Guide · Agent skill
How to use the Code Reviewer agent skill (code-reviewer)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The code-reviewer skill is a set of written review guidelines that tells an AI agent to review code the way an experienced reviewer would, checking for bugs, security problems and performance issues. This guide is for developers who want a second pair of eyes on a pull request, and for anyone new to agent skills. By the end you will know how to install the skill, how to ask for a review, and what the agent will and will not do.
Code ReviewerRightNow-AI/openfang · Apache-2.0 Download the skill Quick start
- 1Download the ZIP. Download the code-reviewer skill ZIP from this page.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into the project's .claude/skills/ folder for one project.
- 3Or upload it in the Claude apps. In the Claude apps, go to Settings, then Capabilities, then Skills, and upload the skill.
- 4Ask for a review. Describe the code or change and what it should do, in plain language.
- 5Read the ranked feedback. Work through must-fix security and bug items first, then performance, then style.
- 6Check the result yourself. Confirm the findings, since the checklist can miss issues or report false positives.
What is an agent skill and what does code-reviewer make the agent do?
An agent skill is a folder containing instructions that an AI agent loads when a task matches the skill. The code-reviewer skill is defined in a single file, SKILL.md, and it turns the agent into a code review specialist focused on patterns, bugs, security and performance.
Once the skill is active, the agent checks for correctness bugs and security problems such as injection, path traversal, hardcoded secrets and missing access checks. It also looks for performance issues such as database calls inside loops and unbounded collections. Feedback is ranked by severity, with security first, then correctness bugs, then performance, then style.
- Flags "must fix" items (bugs, security) separately from "consider" items (style, minor optimizations).
- Points to the exact line or pattern, explains why it is a problem and suggests a concrete fix.
- Praises good patterns, so reviews are not only critical.
- Asks clarifying questions instead of approving code it does not understand.
Install the code-reviewer skill
Download the ZIP for the code-reviewer skill from this page and unzip it. You can install it in one of two places. For a personal setup available across your projects, unzip it into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.
- Personal: ~/.claude/skills/
- Single project: .claude/skills/ inside the project folder
- Claude apps: Settings → Capabilities → Skills, then upload
How do I trigger the skill with a natural request?
You do not need a special command. Ask for a review in plain language and describe what you want checked. The agent should pick up the skill when your request matches its description, which covers code review focused on patterns, bugs, security and performance.
Give the agent the code or the change you want reviewed, and say what the code is supposed to do. The skill asks the agent to check whether the code does what the author intended, so intent helps.
- "Review this pull request for security problems before I merge it."
- "Look over this function for bugs and performance issues."
- "Check this file for hardcoded secrets and missing access checks."
- "Give me a second pair of eyes on these changes. The goal is to paginate the user list."
What a review looks like
The skill asks the agent to group related issues together rather than comment on every line, and to provide code snippets for fixes when the change is non-obvious. Tone is meant to be neutral and professional, and suggestions are often phrased as questions.
The skill also includes pitfalls to avoid. The agent should not nitpick formatting when the project has an autoformatter configured, and it should not request changes unrelated to the pull request's scope. Those should be filed as separate issues.
What the skill needs and its safety notes
The skill lists no requirements. It contains no scripts, so it does not run code on your machine, and it does not use the network. It is a set of written guidelines that shape how the agent reads and comments on code.
The skill is a checklist-based review. It can miss issues and it can report false positives, so treat its output as a strong first pass rather than a final verdict.
- Requires: nothing listed
- Runs scripts: no
- Uses network: no
- Files: SKILL.md
Tips for getting better reviews
Give the agent enough context. If it is handed code it cannot understand, the skill tells it to ask questions rather than approve. Include the purpose of the change, the relevant files and any project conventions.
If your project has an autoformatter, say so. The skill is designed to skip formatting nitpicks in that case.
- Share the whole change, not one fragment, when logic spans several files.
- State the intended behaviour so the agent can check intent.
- Ask for a focus, such as only security issues, when you want a shorter list.
What people use it for
- Reviewing a pull request for injection, path traversal or hardcoded secrets before merging.
- Checking a database-heavy function for queries inside loops.
- Getting explained feedback with concrete fixes as a less experienced developer.
- Applying the same review priorities across a team: security, then bugs, then performance, then style.
Frequently asked questions
How do I install the code-reviewer agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.
Does the code-reviewer skill require anything else to run?
The skill lists no requirements. It runs no scripts and uses no network, and its only file is SKILL.md, which contains written review guidelines.
Is the code-reviewer skill free?
This page does not state pricing or licence terms for the skill itself. The source repository is listed under the Apache-2.0 licence, so check that licence for terms of use.
Can the code-reviewer skill replace a security audit?
No. It is a general checklist-based review and can miss issues or report false positives. Projects that need a certified security audit or penetration test should use a dedicated professional service.
What does the agent do if it does not understand my code?
The skill tells the agent to ask clarifying questions rather than approve code it does not understand. Providing context about intent and related files helps it give a useful review.
How is this different from a normal linter?
According to the skill, the agent reviews logic and intent, not just syntax. It checks for security and performance patterns and explains the reasons behind each issue, while the skill itself tells the agent to skip formatting when an autoformatter is configured.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use the code-reviewer skill if you want a structured, severity-ranked second look at a pull request, especially if you are less experienced and want reasons and fixes explained. Pick something else, such as a professional security audit or penetration test, when you need certified assurance, because this checklist-based review can miss issues and report false positives.
Download the skill