Code Review Claude Skills
2 030 code review skills from 387 authors. They read someone else's code and work through changes before those land. Half of them fit into 1 564 tokens or less — that is what one costs your context window when the agent loads it. 210 ship runnable scripts rather than instructions alone. 3 of them cannot work without an MCP server, most often rube. We also found 261 copies of these same skills sitting in other people's repositories — counted once here, not 261 times.
2 030 unique 387 authors 2 updated this month 280 from vendors
| Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it when the user mentions PE/ELF/Mach-O/DEX/WASM files together with CLI analysis, `rabin2`, `rasm2`, `radiff2`, `r2pipe`, or asks for radare2 command help on Windows/Linux/macOS.
Computing pull request statistics (merge time, top contributors) from gh CLI JSON output using jq.
Using the gh CLI to search and list GitHub issues and pull requests with date filters and label queries.
Workflow for creating and applying patches to Java projects - diff format, patch application, and Maven rebuilds for security fixes.
Retrieve pull request and issue data from GitHub repositories using the gh CLI with specific filters and JSON output for downstream processing.
Techniques for applying security fixes to Java projects using git, diffs, and Maven.
Determine which person opened the most pull requests in December 2024 by analyzing author data from the PR query results.
Fetch all pull requests created in December 2024 from cli/cli repository using the GitHub CLI, applying correct date range filtering to ensure accurate total count and contributor identification.
Scala-specific naming conventions, code organization patterns, and style guidelines that differ from Python conventions.
How to accurately search for issues (excluding pull requests) in a GitHub repository using the gh CLI, since GitHub's search API treats PRs as a type of issue.
How to accurately search for pull requests in a specific GitHub repository within a date range using the gh CLI, and correctly distinguish merged vs closed-without-merge PRs.
Use `gh search prs` to fetch pull requests from a specific repo within a date range. Returns structured JSON for downstream processing. More reliable than `gh pr list --search` for date-range filtering.
> Query GitHub repository activity (PRs, issues) for a date range using the gh CLI. Use this skill whenever you need to fetch pull request or issue data from a GitHub repository, compute statistics like counts, merge times, or identify top contributors. Triggers on tasks involving GitHub activity reports, community pulse summaries, or repository metrics gathering.
How to build Apache Druid with Maven, including how to skip OOM-prone modules, skip code quality checks for patched files, and build only specific modules. Use this skill when building Druid from source, when rebuilding after applying security patches, or when Maven build fails due to memory or code quality check issues.
Security considerations for Jackson @JacksonInject annotation in Java applications. How to prevent JSON input from overriding server-injected values. Use this skill whenever reviewing code that uses @JacksonInject, when an attacker could supply JSON to override configuration objects, or when fixing deserialization vulnerabilities related to injectable values.
> How to fetch and analyze pull request data from a GitHub repository for a contributors. Use this skill whenever the user wants PR metrics, pull request summaries, contributor leaderboards, or community pulse reports.
Expert guidance on using the GitHub CLI (gh) to extract pull request and issue data for specific timeframes and repositories. Use this skill whenever you need to gather metrics for community reports, activity analysis, or repository health checks.
The gh CLI is GitHub's official command line tool for interacting with GitHub repositories, issues, pull requests, and more. When needs to interact with GitHub repositories, issues, pull requests, and more, use this skill.
Automates the Karpathy LLM Wiki workflow: turns web, GitHub, and YouTube URLs into well-structured, citable, wikilinked pages with automatic linting and sourcing — invoke with /pin-llm-wiki
Run any "find all instances of X" sweep — a security audit, a safety audit, a code review, a research question, a compliance check — as an iterative loop that does NOT stop at one pass. Audit → fix → RE-audit → … until a clean pass returns zero NEW discoveries. Use whenever thoroughness matters and a single pass would miss things. Trigger words: audit, sweep, find all, review everything, comprehensive, thorough, exhaustive, security review, safety audit, no stone unturned, did we get everything, convergence.
Plan or execute a scoped GitHub issue, thread, or pull-request synchronization through a configured Runx Connect grant, with approval and readback on writes.
Draft or tighten a Runx operational policy from a governance brief, then validate the exact runx.operational_policy.v1 contract with the native policy engine. Use for repository/source/runner/owner policy design, fail-closed policy linting, or authority attenuation; never use this lane to widen an existing policy.
Govern one GitHub pull-request review comment through Runx Connect or the canonical MCP pattern, with exact approval, retry safety, and independent readback.
Reviews LangGraph code for bugs, anti-patterns, and improvements. Use when reviewing code that uses StateGraph, nodes, edges, checkpointing, or other LangGraph features. Catches common mistakes in state management, graph structure, and async patterns.
Reviews Deep Agents code for bugs, anti-patterns, and improvements. Use when reviewing code that uses create_deep_agent, backends, subagents, middleware, or human-in-the-loop patterns. Catches common configuration and usage mistakes.
Use when comparing two or more code implementations against a spec or requirements doc. Triggers on \"which repo is better\", \"compare these implementations\", \"evaluate both solutions\", \"rank these codebases\", or \"judge which approach wins\". Also covers choosing between competing PRs or vendor submissions solving the same problem. Does NOT review a single codebase for quality \u2014 use code review skills instead. Does NOT evaluate strategy docs \u2014 use strategy-review. Requires a spec file and 2+ repo paths.
create a pull request with standardized description template
Optimize prompts for code-related tasks following prompt-engineering best practices. Use when refining prompts for implementation, debugging, refactoring, code review, or testing.
Schema for tracking code review outcomes to enable feedback-driven skill improvement. Use when logging review results or analyzing review quality.
Detects common LLM coding agent artifacts across four categories (tests, dead code, abstraction, style) over the project or changed files — using parallel subagents when the agent supports them, otherwise four sequential passes. Scans files changed since main by default; use --all for full-project scan. Triggers on LLM cruft cleanup, agent-generated code review, dead code sweeps, test-quality passes, or when the user asks to scan the whole repo.
Process external code review feedback with technical rigor. Use when receiving feedback from another LLM, human reviewer, or CI tool. Verifies claims before implementing, tracks disposition.
Mandatory verification steps for all code reviews to reduce false positives. Load this skill before reporting ANY code review findings.
Confirms or rejects findings from review-llm-artifacts before deletes or risky refactors. Loads review-verification-protocol-style checks per finding. Use after a review run, when the user wants to reduce false positives, before fix-llm-artifacts on dead code, or when validating a full-project scan.
Reviews Elixir code for idiomatic patterns, OTP basics, and documentation. Use when reviewing .ex/.exs files, checking pattern matching, GenServer usage, or module documentation.
Reviews Elixir code for security vulnerabilities including code injection, atom exhaustion, and secret handling. Use when reviewing code handling user input, external data, or sensitive configuration.
Reviews ExUnit test code for proper patterns, boundary mocking with Mox, and test adapter usage. Use when reviewing _test.exs files or test helper configurations.
Reviews Phoenix LiveView code for lifecycle patterns, assigns/streams usage, components, and security. Use when reviewing LiveView modules, .heex templates, or LiveComponents.
Reviews Phoenix code for controller patterns, context boundaries, routing, and plugs. Use when reviewing Phoenix apps, checking controllers, routers, or context modules.
Mandatory verification steps for all code reviews to reduce false positives. Load this skill before reporting ANY code review findings.
Comprehensive Elixir/Phoenix code review with optional parallel agents
Reviews BubbleTea TUI code for proper Elm architecture, model/update/view patterns, and Lipgloss styling. Use when reviewing terminal UI code using charmbracelet/bubbletea.
Reviews Go code for idiomatic patterns, error handling, concurrency safety, and common mistakes. Use when reviewing .go files, checking error handling, goroutine usage, or interface design. Covers generics (Go 1.18+), errors.Join and slog (Go 1.21+), and Go 1.22 loop variable semantics.
Reviews Go test code for proper table-driven tests, assertions, and coverage patterns. Use when reviewing *_test.go files.
Comprehensive Go backend code review with optional parallel review areas. Use when reviewing changed Go files; detects BubbleTea, Wish SSH, and Prometheus and loads the matching review skills.
Reviews Prometheus instrumentation in Go code for proper metric types, labels, and patterns. Use when reviewing code with prometheus/client_golang metrics.
Reviews Wish SSH server code for proper middleware, session handling, and security patterns. Use when reviewing SSH server code using charmbracelet/wish.
Mandatory verification steps for all code reviews to reduce false positives. Load this skill before reporting ANY code review findings.
Comprehensive BubbleTea TUI code review for terminal applications. Use when reviewing charmbracelet/bubbletea, lipgloss, bubbles, or Wish SSH code; optionally reviews each area concurrently.