleet, 215 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Code Review?

timwuhaotian (a GitHub user) maintains it in timwuhaotian/the-pair, which has 378 GitHub stars. The repository was last updated on October 6, 2026.

Source: timwuhaotian/the-pair on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.