Code Reviewer

Code Reviewer performs a full-pass review of a pull request or working diff and returns findings ranked by severity, each paired with a concrete fix you can paste back as an inline comment. It's built for engineers who want a rigorous second set of eyes before merge — checking security, performance, correctness, and style in a single run rather than four separate tools.

When to use it

• Right before requesting human review on a PR, to clear the obvious issues first.
• On a large or risky diff (auth changes, query layer, concurrency) where a manual scan misses edge cases.
• In CI as a gate that posts comments on changed lines.
• When reviewing someone else's PR and you want a structured starting point instead of reading 40 files cold.

What it does

The skill reads your diff (via git diff, a branch range like main...HEAD, or a GitHub PR URL) and runs four analysis passes:

• Security — unvalidated input reaching sinks, missing authz checks, hardcoded secrets/keys, unsafe deserialization, SQL/command injection patterns.
• Performance — N+1 query loops, unnecessary allocations in hot paths, unbounded memory growth, repeated work that should be hoisted or cached.
• Correctness — unhandled edge cases (empty/null, off-by-one), race conditions on shared state, error paths that swallow failures.
• Style — naming consistency, cyclomatic complexity, dead code, deviation from the surrounding file's conventions.

Each finding includes the file and line, a severity (critical / high / medium / low), a one-line rationale, and a suggested patch.

Usage example

curl -fsSL --create-dirs -o ~/.claude/skills/code-reviewer/SKILL.md https://claudeskil.com/skills/code-reviewer/SKILL.md

# Review the diff against main
claude "review my changes against main, group by severity"

# Review a specific PR and post inline comments
claude "review PR #482 and post the critical and high findings as inline comments"

You can scope it: "only flag security and correctness, skip style" keeps the noise down on a fast-moving branch.

Tips & gotchas

• Give it the base branch explicitly. Reviewing HEAD alone reviews the last commit only; pass main...HEAD for the full PR delta.
• Severity is calibrated to the diff, not the whole repo — a low on naming in changed code may sit next to far worse untouched code it won't comment on by design.
• Secrets detection flags patterns, not validity. A matched key may already be rotated; confirm before treating it as an incident.
• Suggested patches assume the surrounding context compiles. Apply them through your editor/tests, not blindly.

FAQ

Does it modify my code? No. It only reads the diff and emits findings plus suggested patches. Applying them is your call.

Can it post directly to GitHub? Yes, when given a PR URL and gh is authenticated, it can attach findings as inline review comments on the relevant lines.

Which languages? It's language-agnostic for style and correctness; security/performance heuristics are strongest in mainstream stacks (JS/TS, Python, Go, Java, Ruby).