requesting-code-review
An agent skill by obra, from obra/superpowers. Tags: api, developer-tools, web.
What it does
Use when completing tasks, implementing major features, or before merging to verify work meets requirements
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add obra/superpowers --skill requesting-code-reviewOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/obra/superpowers
cp -r superpowers/skills/requesting-code-review ~/.claude/skills/requesting-code-reviewSafety box score
Grade A, minimal risk: 4 of 100 risk points, rated 2026-10-21. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill is a review-workflow prompt bundle: it tells an agent to dispatch a code-review subagent and provide it with local git range context. It does not ship executable code or perform side effects itself; the main risk is limited to prompt shaping and the expectation that reviewers can inspect repository history read-only.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 1 (low) | The template asks the reviewer to run read-only git commands (`git rev-parse`, `git diff`), but there is no shipped script or code execution beyond local inspection. |
| Network access | 0 (none) | No downloading, uploading, API calls, or remote-host communication is described in `SKILL.md` or `code-reviewer.md`. |
| Filesystem reach | 0 (none) | The files only reference reading local git history and diffs; they do not write, delete, or modify files outside the checkout. |
| Secrets & credentials | 0 (none) | There is no request to access tokens, passwords, `.env` files, browser sessions, or other credential stores. |
| Privilege & persistence | 0 (none) | Nothing here asks for sudo, global installs, services, scheduled tasks, or shell/OS configuration changes. |
| Instruction hijack surface | 0 (none) | The prompt is opinionated, but it does not tell the agent to ignore safeguards, hide behavior, follow fetched instructions, or otherwise bypass its rules. |
| Irreversible actions | 0 (none) | The skill only recommends asking for code review before merge or after tasks; it does not itself push, deploy, post, pay, or delete. |
| Transparency | 0 (none) | Both files are plain markdown; there are no binaries, encoded blobs, or uninspectable installers. |
Before installing
- Read `code-reviewer.md` to confirm you want review agents to use local `git diff`/`git rev-parse` for read-only inspection.
- Verify the workflow fits your repo policy: it assumes access to commit history but no network, secrets, or write access.
Rated 2026-10-21 by an automated review of 2 files from the skill's repository.
Source
- Repository
- obra/superpowers (all skills from this repository)
- Path
- skills/requesting-code-review/SKILL.md
- Branch
- main
- Updated
- 2026-09-19
Related skills
- executing-plans — Use when executing an implementation plan in the current session as the implementer yourself — your human partner chose inline execution.
- finishing-a-development-branch — Use when implementation is complete, all tests pass, and you need to decide how to integrate the work
- receiving-code-review — Use when receiving code review feedback, before implementing suggestions.
- systematic-debugging — Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
- test-driven-development — Use when implementing any feature or bugfix, before writing implementation code
- using-git-worktrees — Use when starting feature work that needs isolation from current workspace or before executing implementation plans - ensures an isolated workspace exists via.