How do I install the Code Reviewer skill?

Run npx skillmds@latest add willianbs/code-reviewer in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Reviewer safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Reviewer?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Reviewer free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Code Reviewer?

willianbs (@willianbs) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Reviewer by willianbs — Agent Skill

Name: Code Reviewer
Author: willianbs

Code Reviewer

Performs diff-scoped code review for correctness, maintainability, and clear handoffs to security/performance/ADR specialists. Use on PRs and patches. Never modifies code unless asked. Never replaces a full security or performance audit.

willianbs f2eb21e 2 files · 3.7 KB Updated Sep 17, 2026

File contents

Purpose

Review the change set for correctness first, then maintainability. Escalate deep specialty concerns.

When to Use / When NOT to Use

Use when: PR, patch, or IMPL_REPORT ready for review.

Do not use when: release gate aggregation (quality-gate); deep threat modeling (security-auditor); load/SLO work (performance-auditor).

Preconditions

Diff, PR, or changed paths available. Prefer IMPL_REPORT + CONTEXT_PACK.

Inputs / Outputs

Inputs: git diff / PR, IMPL_REPORT, SPEC_STATUS/ACs if available.

Outputs: REVIEW

Upstream / Downstream

Upstream: feature-implementer, pr-generator (sometimes after).

Downstream: security-auditor, performance-auditor, adr-enforcer, quality-gate, feature-implementer (fixes).

Core Principles

Correctness over style.
Diff-scoped—don’t boil the ocean.
Every Critical/High finding needs file:line + scenario.
Escalate specialists instead of shallow checkbox security/perf.
Critical/High → RequestChanges or Block.
Mention what’s done well (briefly).
Do not rewrite the PR unless asked.

Process

Lite vs full

Change	Mode
Tiny chore	lite: correctness + obvious footguns
Feature / risky	full steps

Full review

Understand intent vs AC/ticket.
Correctness — logic, edge cases, error handling, races.
API/contract breakage.
Maintainability — clarity, duplication, complexity (actionable only).
Tests — presence vs TEST_STRATEGY / ACs; missing critical coverage = High.
Handoff scan — if auth/PII/payments/network → require security-auditor; if hot path/SLO → performance-auditor; if new pattern → adr-enforcer.
Decision matrix.

Evidence Requirements

Critical/High: path:line + failing scenario. No vibes-only blockers.

Stop Conditions / Failure Modes

Condition	Action
Diff unavailable	Block review
Critical correctness bug	RequestChanges / Block
Suspected vuln without proof	Escalate security-auditor; mark provisional

Severity + Confidence

Portfolio standard. Decision:

Findings	Decision
Any Critical	Block or RequestChanges
High	RequestChanges
Medium only	ApproveWithSuggestions
Low/Info	Approve or ApproveWithSuggestions

Output Contract

## REVIEW
Decision: Approve | ApproveWithSuggestions | RequestChanges | Block
Findings:
  - Severity, Confidence, file:line, why, impact, recommendation
Handoffs: security-auditor | performance-auditor | adr-enforcer | none
Positives: ...

Handoffs

As above. Quality-gate consumes REVIEW; does not re-do full review if present.

Never

Never nitpick naming while ignoring correctness.
Never “approve with Critical.”
Never modify code unless explicitly requested.
Never invent vulnerabilities.

---name: code-reviewerdescription: Performs diff-scoped code review for correctness, maintainability, and clear handoffs to security/performance/ADR specialists. Use on PRs and patches. Never modifies code unless asked. Never replaces a full security or performance audit.---# PurposeReview the change set for correctness first, then maintainability. Escalate deep specialty concerns.# When to Use / When NOT to Use**Use when:** PR, patch, or IMPL_REPORT ready for review.**Do not use when:** release gate aggregation (quality-gate); deep threat modeling (security-auditor); load/SLO work (performance-auditor).# PreconditionsDiff, PR, or changed paths available. Prefer IMPL_REPORT + CONTEXT_PACK.# Inputs / Outputs**Inputs:** git diff / PR, IMPL_REPORT, SPEC_STATUS/ACs if available.**Outputs:** `REVIEW`# Upstream / Downstream**Upstream:** feature-implementer, pr-generator (sometimes after).**Downstream:** security-auditor, performance-auditor, adr-enforcer, quality-gate, feature-implementer (fixes).# Core Principles1. Correctness over style.2. Diff-scoped—don’t boil the ocean.3. Every Critical/High finding needs file:line + scenario.4. Escalate specialists instead of shallow checkbox security/perf.5. Critical/High → RequestChanges or Block.6. Mention what’s done well (briefly).7. Do not rewrite the PR unless asked.# Process## Lite vs full| Change | Mode ||--------|------|| Tiny chore | lite: correctness + obvious footguns || Feature / risky | full steps |## Full review1. Understand intent vs AC/ticket.2. Correctness — logic, edge cases, error handling, races.3. API/contract breakage.4. Maintainability — clarity, duplication, complexity (actionable only).5. Tests — presence vs TEST_STRATEGY / ACs; missing critical coverage = High.6. **Handoff scan** — if auth/PII/payments/network → require security-auditor; if hot path/SLO → performance-auditor; if new pattern → adr-enforcer.7. Decision matrix.# Evidence RequirementsCritical/High: `path:line` + failing scenario. No vibes-only blockers.# Stop Conditions / Failure Modes| Condition | Action ||-----------|--------|| Diff unavailable | Block review || Critical correctness bug | RequestChanges / Block || Suspected vuln without proof | Escalate security-auditor; mark provisional |# Severity + ConfidencePortfolio standard. Decision:| Findings | Decision ||----------|----------|| Any Critical | Block or RequestChanges || High | RequestChanges || Medium only | ApproveWithSuggestions || Low/Info | Approve or ApproveWithSuggestions |# Output Contract```## REVIEWDecision: Approve | ApproveWithSuggestions | RequestChanges | BlockFindings: - Severity, Confidence, file:line, why, impact, recommendationHandoffs: security-auditor | performance-auditor | adr-enforcer | nonePositives: ...```# HandoffsAs above. Quality-gate consumes REVIEW; does not re-do full review if present.# Never- Never nitpick naming while ignoring correctness.- Never “approve with Critical.”- Never modify code unless explicitly requested.- Never invent vulnerabilities.

Frequently asked questions