Skip to content
Get packs

Guide · Agent skill

How to use the Code Review Checklist agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The Code Review Checklist is an agent skill: a written set of instructions that tells an AI agent how to review code. It is useful if you want a consistent, checklist-driven first pass on a pull request or file, with feedback sorted by severity. This guide explains what the skill changes, how to install it, how to trigger it, and what to watch for before sending code to an agent.

Code Review Checklistkyegomez/swarms · Apache-2.0

Quick start

  1. 1Get the skill files. Download the code-review ZIP from the skill's page. It contains SKILL.md.
  2. 2Unzip into a skills folder. Extract the ZIP into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project to limit it to that project.
  3. 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
  4. 4Ask for a review. Request a review in plain language, naming the file or changes and the focus you want.
  5. 5Read the severity sections. Start with Critical Issues, then Major Concerns, then Suggestions.
  6. 6Verify each finding. Check the code yourself before changing anything, since the agent may miss or invent issues.

What does the code-review skill make the agent do?

The skill is a playbook, not a program. It does not run code or tools. When you ask the agent to review code, it follows a fixed checklist covering five areas: code quality (readability, naming, structure, comments, complexity), security (such as SQL injection, XSS, authentication and authorization flaws, insecure data handling, input validation, and OWASP Top 10 issues), performance (bottlenecks, inefficient algorithms, unnecessary queries or API calls, caching, memory use), best practices (DRY, SOLID, error handling, testing, dependencies), and maintainability (ease of change, abstractions, scalability, technical debt).

How is the review report organised?

The skill asks the agent to structure its feedback in a fixed order so you can scan it quickly: a Summary of the changes, then Critical Issues (security vulnerabilities or bugs that must be fixed), Major Concerns (significant quality or performance problems), Suggestions (optional improvements), and Positive Feedback. It also asks the agent to explain the why behind each recommendation and to prioritise by severity.

How do you install the skill?

You need the skill's files, which you can download as a ZIP from the skill's page. The skill's only file is SKILL.md. Unzip it into one of these locations:

  • Personal skills folder: ~/.claude/skills/ (available across your projects)
  • Project skills folder: .claude/skills/ inside a specific project (available only in that project)
  • Claude apps: upload the ZIP under Settings → Capabilities → Skills

How do you trigger the skill with a natural request?

You do not need a special command. Ask the agent to review code in plain language, and make clear what you want reviewed. The skill's description covers comprehensive reviews of best practices, security vulnerabilities, performance optimisation and maintainability, so requests that mention those topics fit well.

  • Review this pull request for security issues and performance problems.
  • Do a code review of auth.py and sort the findings by severity.
  • Check this function for SQL injection and error handling gaps, and explain why each issue matters.
  • Review the changes in this file for maintainability and DRY violations.

What does a review look like?

Reviews follow the skill's example format, with each finding labelled by severity. A security finding is marked CRITICAL and includes the line number, the current code, and a recommendation. A performance finding is marked SUGGESTION and explains the reasoning. The format below is taken from the skill's examples.

CRITICAL: SQL injection vulnerability detected at line 45 Current: f"SELECT * FROM users WHERE id = {user_id}" Recommendation: Use parameterized queries to prevent SQL injection

What does the skill need, and what are the safety notes?

The skill lists no requirements, runs no scripts and makes no network calls. However, the code you submit is processed by the agent's model, so anything in the code is sent to the AI service it uses. Do not use the skill on code containing secrets or sensitive data you do not want shared with that service. The skill is also not a substitute for a security audit: its checklist is generic, and the agent may miss real issues or report issues that do not exist. Use it for a first pass, and bring in a professional penetration test or formal review for compliance or security certification.

  • Do not paste API keys, passwords or customer data into a review request.
  • Treat every finding as a prompt to check, not a verified defect.
  • Verify any performance figure the agent quotes before acting on it.

What tips get better reviews?

Give the agent context about the project, since the skill asks it to consider the constraints of the project. Name the file or diff you want reviewed and state the focus, such as security or maintainability. Ask for the reasoning behind each point if you are learning, because the skill asks the agent to explain why each recommendation matters.

  • Narrow the scope to one file or pull request at a time.
  • Say which areas matter most, for example security only.
  • Ask the agent to reference standards when it cites a rule.

What people use it for

  • A first-pass review of a pull request before a human reviewer looks at it.
  • Checking a single file for SQL injection or XSS risks.
  • Getting feedback on DRY and SOLID violations in a growing module.
  • Learning what to look for in a code review by reading findings that explain the why.
  • Producing a severity-sorted list of issues to discuss with a team.

Frequently asked questions

Is the code-review agent skill free?

The skill is published under the Apache-2.0 licence, as listed on its page. The source does not describe pricing, so check the hosting platform for any costs of using the agent itself.

What do I need to use the code-review skill?

The skill lists no specific requirements. You need an agent that supports skills, such as the Claude apps or a Claude setup that reads from skills folders, and you unzip the skill's SKILL.md into the right folder.

Does the code-review skill run scripts or access the network?

No. The skill runs no scripts and uses no network. It is a written checklist that shapes how the agent reads and reports on code.

Can this skill replace a security audit?

No. The checklist is generic guidance and cannot replace a professional penetration test or formal review. The agent may miss or invent findings.

Where should I install the skill: personal or project folder?

Use ~/.claude/skills/ if you want it available across all your projects. Use .claude/skills/ inside a project if you want it only there.

Why isn't my review following the checklist?

Check that the SKILL.md file is inside the correct skills folder, then ask for a review that names the skill's focus, such as security or maintainability. Reviews depend on the agent loading the skill, so confirm it is installed.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Use this skill if you want a consistent, severity-sorted first pass on pull requests or files, or you are learning what to look for in a review. Skip it for security certification or compliance audits, and do not use it on code with secrets or sensitive data you do not want processed by an AI service.

Download the skill