Code review

Skill Jylhis/skills/skills/engineering/code-review

Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, 'review this before I merge', 'is this code safe?', or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.From its SKILL.md

Install

npx -y skills add Jylhis/skills --skill code-review

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

4.3 KB, 768 tokens by cl100k_base, as published. Nobody here has run it

/code-review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Review code changes with a structured lens on security, performance, correctness, and maintainability.

Usage

/code-review <PR URL or file path>

Review the provided code changes: @$1

If no specific file or URL is provided, ask what to review.

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                      CODE REVIEW                                   │
├─────────────────────────────────────────────────────────────────┤
│  STANDALONE (always works)                                       │
│  ✓ Paste a diff, PR URL, or point to files                      │
│  ✓ Security audit (OWASP top 10, injection, auth)               │
│  ✓ Performance review (N+1, memory leaks, complexity)           │
│  ✓ Correctness (edge cases, error handling, race conditions)    │
│  ✓ Style (naming, structure, readability)                        │
│  ✓ Actionable suggestions with code examples                    │
├─────────────────────────────────────────────────────────────────┤
│  SUPERCHARGED (when you connect your tools)                      │
│  + Source control: Pull PR diff automatically                    │
│  + Project tracker: Link findings to tickets                     │
│  + Knowledge base: Check against team coding standards           │
└─────────────────────────────────────────────────────────────────┘

Review Dimensions

Security

SQL injection, XSS, CSRF
Authentication and authorization flaws
Secrets or credentials in code
Insecure deserialization
Path traversal
SSRF

Performance

N+1 queries
Unnecessary memory allocations
Algorithmic complexity (O(n²) in hot paths)
Missing database indexes
Unbounded queries or loops
Resource leaks

Correctness

Edge cases (empty input, null, overflow)
Race conditions and concurrency issues
Error handling and propagation
Off-by-one errors
Type safety

Maintainability

Naming clarity
Single responsibility
Duplication
Test coverage
Documentation for non-obvious logic

Output

## Code Review: [PR title or file]

### Summary
[1-2 sentence overview of the changes and overall quality]

### Critical Issues
| # | File | Line | Issue | Severity |
|---|------|------|-------|----------|
| 1 | [file] | [line] | [description] | 🔴 Critical |

### Suggestions
| # | File | Line | Suggestion | Category |
|---|------|------|------------|----------|
| 1 | [file] | [line] | [description] | Performance |

### What Looks Good
- [Positive observations]

### Verdict
[Approve / Request Changes / Needs Discussion]

If Connectors Available

If ~~source control is connected:

Pull the PR diff automatically from the URL
Check CI status and test results

If ~~project tracker is connected:

Link findings to related tickets
Verify the PR addresses the stated requirements

If ~~knowledge base is connected:

Check changes against team coding standards and style guides

Tips

Provide context — "This is a hot path" or "This handles PII" helps me focus.
Specify concerns — "Focus on security" narrows the review.
Include tests — I'll check test coverage and quality too.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.

Gives 0 of the 12 instructions most code review skills give in 768 tokens

Counted across 668 of the 814 authors here whose files we hold, read 2026-09-06

Provide technical reasoning when pushing backin 84 of 668, across 70 files
Fix critical issues immediatelyin 77 of 668, across 60 files
Dispatch a code reviewer subagentin 76 of 668, across 59 files
Fix important issues before proceedingin 73 of 668, across 56 files
Ask for clarification on unclear itemsin 68 of 668, across 56 files
Verify feedback against codebase before implementationin 66 of 668, across 55 files
Implement fixes one at a timein 64 of 668, across 53 files
Test each fix individuallyin 62 of 668, across 51 files
Restate technical requirements in own wordsin 57 of 668, across 46 files
Reply to inline comments in the specific threadin 51 of 668, across 40 files
Note minor issues for laterin 49 of 668, across 34 files
Group findings by severityin 48 of 668, across 47 files

Said here and by no other author read

Ask for input if no file or URL is provided
Pull PR diffs automatically if source control is connected
Link findings to tickets if project tracker is connected
Check changes against team coding standards

Grouped from the skills themselves: near-identical wordings counted once, and counted by distinct author, so one author publishing three of these counts once. Length counted with cl100k_base; the agent that loads this file may tokenize it differently.