Code Review

by anthropicsae1513ea94dcNo license27K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated today

Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.

FeaturedInstructions onlySoftware Development

AI-generated overview

Reviews code changes for security, performance, correctness and maintainability, producing a structured report with a verdict.

What it does: Reviews a provided diff, pull request URL or file path across four dimensions: security (injection, auth flaws, secrets, SSRF), performance (N+1 queries, complexity, leaks), correctness (edge cases, race conditions, error handling) and maintainability (naming, duplication, tests). It outputs a markdown report with a summary, a critical issues table, a suggestions table, positive observations and a verdict of approve, request changes or needs discussion. Suggestions are meant to be actionable and include code examples.
When to use it: Use before merging a change, when checking whether code is safe, or when a diff needs review for N+1 queries, injection risks, missing edge cases or error handling gaps. It also fits when you want a structured review report with severity levels and a merge verdict.
Requirements: No scripts; instructions only. Works standalone with a pasted diff, PR URL or file path. Optional connectors for source control, project tracker and knowledge base add automatic diff pulling, ticket linking and coding-standard checks.

/code-review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Review code changes with a structured lens on security, performance, correctness, and maintainability.

Usage

Review the provided code changes: @$1

If no specific file or URL is provided, ask what to review.

How It Works

┌─────────────────────────────────────────────────────────────────┐│                      CODE REVIEW                                   │├─────────────────────────────────────────────────────────────────┤│  STANDALONE (always works)                                       ││  ✓ Paste a diff, PR URL, or point to files                      ││  ✓ Security audit (OWASP top 10, injection, auth)               ││  ✓ Performance review (N+1, memory leaks, complexity)           ││  ✓ Correctness (edge cases, error handling, race conditions)    ││  ✓ Style (naming, structure, readability)                        ││  ✓ Actionable suggestions with code examples                    │├─────────────────────────────────────────────────────────────────┤│  SUPERCHARGED (when you connect your tools)                      ││  + Source control: Pull PR diff automatically                    ││  + Project tracker: Link findings to tickets                     ││  + Knowledge base: Check against team coding standards           │└─────────────────────────────────────────────────────────────────┘

┌─────────────────────────────────────────────────────────────────┐│                      CODE REVIEW                                   │├─────────────────────────────────────────────────────────────────┤│  STANDALONE (always works)                                       ││  ✓ Paste a diff, PR URL, or point to files                      ││  ✓ Security audit (OWASP top 10, injection, auth)               ││  ✓ Performance review (N+1, memory leaks, complexity)           ││  ✓ Correctness (edge cases, error handling, race conditions)    ││  ✓ Style (naming, structure, readability)                        ││  ✓ Actionable suggestions with code examples                    │├─────────────────────────────────────────────────────────────────┤│  SUPERCHARGED (when you connect your tools)                      ││  + Source control: Pull PR diff automatically                    ││  + Project tracker: Link findings to tickets                     ││  + Knowledge base: Check against team coding standards           │└─────────────────────────────────────────────────────────────────┘

Review Dimensions

Security

SQL injection, XSS, CSRF
Authentication and authorization flaws
Secrets or credentials in code
Insecure deserialization
Path traversal
SSRF

Performance

N+1 queries
Unnecessary memory allocations
Algorithmic complexity (O(n²) in hot paths)
Missing database indexes
Unbounded queries or loops
Resource leaks

Correctness

Edge cases (empty input, null, overflow)
Race conditions and concurrency issues
Error handling and propagation
Off-by-one errors
Type safety

Maintainability

Naming clarity
Single responsibility
Duplication
Test coverage
Documentation for non-obvious logic

Output

markdown

## Code Review: [PR title or file]
### Summary[1-2 sentence overview of the changes and overall quality]
### Critical Issues| # | File | Line | Issue | Severity ||---|------|------|-------|----------|| 1 | [file] | [line] | [description] | 🔴 Critical |
### Suggestions| # | File | Line | Suggestion | Category ||---|------|------|------------|----------|| 1 | [file] | [line] | [description] | Performance |
### What Looks Good- [Positive observations]
### Verdict[Approve / Request Changes / Needs Discussion]

## Code Review: [PR title or file]
### Summary[1-2 sentence overview of the changes and overall quality]
### Critical Issues| # | File | Line | Issue | Severity ||---|------|------|-------|----------|| 1 | [file] | [line] | [description] | 🔴 Critical |
### Suggestions| # | File | Line | Suggestion | Category ||---|------|------|------------|----------|| 1 | [file] | [line] | [description] | Performance |
### What Looks Good- [Positive observations]
### Verdict[Approve / Request Changes / Needs Discussion]

If Connectors Available

If ~~source control is connected:

Pull the PR diff automatically from the URL
Check CI status and test results

If ~~project tracker is connected:

Link findings to related tickets
Verify the PR addresses the stated requirements

If ~~knowledge base is connected:

Check changes against team coding standards and style guides

Tips

Provide context — "This is a hot path" or "This handles PII" helps me focus.
Specify concerns — "Focus on security" narrows the review.
Include tests — I'll check test coverage and quality too.

Source and attribution

Source:anthropics/knowledge-work-pluginsinengineering/skills/code-reviewat commitae1513e

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from anthropics/knowledge-work-plugins

Ticket Deflector

anthropics

Featured

Reads a forwarded customer email or ticket, pulls order and refund status from a payments connector (PayPal, Square, or Stripe) or Shopify, account history from the CRM, and open tickets from a support desk (Zoho Desk), drafts a tone-matched reply in the owner's writing voice, and can issue a refund through the payments connector with explicit owner approval. With Shopify connected it also runs a proactive order-triage mode that surfaces orders needing attention — unfulfilled past the promised window, payment problems, pending refunds, stuck shipments — and drafts the next action for each before the customer has to ask. Use when the user says "draft a response," "answer this customer," "where's my order," "I want a refund," "check my orders," or "anything about to blow up."

Awaiting classification27Kupdated today

Tax Season Organizer

anthropics

Featured

Prepares tax-season materials for the owner's accountant, not tax advice. US federal tax; a non-US business gets its closed-books packet instead. Two modes: (1) quarterly estimated tax from YTD net income in the ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books); (2) year-end 1099 prep, scanning the ledger, PayPal, and Stripe for contractors paid over USD 600 into a 1099-NEC list with missing W-9 flags. Any tax request routes first to /tax-prep, which confirms the books are closed and reconciled before running this skill. Use this skill directly only when the owner says the period's books are already closed: "books are closed, now do the 1099s," "run the quarterly estimate off the closed numbers," or "just the contractor W-9 list."

Awaiting classification27Kupdated today

Tax Prep

anthropics

Featured

Prepares tax materials from closed books: a quarterly estimated payment breakdown or a year-end 1099-NEC list and accountant packet.

Business & Finance27Kupdated today

Smb Onboard

anthropics

Featured

Guides a small-business owner through first-time setup: connecting tools, running a value-proof recipe, capturing business context, and setting a weekly…

Productivity & Workflow27Kupdated today

Smb Router

anthropics

Featured

Routes a small-business owner's request to the right plugin skill or command and explains what is available.

Productivity & Workflow27Kupdated today

Month End Prep

anthropics

Featured

Reconciles the accounting ledger (MYOB, NetSuite, QuickBooks, Xero, or Zoho Books) against PayPal, Shopify, Square, and Stripe settlements, flags transactions that need attention, suspicious duplicates, and missing receipts, then writes a plain-English P&L narrative and exports a close packet (xlsx + one-page PDF). This is the first link of the /close-month command; a request to close the month or the books routes there, and the command runs this skill before refreshing the forecast and distributing the packet. Use this skill directly only when the owner wants the reconciliation alone, with no forecast refresh and no distribution: "just reconcile, no packet," "what's missing from the books," "flag the duplicates and missing receipts," or "write the P&L narrative for this month."

Awaiting classification27Kupdated today

Code Review

/code-review

Usage

How It Works

Review Dimensions

Security

Performance

Correctness

Maintainability

Output

If Connectors Available

Tips

Source and attribution

More from anthropics/knowledge-work-plugins

Ticket Deflector

Tax Season Organizer

Tax Prep

Smb Onboard

Smb Router

Month End Prep

More in Software Development

Playground

M5 Onboard

Cardputer Buddy

Web Design Guidelines

Vercel React Native Skills

Vercel React Best Practices