Skills Explorer Add Skills

code-review

An agent skill by mattpocock, from mattpocock/skills. Tags: code-review, github, review, validation, workflow.

What it does

Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add mattpocock/skills --skill code-review

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/mattpocock/skills
cp -r skills/skills/engineering/code-review ~/.claude/skills/code-review

Safety box score

Grade B, low risk: 12 of 100 risk points, rated 2026-10-16. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This is a read-only code-review skill: it inspects `git diff`, `git log`, repo standards docs, and optional spec text, then asks sub-agents to review the change. It does not write files or change system settings, but it can surface whatever is already present in the repo history and diff, including any committed secrets.

Category levels, from 0 (none) to 3 (high)
CategoryLevelWhy
Code & shell execution1 (low)It directs the agent to run shell git commands such as `git diff <fixed-point>...HEAD`, `git log <fixed-point>..HEAD --oneline`, and `git rev-parse <fixed-point>`, but it does not evaluate arbitrary code.
Network access0 (none)The provided files do not name any remote hosts or download steps; the workflow is local repo inspection only.
Filesystem reach1 (low)It reads the repository diff, commit history, and standards/spec files under the workspace (for example `docs/`, `specs/`, `.scratch/`), but it does not write or delete files.
Secrets & credentials1 (low)Because it reviews the diff and commit history, any secrets accidentally committed in those ranges could be exposed in the review output, even though it does not directly access keychains or credential stores.
Privilege & persistence0 (none)There is no use of `sudo`, global installs, services, shell startup files, or other privileged system changes.
Instruction hijack surface0 (none)The skill does not instruct the agent to ignore higher-level rules, hide behavior, or follow remote instructions.
Irreversible actions0 (none)It only generates a review; it does not merge, deploy, publish, message, pay, book, or delete anything.
Transparency0 (none)All provided content is plain text; there are no binaries, minified blobs, or decoded-at-runtime snippets.

Before installing

Rated 2026-10-16 by an automated review of 2 files from the skill's repository.

Source

Repository
mattpocock/skills (all skills from this repository)
Path
skills/engineering/code-review/SKILL.md
Branch
main
Updated
2026-10-05