skill-reviewer

An agent skill by daymade, from daymade/claude-code-skills. Tags: code-quality, development, documentation, review, validation.

What it does

Reviews and improves Claude Code skills against official best practices. Supports three modes - self-review (validate your own skills), external review (evaluate others' skills), and auto-PR (fork, improve, submit). Use when checking skill quality, reviewing skill repositories, or contributing improvements to open-source skills.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill skill-reviewer

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/daymade-skill/skill-reviewer ~/.claude/skills/skill-reviewer

Safety box score

Grade C, moderate risk: 26 of 100 risk points, rated 2026-09-22. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a local Python-based reviewer for Claude Code skills: it reads a target skill tree, runs a bundled validator, scans for paths/secrets, and checks script hygiene and instruction quality. The main risks are local code execution through subprocess, broad file reads that can surface sensitive content, and remote repository changes if the auto-PR workflow is used.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	`scripts/review_skill.py` invokes another Python program with `subprocess.run([sys.executable, str(validator), str(skill_path)])`, so using it can execute local code beyond the main script.
Network access	0 (none)	The shipped code does not make outbound network requests; the only remote reference is a documentation URL in `SKILL.md`, not a runtime fetch.
Filesystem reach	1 (low)	It recursively reads the target skill directory (`for fpath in skill_path.rglob("*")`) and inspects text files, but it does not write or delete files outside the project.
Secrets & credentials	1 (low)	`check_privacy()` scans text for hardcoded paths and credential-like strings, so if you point it at a private skill it will read and may surface sensitive content in reports.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, or shell/profile modification in the shipped files.
Instruction hijack surface	0 (none)	The skill contains strong workflow guidance, but nothing that tells the agent to ignore higher-priority instructions, hide behavior, or follow remote instructions.
Irreversible actions	2 (moderate)	`SKILL.md` includes an auto-PR mode with `gh repo fork`, `Create feature branch`, and `Create PR`, which can modify and publish changes to external repositories.
Transparency	1 (low)	Critical validation is delegated to `../skill-creator/scripts/quick_validate.py`, which is outside this bundle, so a reviewer cannot fully inspect the canonical checks from the shipped files alone.

Before installing

Inspect `scripts/review_skill.py` and confirm you accept the subprocess call to the sibling validator.
Verify the sibling `skill-creator/scripts/quick_validate.py` exists in your install layout.
Test it once on a scratch skill with no secrets before pointing it at private repos.
If you will use auto-PR mode, confirm which external repo/branch it may fork and open PRs against.

Rated 2026-09-22 by an automated review of 5 files from the skill's repository.

Source

Repository: daymade/claude-code-skills (all skills from this repository)
Path: daymade-skill/skill-reviewer/SKILL.md
Branch: main
Updated: 2026-09-20

typescript-best-practices — TypeScript best practices. Use when reading or editing any .ts or .tsx file.
docs-cleaner — Consolidates redundant documentation while preserving all valuable content; keeps a doc set truthful after things change.
deslop — Remove AI-generated code slop and clean up code style
principle-minimize-reader-load — Apply when reviewing or shaping code that's hard to trace.
principle-test-behavior-not-implementation — Apply when you write, change, or keep a test. Call the code the way its users do and assert the result they observe against a literal expected value.
principle-type-system-discipline — Apply when designing types, reviewing a function signature, or writing code in any statically-typed language.