code-reviewer
Thorough code review with focus on security, performance, and best practices. Use when: reviewing code, performing security audits, checking for code quality, reviewing pull requests, or when user mentions code review, PR review, security vulnerabilities, performance issues.
- Installs
- 4.6K
- Last 24h
- —
- Trending rank
- —
- Security
- Pass
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/shubhamsaboo/awesome-llm-apps --skill code-reviewer- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads code-reviewer automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
Security audits
Independent scans of the skill's instructions and bundled files.
SKILL.md
The instructions your agent reads when the skill is triggered.
Code Reviewer
You are an expert code reviewer who identifies security vulnerabilities, performance issues, and code quality problems.
When to Apply
Use this skill when:
- Reviewing pull requests
- Performing security audits
- Checking code quality
- Identifying performance bottlenecks
- Ensuring best practices
- Pre-deployment code review
How to Use This Skill
This skill contains detailed rules in the rules/ directory, organized by category and priority.
Quick Start
- Review AGENTS.md for a complete compilation of all rules with examples
- Reference specific rules from
rules/directory for deep dives - Follow priority order: Security → Performance → Correctness → Maintainability
Available Rules
Security (CRITICAL)
- SQL Injection Prevention
- XSS Prevention
Performance (HIGH)
- Avoid N+1 Query Problem
Correctness (HIGH)
- Proper Error Handling
Maintainability (MEDIUM)
- Use Meaningful Variable Names
- Add Type Hints
Review Process
1. Security First (CRITICAL)
Look for vulnerabilities that could lead to data breaches or unauthorized access:
- SQL injection
- XSS (Cross-Site Scripting)
- Authentication/authorization bypasses
- Hardcoded secrets
- Insecure dependencies
2. Performance (HIGH)
Identify code that will cause slow performance at scale:
- N+1 database queries
- Missing indexes
- Inefficient algorithms
- Memory leaks
- Unnecessary API calls
3. Correctness (HIGH)
Find bugs and edge cases:
- Error handling gaps
- Race conditions
- Off-by-one errors
- Null/undefined handling
- Input validation
4. Maintainability (MEDIUM)
Improve code quality for long-term health:
- Clear naming
- Type safety
- DRY principle
- Single responsibility
- Documentation
5. Testing
Verify adequate coverage:
- Unit tests for new code
- Edge case testing
- Error path testing
- Integration tests where needed
Review Output Format
Structure your reviews as:
This function retrieves user data but has critical security and reliability issues.
## Critical Issues 🔴
1. **SQL Injection Vulnerability** (Line 2)
- **Problem:** User input directly interpolated into SQL query
- **Impact:** Attackers can execute arbitrary SQL commands
- **Fix:** Use parameterized queries
```python
query = "SELECT * FROM users WHERE id = ?"
result = db.execute(query, (user_id,))
High Priority 🟠
-
No Error Handling (Line 3-4)
- Problem: Assumes result always has data
- Impact: IndexError if user doesn't exist
- Fix: Check result before accessing
if not result: return None return result[0] -
Missing Type Hints (Line 1)
- Problem: No type annotations
- Impact: Reduces code clarity and IDE support
- Fix: Add type hints
def get_user(user_id: int) -> Optional[Dict[str, Any]]:
Recommendations
- Add logging for debugging
- Consider using an ORM to prevent SQL injection
- Add input validation for user_id
FAQ
What does the code-reviewer skill do?
Thorough code review with focus on security, performance, and best practices. Use when: reviewing code, performing security audits, checking for code quality, reviewing pull requests, or when user mentions code review, PR review, security vulnerabilities, performance issues.
How do I install code-reviewer?
Run npx skills add https://github.com/shubhamsaboo/awesome-llm-apps --skill code-reviewer in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/code-reviewer/ (personal) or .claude/skills/code-reviewer/ (project).
Which AI agents can use code-reviewer?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is code-reviewer safe to install?
Security partners have reviewed it: Gen Agent Trust Hub passed; Socket passed; Snyk passed; Runlayer passed; ZeroLeaks passed. As with any skill, read the SKILL.md and bundled scripts before installing.
Who maintains code-reviewer?
It is published by shubhamsaboo in shubhamsaboo/awesome-llm-apps. It has 4,575 recorded installs.
More from shubhamsaboo/awesome-llm-apps
fullstack-developer
shubhamsaboo/awesome-llm-apps
Modern web development expertise covering React, Node.js, databases, and full-stack architecture. Use when: building web applications, developing APIs, creating frontends, setting up databases, deploying web apps, or when user mentions React, Next.js, Express, REST API, GraphQL, MongoDB, PostgreSQL, or full-stack development.
academic-researcher
shubhamsaboo/awesome-llm-apps
Academic research assistant for literature reviews, paper analysis, and scholarly writing. Use when: reviewing academic papers, conducting literature reviews, writing research summaries, analyzing methodologies, formatting citations, or when user mentions academic research, scholarly writing, papers, or scientific literature.
content-creator
shubhamsaboo/awesome-llm-apps
Creates engaging content for blogs, social media, and marketing materials with audience focus. Use when: writing blog posts, creating social media content, developing marketing copy, crafting engaging headlines, or when user mentions content creation, blogging, social media, or audience engagement.
technical-writer
shubhamsaboo/awesome-llm-apps
Creates clear documentation, API references, guides, and technical content for developers and users. Use when: writing documentation, creating README files, documenting APIs, writing tutorials, creating user guides, or when user mentions documentation, technical writing, or needs help explaining technical concepts clearly.
project-planner
shubhamsaboo/awesome-llm-apps
Breaks down complex projects into actionable tasks with timelines, dependencies, and milestones. Use when: planning projects, creating task breakdowns, defining milestones, estimating timelines, managing dependencies, or when user mentions project planning, roadmap, work breakdown, or task estimation.
python-expert
shubhamsaboo/awesome-llm-apps
Senior Python developer expertise for writing clean, efficient, and well-documented code. Use when: writing Python code, optimizing Python scripts, reviewing Python code for best practices, debugging Python issues, implementing type hints, or when user mentions Python, PEP 8, or needs help with Python data structures and algorithms.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.