Skills anthropics knowledge-work-plugins

code-review

Use it when:: You want a change checked before you merge it, from a pasted diff, a PR URL or file paths.
It checks:: Security such as injection, XSS, CSRF, auth flaws and secrets in code; performance such as N+1 queries and leaks; correctness; and maintainability.
You get:: A Markdown review: summary, critical issues and suggestions by file and line, what looks good, and approve, request changes or needs discussion.
With connectors:: It pulls the PR diff and CI status, links findings to tickets, and checks your team's coding standards.
Runs:: As /code-review with a PR URL, diff or file path, or when you ask for a review.
Part of:: The engineering plugin of Anthropic's knowledge-work plugins.

TL;DR

A review command. Point it at a PR URL, a diff or files; with nothing given, it asks what to review. It looks through four lenses. Security covers the OWASP top 10, such as SQL injection, XSS, CSRF, authentication and authorization flaws, secrets in code, insecure deserialization, path traversal and SSRF. Performance covers N+1 queries, needless allocations, quadratic work in hot paths, missing indexes, unbounded queries and resource leaks. Correctness covers empty or null input, overflow, race conditions, error handling, off-by-one errors and type safety. Maintainability covers naming, single responsibility, duplication, test coverage and comments on non-obvious logic. The report has a one- or two-sentence summary, a table of critical issues with file, line and severity, a table of suggestions by category, what looks good, and a verdict. It works on its own; with source control, project tracker or knowledge base connectors it also pulls the diff, checks CI and test results, links findings to tickets, checks that the PR meets its stated requirements, and compares the change with your team's standards. Saying the code is a hot path or handles PII focuses the review.

Summarizes the skill at ab4cb1c.

npx skills add https://github.com/anthropics/knowledge-work-plugins --skill code-review

skills.sh page Source on GitHub All skills from anthropics/knowledge-work-plugins

Total Downloads: 10,100 on skills.sh, Nov 9, 2026
Repo stars: 35,234 anthropics/knowledge-work-plugins
First seen: Feb 24, 2026 on skills.sh

Weekly Downloads

-57% over the 8 weeks to Nov 9

Weekly values

Week to	Installs
Sep 21	216
Sep 28	145
Oct 5	103
Oct 12	109
Oct 19	93
Oct 26	110
Nov 2	88
Nov 9	93

Category	category:debugging category:security category:software-engineering Find root causes, review code and test what you built. Compliance, guardrails, skill vetting and browser fingerprinting. Everything for building software: planning, coding, debugging, design, frameworks, cloud, agents and skills.
Type	type:workflow A multi-step process the agent follows: interview, debug, run a TDD loop, review.
Effect	effect:none Adds no side effects of its own. It shapes how the agent thinks, writes or reviews. Guidelines and routers are always effect:none, even when the task they support edits code.
Needs	needs:none Instructions only. Works in any agent that supports skills.
Publisher	by:official A verified publisher on skills.sh, or the company or maintainer behind the product the skill operates.
Topics	code-review security performance

SKILL.md

From anthropics/knowledge-work-plugins at ab4cb1c. Checked daily, last changed Nov 6, 2026.

Frontmatter

name: code-review
description: Review code changes for security, performance, and correctness. Trigger with a PR URL or diff, "review this before I merge", "is this code safe?", or when checking a change for N+1 queries, injection risks, missing edge cases, or error handling gaps.
argument-hint: "<PR URL, diff, or file path>"

/code-review

If you see unfamiliar placeholders or need to check which tools are connected, see CONNECTORS.md.

Review code changes with a structured lens on security, performance, correctness, and maintainability.

Usage

/code-review <PR URL or file path>

Review the provided code changes: @$1

If no specific file or URL is provided, ask what to review.

How It Works

┌─────────────────────────────────────────────────────────────────┐
│                      CODE REVIEW                                   │
├─────────────────────────────────────────────────────────────────┤
│  STANDALONE (always works)                                       │
│  ✓ Paste a diff, PR URL, or point to files                      │
│  ✓ Security audit (OWASP top 10, injection, auth)               │
│  ✓ Performance review (N+1, memory leaks, complexity)           │
│  ✓ Correctness (edge cases, error handling, race conditions)    │
│  ✓ Style (naming, structure, readability)                        │
│  ✓ Actionable suggestions with code examples                    │
├─────────────────────────────────────────────────────────────────┤
│  SUPERCHARGED (when you connect your tools)                      │
│  + Source control: Pull PR diff automatically                    │
│  + Project tracker: Link findings to tickets                     │
│  + Knowledge base: Check against team coding standards           │
└─────────────────────────────────────────────────────────────────┘

Review Dimensions

Security

SQL injection, XSS, CSRF
Authentication and authorization flaws
Secrets or credentials in code
Insecure deserialization
Path traversal
SSRF

Performance

N+1 queries
Unnecessary memory allocations
Algorithmic complexity (O(n²) in hot paths)
Missing database indexes
Unbounded queries or loops
Resource leaks

Correctness

Edge cases (empty input, null, overflow)
Race conditions and concurrency issues
Error handling and propagation
Off-by-one errors
Type safety

Maintainability

Naming clarity
Single responsibility
Duplication
Test coverage
Documentation for non-obvious logic

Output

## Code Review: [PR title or file]

### Summary
[1-2 sentence overview of the changes and overall quality]

### Critical Issues
| # | File | Line | Issue | Severity |
|---|------|------|-------|----------|
| 1 | [file] | [line] | [description] | 🔴 Critical |

### Suggestions
| # | File | Line | Suggestion | Category |
|---|------|------|------------|----------|
| 1 | [file] | [line] | [description] | Performance |

### What Looks Good
- [Positive observations]

### Verdict
[Approve / Request Changes / Needs Discussion]

If Connectors Available

If ~~source control is connected:

Pull the PR diff automatically from the URL
Check CI status and test results

If ~~project tracker is connected:

Link findings to related tickets
Verify the PR addresses the stated requirements

If ~~knowledge base is connected:

Check changes against team coding standards and style guides

Tips

Provide context — "This is a hot path" or "This handles PII" helps me focus.
Specify concerns — "Focus on security" narrows the review.
Include tests — I'll check test coverage and quality too.