code-review
Reviews code changes for bugs, security issues, and quality problems. Use for a single-pass review of a PR, branch, or local diff; for large PRs that span several subsystems, use deep-review (.agents/skills/deep-review/).
- Installs
- 281
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://smithery.ai --skill code-review- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads code-review automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Code Review Skill
Review code changes in coder/coder and identify bugs, security issues, and quality problems.
Workflow
-
Get the code changes - Use the method provided in the prompt, or if none specified:
- For a PR:
gh pr diff <PR_NUMBER> --repo coder/coder - For local changes:
git diff mainorgit diff --staged
- For a PR:
-
Read full files and related code before commenting - verify issues exist and consider how similar code is implemented elsewhere in the codebase
-
Analyze for issues - Focus on what could break production
-
Report findings - Use the method provided in the prompt, or summarize directly
Severity Levels
- 🔴 CRITICAL: Security vulnerabilities, auth bypass, data corruption, crashes
- 🟡 IMPORTANT: Logic bugs, race conditions, resource leaks, unhandled errors
- 🔵 NITPICK: Minor improvements, style issues, portability concerns
What to Look For
- Security: Auth bypass, injection, data exposure, improper access control
- Correctness: Logic errors, off-by-one, nil/null handling, error paths
- Concurrency: Race conditions, deadlocks, missing synchronization
- Resources: Leaks, unclosed handles, missing cleanup
- Error handling: Swallowed errors, missing validation, panic paths
- Frontend (
site/src/): audit against the FE rule IDs in Frontend Patterns and cite the rule ID in findings (for example, "FE7: re-typed query key")
What NOT to Comment On
- Style that matches existing Coder patterns (check AGENTS.md first)
- Code that already exists unchanged
- Theoretical issues without concrete impact
- Changes unrelated to the PR's purpose
Coder-Specific Patterns
Authorization Context
// Public endpoints needing system access
dbauthz.AsSystemRestricted(ctx)
// Authenticated endpoints with user context - just use ctx
api.Database.GetResource(ctx, id)
Error Handling
// OAuth2 endpoints use RFC-compliant errors
httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, codersdk.OAuth2ErrorCodeInvalidGrant, "description")
// Regular endpoints use httpapi
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{...})
Shell Scripts
set -u only catches UNDEFINED variables, not empty strings:
unset VAR; echo ${VAR} # ERROR with set -u
VAR=""; echo ${VAR} # OK with set -u (empty is fine)
VAR="${INPUT:-}"; echo ${VAR} # OK - always defined
GitHub Actions context variables (github.*, inputs.*) are always defined.
Review Quality
- Explain impact ("causes crash when X" not "could be better")
- Make observations actionable with specific fixes
- Read the full context before commenting on a line
- Check AGENTS.md for project conventions before flagging style
Comment Standards
- Only comment when confident - If you're not 80%+ sure it's a real issue, don't comment. Verify claims before posting.
- No speculation about bugs - For correctness and security issues, avoid "might", "could", "consider"; state facts or skip. Design suggestions may be phrased as questions ("Could we use X instead?").
- Verify technical claims - Check documentation or code before asserting how something works. Don't guess at API behavior or syntax rules.
FAQ
What does the code-review skill do?
Reviews code changes for bugs, security issues, and quality problems. Use for a single-pass review of a PR, branch, or local diff; for large PRs that span several subsystems, use deep-review (.agents/skills/deep-review/).
How do I install code-review?
Run npx skills add https://smithery.ai --skill code-review in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/code-review/ (personal) or .claude/skills/code-review/ (project).
Which AI agents can use code-review?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is code-review safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains code-review?
It is published by smithery.ai in smithery.ai. It has 281 recorded installs.
More from smithery.ai
smithery-ai-cli
smithery.ai
Find, connect, and use MCP tools and skills via the Smithery CLI. Use when the user searches for new tools or skills, wants to discover integrations, connect to an MCP, install a skill, or wants to interact with an external service (email, Slack, Discord, GitHub, Jira, Notion, databases, cloud APIs, monitoring, etc.).
frontend-design
smithery.ai
Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
skill-creator
smithery.ai
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Gemini CLI's capabilities with specialized knowledge, workflows, or tool integrations.
ui-ux-pro-max
smithery.ai
UI/UX design intelligence for web, mobile, and desktop. This skill should be used when designing, building, reviewing, or fixing interfaces, including pages, components, design systems, accessibility, interaction, responsive layout, typography, color, charts, and stack-specific UI implementation. Searchable local data: 79 searchable styles (50 active), 192 product palettes and reasoning profiles, 74 font pairings, 119 UX guidelines, 105 icons, 17 GSAP presets, 25 chart types, and 22 stacks.
smithery.ai
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.
xlsx
smithery.ai
Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .xltx, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like "the xlsx in my downloads") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.