code-review
An agent skill by phuryn, from phuryn/pm-skills. Tags: api, cli, debugging, developer-tools.
What it does
Review code for actionable defects. Correctness is the core; performance and security are optional sub-cases of the same engine. Anchors on agreements between participants across a boundary, forces a violating execution, and refutes every candidate before reporting. Use when asked to review changes, find bugs, audit a codebase, or check whether a fix is safe.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add phuryn/pm-skills --skill code-reviewOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/phuryn/pm-skills
cp -r pm-skills/pm-ai-shipping/skills/code-review ~/.claude/skills/code-reviewSafety box score
Grade A, minimal risk: 0 of 100 risk points, rated 2026-09-29. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This is a documentation-only code-review skill: it ships markdown guidance and reference files, not executable code. It does not introduce direct machine, account, or data access; the main effect is to steer how an agent reasons about reviews.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | The inventory is only `SKILL.md` and three reference markdown files; no scripts, code blocks to execute, or installers are present. |
| Network access | 0 (none) | There are no commands, fetches, API calls, or outbound data flows defined in the shipped files. |
| Filesystem reach | 0 (none) | The skill describes review methodology only and does not instruct reads/writes/deletes outside the repository. |
| Secrets & credentials | 0 (none) | No token, password, key, `.env`, or credential-store access is mentioned anywhere in the files. |
| Privilege & persistence | 0 (none) | The skill does not request sudo, global installs, services, scheduled tasks, or OS/git setting changes. |
| Instruction hijack surface | 0 (none) | The content is procedural guidance for code review; it does not tell the agent to ignore its rules, hide actions, or follow external instructions. |
| Irreversible actions | 0 (none) | It does not deploy, publish, merge, pay, message, or delete anything; it only defines a review workflow. |
| Transparency | 0 (none) | All shipped content is plain markdown; there are no binaries, obfuscated blobs, or runtime-generated payloads. |
Before installing
- Confirm the installed skill directory contains only the four markdown files shown, with no companion scripts or binaries.
- If you expect broader behavior, inspect the referenced `references/*.md` files first; they only affect review guidance, not system state.
Rated 2026-09-29 by an automated review of 4 files from the skill's repository.
Source
- Repository
- phuryn/pm-skills (all skills from this repository)
- Path
- pm-ai-shipping/skills/code-review/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- dwarf-expert — Analyzes DWARF debug information in compiled binaries.
- modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
- intended-vs-implemented — The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they.
- sql-queries — Generate SQL queries from natural language descriptions. Supports BigQuery, PostgreSQL, MySQL, and other dialects.
- claude-api — Reference for the Claude API / Anthropic SDK — model ids, pricing, params, streaming, tool use, MCP, agents, caching, token counting, model migration.
- context-engineering-collection — A comprehensive collection of Agent Skills for context engineering, harness engineering, multi-agent architectures, and production agent systems.