ZhangHanDongZhangHanDong/cowork-skills/skills/code-review/SKILL.md

code-review

Skill46 starsChanged 9 months agoMITView on GitHub

CRITICAL: Code review skill using GitHub API. Triggers on: review PR, code review, PR review, pull request review, review changes, check this PR, analyze this PR, review #, 代码审查, 审查 PR

Reads credentials

We split this skill into the rules it gives an agent

5 rules. 0 are common, 5 are distinctive, and 0 are very specific to this project.

0
Common
Most of the 183 edited versions we read keep these.
5
Distinctive
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.

Common
Distinctive
Very specific

Distinctive:
Check for common issues and anti-patterns
line 16
Distinctive:
When you ask me to review a PR, I will:
line 27
Distinctive:
Critical Issues: - Must-fix before merge
line 135
Distinctive:
Self-review first: - Check your own code before requesting
line 269
Distinctive:
Address all comments: - Don't leave feedback unresolved
line 270

“Common” is measured: kept by at least 6 in 10 of the 183 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.

Files

SKILL.md

Code Review

AI-powered code review using GitHub API

Overview

This skill provides comprehensive code review capabilities by integrating with GitHub's API:

Fetch and analyze pull requests
Review code changes with AI assistance
Generate review comments and suggestions
Check for common issues and anti-patterns

Prerequisites

gh CLI must be installed and authenticated
Or GITHUB_TOKEN environment variable must be set

Usage

Review a Pull Request

When you ask me to review a PR, I will:

Fetch PR details using gh pr view
Analyze the diff using gh pr diff
Review each file for:
- Code quality issues
- Security vulnerabilities
- Performance concerns
- Best practices violations
- Documentation gaps
Provide actionable feedback

Trigger Patterns

Trigger	Example
`review PR #123`	Review a specific PR by number
`review this PR`	Review the current branch's PR
`code review`	Start code review workflow
`check PR changes`	Analyze PR changes
`review https://github.com/user/repo/pull/123`	Review from URL

Commands Reference

Fetch PR Information

# View PR details
gh pr view 123

# View PR diff
gh pr diff 123

# View PR files changed
gh api repos/{owner}/{repo}/pulls/123/files

# View PR comments
gh api repos/{owner}/{repo}/pulls/123/comments

# View PR reviews
gh api repos/{owner}/{repo}/pulls/123/reviews

Submit Review Comments

# Add a comment to a PR
gh pr comment 123 --body "Review comment here"

# Create a review with comments
gh api repos/{owner}/{repo}/pulls/123/reviews \
  -f body="Review summary" \
  -f event="COMMENT"

# Approve a PR
gh pr review 123 --approve --body "LGTM"

# Request changes
gh pr review 123 --request-changes --body "Please address the issues"

Review Workflow

Step 1: Fetch PR Context

# Get PR metadata
gh pr view 123 --json title,body,author,files,additions,deletions

# Get full diff
gh pr diff 123

Step 2: Analyze Changes

For each file in the PR, I analyze:

Code Quality:

Naming conventions
Code organization
DRY principle violations
Complex logic that needs refactoring
Unused code or imports

Security:

Input validation
SQL injection risks
XSS vulnerabilities
Hardcoded secrets
Improper error handling

Performance:

N+1 queries
Unnecessary allocations
Blocking operations in async code
Missing indexes (for DB changes)

Rust-Specific (if applicable):

Ownership issues (E0382, E0507, etc.)
Lifetime annotations
Unsafe code usage
Error handling with Result/Option
Clippy warnings

Step 3: Generate Review

I provide:

Summary - Overall assessment
Critical Issues - Must-fix before merge
Suggestions - Recommended improvements
Nitpicks - Optional style improvements
Questions - Clarifications needed

Review Templates

Standard Review

## Code Review Summary

**PR:** #123 - Title
**Author:** @username
**Files Changed:** N files (+X/-Y lines)

### Overall Assessment
[APPROVE / REQUEST_CHANGES / COMMENT]

Brief summary of the changes and overall quality.

### Critical Issues
- [ ] Issue 1: Description (file:line)
- [ ] Issue 2: Description (file:line)

### Suggestions
- Consider using X instead of Y in `file.rs:42`
- The function could be simplified by...

### Nitpicks
- Style: Prefer `foo` over `bar` per project conventions
- Typo in comment at line 15

### Questions
- What is the expected behavior when...?
- Should this be documented in the README?

### Files Reviewed
- [x] src/main.rs
- [x] src/lib.rs
- [ ] tests/test.rs (no concerns)

Security-Focused Review

## Security Review

**PR:** #123
**Risk Level:** [LOW / MEDIUM / HIGH]

### Security Checklist
- [ ] Input validation on all user inputs
- [ ] No hardcoded credentials
- [ ] Proper error handling (no stack traces exposed)
- [ ] SQL queries use parameterized statements
- [ ] File paths are validated
- [ ] Authentication/authorization checks in place

### Findings
| Severity | Issue | Location | Recommendation |
|----------|-------|----------|----------------|
| HIGH | ... | file:line | ... |
| MEDIUM | ... | file:line | ... |

### Recommendations
1. ...
2. ...

Example Usage

Review Current PR

User: Review the current PR

Claude: Let me fetch the PR details and review the changes.

[Executes: gh pr view --json number,title,body,files]
[Executes: gh pr diff]

Based on my analysis...

Review Specific PR

User: Review PR #42 in user/repo

Claude: I'll review PR #42.

[Executes: gh pr view 42 -R user/repo --json ...]
[Executes: gh pr diff 42 -R user/repo]

Here's my review...

Quick Check

User: Quick check the PR for security issues

Claude: I'll perform a security-focused review.

[Analyzes for security patterns only]

Security assessment...

Integration with Other Skills

This skill works well with:

Skill	Integration
`rust-router`	Rust-specific code quality checks
`domain-web`	Web security best practices
`unsafe-checker`	Unsafe Rust code analysis
`memory-filesystem`	Remember previous review context

Best Practices

For Reviewers

Be specific - Reference exact file:line locations
Be constructive - Suggest solutions, not just problems
Prioritize - Mark critical vs. nice-to-have
Be timely - Review PRs promptly

For Authors

Small PRs - Easier to review thoroughly
Good descriptions - Explain the why, not just what
Self-review first - Check your own code before requesting
Address all comments - Don't leave feedback unresolved

Download now (ZIP)

Other versions193 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 193
mattpocock/skills★ 309ksame name
TheAlgorithms/Python★ 226ksame name
microsoft/vscode★ 194ksame name
github/spec-kit★ 145ksame name
ggml-org/llama.cpp★ 133ksame name
shareAI-lab/analysis_claude_code★ 80ksame name
shareAI-lab/learn-claude-code★ 80ksame name
vectorize-io/hindsight★ 57ksame name
dbeaver/dbeaver★ 52ksame name
roboflow/supervision★ 51ksame name
183 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
Used alongsideProjects with it also use add-new-model, azsdk-common-sdk-breaking-change and 9 more.
Other files people use alongside this one.
- PydanticSkill
  add-new-model
  Add support for a newly-released language or image generation model in pydantic-ai (e.g. openai:gpt-5.6, anthropic:claude-sonnet-5, openai:gpt-image-2). Use when a provider ships a new model id and you need to wire literals, profile flags, adapters, and tests to recognize it. Handles SDK-lag, gateway list conventions, capability probing, and direct image-model geometry.
  Also in 9 projects that use this
- Microsoft AzureSkill
  azsdk-common-sdk-breaking-change
  Detect and mitigate SDK Breaking changes for an SDK package which is generated from TypeSpec. WHEN: "Detect SDK breaking changes for a service", "Detect SDK breaking changes for an SDK package", "Detect and mitigate SDK breaking changes for a service", "Detect and mitigate SDK breaking changes for an SDK package". INVOKES: skill: azsdk-common-generate-sdk-locally; MCP tools: azure-sdk-mcp:azsdk_customized_code_update, azure-sdk-mcp:azsdk_package_detect_breaking_change.
  Also in 4 projects that use this
- ww-w-aiSkill
  bkend-auth
  bkend.ai authentication guide. Signup, login, JWT tokens, sessions, role-based access control, and password management with bkend.ai BaaS. Triggers: bkend auth, bkend login, bkend signup, JWT, session, RBAC, password, bkend 인증, 로그인, 회원가입, bkend認証, ログイン, 新規登録, bkend认证, 登录, 注册, autenticacion bkend, authentification bkend, bkend-Auth Do NOT use for: data operations (use $bkend-data), file storage (use $bkend-storage).
  Also in 4 projects that use this
- ww-w-aiSkill
  bkend-cookbook
  bkend.ai cookbook with step-by-step tutorials and example projects. Build a todo app, blog, e-commerce store, and more with bkend.ai BaaS. Triggers: bkend cookbook, bkend tutorial, bkend example, todo app, blog app, bkend 쿡북, bkend 튜토리얼, 예제 프로젝트, bkendクックブック, チュートリアル, bkend教程, 示例项目, tutorial bkend, tutoriel bkend, bkend-Tutorial, ricettario Do NOT use for: initial setup (use $bkend-quickstart), specific features (use $bkend-data/auth/storage).
  Also in 4 projects that use this
- dzhngSkill
  close-spec
  When a spec under specs/<feature>/ is done shipping (a write-spec build, or any planned task that produced a spec), archive it to specs/done/ and rewrite it from a build-plan into a durable rationale — the why, the principles, the invariants — pointing back to the real code for the how. Use when implementation has landed and the plan no longer matches what shipped, or the user says a feature/spec is finished. Pairs with [write-spec](../write-spec/SKILL.md) (the plan this closes) and [review](../review/SKILL.md) (run before closing).
  Also in 4 projects that use this
- dzhngSkill
  design-with-images
  Explore UI and visual design with image generation, then iterate the real implementation against the user-selected concept. Use when brainstorming visual directions, offering mockup variants, or implementing an approved generated design; do not stop at the mockups or the first code approximation.
  Also in 4 projects that use this
- +5 more from ww-w-ai
In this repository7 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- cowork-guideSkill
- cowork-guideSkill
- cowork-routerSkill
- github-generateSkill
- github-searchSkill
- memory-skillsSkill

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

It worked
Partly
It didn't

What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free