code-review
Review Code for Security and Quality
Manual reviews can miss security, performance, and test gaps. This skill guides Claude, Codex, and Claude Code through a structured review checklist.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "code-review" from https://skillstore.io/skills/cain96-code-review.md and its manifest at https://skillstore.io/api/skills/cain96-code-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "code-review". Review an authentication change before merge.
Expected outcome:
- High: The password reset path lacks rate limiting and should be protected before release.
- Medium: Add tests for expired tokens and repeated reset attempts.
- Low: Clarify the error message so users know the next step.
Using "code-review". Review a React list rendering update.
Expected outcome:
- Medium: The component recomputes filtered results on every render. Cache the derived list when inputs do not change.
- Medium: Add a test for an empty result set and loading state.
- Low: Extract the item label formatting to reduce component complexity.
Using "code-review". Review a database query refactor.
Expected outcome:
- High: Confirm the new query preserves tenant filtering before merge.
- Medium: Add coverage for missing records and permission denied responses.
- Low: Document why the join order was changed.
Security Audit
SafeStatic findings are documentation examples, Markdown fences, and resource links rather than executable skill behavior. No prompt injection, secret exfiltration, hidden network activity, or malicious intent was found in SKILL.md.
Risk Factors
⚡ Contains scripts (1)
⚙️ External commands (21)
🌐 Network access (4)
🔑 Env variables (4)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cain96-code-review/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cain96-code-review?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cain96-code-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cain96-code-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cain96-code-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
Cain96. (2026). code-review security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cain96-code-review/audits/10BibTeX citation
@techreport{cain96-cain96-code-review-2026,
author = {Cain96},
title = {code-review security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/cain96-code-review/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "code-review security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "Cain96"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/cain96-code-review/audits/10"
identifiers:
- type: other
value: "skillstore:cain96-code-review:audit:10"
description: "Skillstore immutable audit report identifier"
Compare variants
14 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
21pounder-code-review
2026-08-21
daviddworetzky-code-review
2026-08-21
bind-code-review
2026-08-21
adammanuel-dev-code-review
2026-08-21
getsentry-code-review
2026-08-21
davila7-code-review
2026-08-21
89jobrien-code-review
2026-08-21
supercent-io-code-review
2026-08-21
ancplua-code-review
2026-08-21
cain96-code-review
2026-08-21
doyajin174-code-review
2026-08-21
mattpocock-code-review
2026-08-21
ericdumingtong-code-review
2026-08-21
coderabbitai-code-review
2026-08-21
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Review an API Change
Find security, validation, performance, and test coverage issues before a backend merge.
Check a Frontend Update
Assess React rendering costs, XSS risks, component complexity, and missing UI tests.
Prepare a Merge Review
Organize findings by priority and produce clear review comments for a pull request.
Try These Prompts
Review the selected files for bugs, security concerns, and simple maintainability issues. Prioritize findings that should block a merge.
Review this change for input validation, authorization, secret handling, and missing tests. Include concrete fixes for each important issue.
Analyze the changed code for slow operations, repeated work, complex functions, duplication, and unclear boundaries. Group findings by severity.
Perform a release readiness review across security, performance, maintainability, tests, and documentation. Identify blockers, risks, and follow-up tasks.
Best Practices
- Provide the relevant diff, affected files, and project context before asking for review.
- Ask for severity-ranked findings when the review may affect a merge decision.
- Verify important recommendations with tests, local checks, or a human reviewer.
Avoid
- Do not ask for a broad review without providing the changed files or target risk areas.
- Do not treat every suggestion as a blocker without judging impact and likelihood.
- Do not run project commands from untrusted code without approval and isolation.