code-review-and-quality
An agent skill by addyosmani, from addyosmani/agent-skills. Tags: debugging, developer-tools, documents.
What it does
Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add addyosmani/agent-skills --skill code-review-and-qualityOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/addyosmani/agent-skills
cp -r agent-skills/skills/code-review-and-quality ~/.claude/skills/code-review-and-qualitySafety box score
Grade A, minimal risk: 0 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is pure documentation for code review quality gates; it ships no executable code, network access, or filesystem actions. Its main effect is process-level guidance for how an agent reviews changes, not direct risk to the host machine or user data.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 0 (none) | `SKILL.md` is plain text only; there are no scripts, shell commands, or code-evaluation hooks to run. |
| Network access | 0 (none) | The skill contains no download/upload logic, remote fetches, or external API calls. |
| Filesystem reach | 0 (none) | It does not read, write, or delete files on the machine; it is only a review rubric in `SKILL.md`. |
| Secrets & credentials | 0 (none) | There is no code or guidance that touches tokens, passwords, keychains, `.env` files, or browser sessions. |
| Privilege & persistence | 0 (none) | No sudo, service registration, shell startup edits, or other privilege changes appear in the shipped files. |
| Instruction hijack surface | 0 (none) | The text gives review instructions but does not tell the agent to ignore higher-priority rules, hide actions, or follow untrusted remote instructions. |
| Irreversible actions | 0 (none) | It does not send messages, deploy, publish, delete, or otherwise act outside the review context; it only advises on code review decisions. |
| Transparency | 0 (none) | The package is fully readable Markdown with no binaries, installers, base64 blobs, or generated code to audit. |
Before installing
- Read `SKILL.md` and confirm its review rubric matches your team's merge policy.
- If you want stricter or lighter gates, decide that before enabling it so the agent's approval standard is aligned.
- Verify your local copy contains only the Markdown file and no added scripts or hidden assets.
Rated 2026-10-19 by an automated review of 1 file from the skill's repository.
Source
- Repository
- addyosmani/agent-skills (all skills from this repository)
- Path
- skills/code-review-and-quality/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- constraint-driven-development — Establishes a project's quality bar as a written contract and stops agents quietly lowering it.
- deprecation-and-migration — Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another.
- doubt-driven-development — Subjects every non-trivial decision to a fresh-context adversarial review before it stands.
- archify-review — Review Archify issues, PRs, or code through value, cost, and impact to support evidence-based maintenance decisions.
- intended-vs-implemented — The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they.
- obsidian-cli — Interact with Obsidian vaults using the Obsidian CLI to read, create, search, and manage notes, tasks, properties, and more.