---
name: code-reviewer
description: "Thorough PR review — security, performance, correctness, style, with inline-comment-ready output. Production code review skill: checks security (input validation, auth, secrets), performance (N+1, memory, allocations), correctness (edge cases, race conditions), style (consistency, naming, complexity). Outputs findings ranked by severity with concrete fix code."
license: MIT
---

# Code Reviewer

Code Reviewer performs a full-pass review of a pull request or working diff and returns findings ranked by severity, each paired with a concrete fix you can paste back as an inline comment. It's built for engineers who want a rigorous second set of eyes before merge — checking security, performance, correctness, and style in a single run rather than four separate tools.

## When to use it

- Right before requesting human review on a PR, to clear the obvious issues first.
- On a large or risky diff (auth changes, query layer, concurrency) where a manual scan misses edge cases.
- In CI as a gate that posts comments on changed lines.
- When reviewing someone else's PR and you want a structured starting point instead of reading 40 files cold.

## What it does

The skill reads your diff (via `git diff`, a branch range like `main...HEAD`, or a GitHub PR URL) and runs four analysis passes:

- **Security** — unvalidated input reaching sinks, missing authz checks, hardcoded secrets/keys, unsafe deserialization, SQL/command injection patterns.
- **Performance** — N+1 query loops, unnecessary allocations in hot paths, unbounded memory growth, repeated work that should be hoisted or cached.
- **Correctness** — unhandled edge cases (empty/null, off-by-one), race conditions on shared state, error paths that swallow failures.
- **Style** — naming consistency, cyclomatic complexity, dead code, deviation from the surrounding file's conventions.

Each finding includes the file and line, a severity (`critical` / `high` / `medium` / `low`), a one-line rationale, and a suggested patch.

## Usage example

```bash
curl -fsSL --create-dirs -o ~/.claude/skills/code-reviewer/SKILL.md https://claudeskil.com/skills/code-reviewer/SKILL.md

# Review the diff against main
claude "review my changes against main, group by severity"

# Review a specific PR and post inline comments
claude "review PR #482 and post the critical and high findings as inline comments"
```

You can scope it: "only flag security and correctness, skip style" keeps the noise down on a fast-moving branch.

## Tips & gotchas

- **Give it the base branch explicitly.** Reviewing `HEAD` alone reviews the last commit only; pass `main...HEAD` for the full PR delta.
- **Severity is calibrated to the diff, not the whole repo** — a `low` on naming in changed code may sit next to far worse untouched code it won't comment on by design.
- **Secrets detection flags patterns, not validity.** A matched key may already be rotated; confirm before treating it as an incident.
- **Suggested patches assume the surrounding context compiles.** Apply them through your editor/tests, not blindly.

## FAQ

**Does it modify my code?** No. It only reads the diff and emits findings plus suggested patches. Applying them is your call.

**Can it post directly to GitHub?** Yes, when given a PR URL and `gh` is authenticated, it can attach findings as inline review comments on the relevant lines.

**Which languages?** It's language-agnostic for style and correctness; security/performance heuristics are strongest in mainstream stacks (JS/TS, Python, Go, Java, Ruby).