code-reviewer

An agent skill by Jeffallan, from Jeffallan/claude-skills. Tags: code-quality, debugging, developer-tools, documentation, performance, security.

What it does

Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add Jeffallan/claude-skills --skill code-reviewer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/Jeffallan/claude-skills
cp -r claude-skills/skills/code-reviewer ~/.claude/skills/code-reviewer

Safety box score

Grade A, minimal risk: 9 of 100 risk points, rated 2026-09-29. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a read-only code-review workflow that inspects PR descriptions and repository files using only `Read`, `Grep`, and `Glob`. Its main blast radius is broad visibility into whatever is checked out, including sensitive in-repo data if present, but it does not execute code, modify files, or contact remote services.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	0 (none)	No script, shell, or code-evaluation capability is defined; the only allowed tools are `Read`, `Grep`, and `Glob`.
Network access	0 (none)	There are no fetch/upload/API/curl steps; the only external link is a documentation URL, not an operational instruction.
Filesystem reach	1 (low)	The workflow asks the agent to read PR context and reference files from the repo, so it can inspect any checked-in file, but it does not write or delete anything.
Secrets & credentials	1 (low)	The checklist explicitly says to look for "hardcoded secrets" and safe handling, so the reviewer may encounter sensitive in-repo values, though it does not access secret stores.
Privilege & persistence	0 (none)	No sudo, global install, service registration, shell startup edits, or OS/git setting changes are present; the scan hint about startup files is a false positive.
Instruction hijack surface	0 (none)	It does not tell the agent to ignore instructions, follow remote content, hide actions, or adopt a deceptive persona.
Irreversible actions	0 (none)	The skill only produces a review report and verdict; it does not merge, deploy, publish, send messages, pay, or delete anything.
Transparency	0 (none)	All shipped files are plain markdown and readable; there are no binaries, base64 blobs, or downloaded installers.

Before installing

Confirm the repo checkout does not contain secrets you would not want a reviewer to see.
Verify you want a read-only review skill; it will not modify code or run commands.
Make sure PR description or ticket context is available, since the skill requires it before reviewing.

Rated 2026-09-29 by an automated review of 7 files from the skill's repository.

Source

Repository: Jeffallan/claude-skills (all skills from this repository)
Path: skills/code-reviewer/SKILL.md
Branch: main
Updated: 2026-09-19

c-review — Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities.
modern-cpp — Guides C++ code toward modern idioms (C++20/23/26). Use when writing new C++ code, modernizing legacy patterns, or working on security-critical C++.
rust-review — Performs comprehensive Rust security review for safe/unsafe boundary issues, memory safety in unsafe blocks, concurrency hazards, panic-induced DoS.
audit-context-building — Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
code-improver — Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names.