A code-review skill for checking code changes for security risks, performance problems, maintainability issues, and inconsistent style. It produces a report that groups findings by urgency.

It is for reviewing pull requests and other code changes, checking project conventions and linter rules, and reporting problems with file and line references.

It gives developers a structured way to spot common defects, such as unsafe database queries, exposed credentials, slow repeated queries, and unclear code.

code-review — Skill for Claude Code and Codex by fuzhengwei

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add fuzhengwei/xfg-skills-template --skill code-review

Clone the repo

git clone --depth 1 https://github.com/fuzhengwei/xfg-skills-template

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/fuzhengwei/xfg-skills-template/code-review/github.svg)](https://agentmods.dev/skills/fuzhengwei/xfg-skills-template/code-review)

Your own site

<a href="https://agentmods.dev/skills/fuzhengwei/xfg-skills-template/code-review"><img src="https://agentmods.dev/badge/skills/fuzhengwei/xfg-skills-template/code-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/fuzhengwei/xfg-skills-template/code-review"><img src="https://agentmods.dev/badge/skills/fuzhengwei/xfg-skills-template/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 45 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 590 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00045	$0.00590
Opus 5.5	$0.00018	$0.00236
Sonnet 5.5	$0.00009	$0.00118
Haiku 4.5	$0.00005	$0.00059

Measured 2mo ago against content hash fa17b132565b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

examples/code-review/SKILL.md · 74 lines

What it actually says

Code Review 技能

对代码变更进行系统性审查，覆盖安全性、性能、可维护性和风格一致性。

审查维度

1. 安全性检查

SQL 注入：所有数据库查询必须使用参数化查询
XSS：用户输入必须经过转义再输出
认证：每个 API 端点必须有身份验证检查
敏感信息：错误消息不得泄露内部实现细节
密钥管理：不得在代码中硬编码密钥和凭证

2. 性能检查

N+1 查询：循环中不得执行数据库查询
内存泄漏：大对象必须及时释放
异步处理：I/O 密集操作应使用异步
缓存策略：频繁访问的数据应考虑缓存

3. 可维护性检查

函数长度：单个函数不超过 50 行
圈复杂度：不超过 10
命名规范：变量和函数名应表达意图
注释：复杂逻辑必须有注释说明

4. 风格一致性

遵循项目现有的代码风格
使用项目配置的 linter 规则

审查流程

阅读变更描述，理解意图
按维度逐项检查
将问题分为：🔴 必须修复 / 🟡 建议改进 / 🟢 可选优化
输出审查报告

输出格式

# Code Review 报告

## 概要
- 变更范围：[简述]
- 审查结果：[通过/需修改]

## 🔴 必须修复
- [文件:行号] 问题描述

## 🟡 建议改进
- [文件:行号] 改进建议

## 🟢 可选优化
- [文件:行号] 优化建议

## 总体评价
[1-2 句总结]

Gotchas

不要只关注错误，也要肯定好的实践
优先审查安全问题和数据完整性
对于风格问题，如果项目有 linter 配置，以 linter 为准

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 74 lines · 45 tokens per session scan A fa17b132565b

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository fuzhengwei/xfg-skills-template (15 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 45 tokens to every session and 590 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code review

code-review next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
code-reviewfuzhengwei/xfg-skills-template	Skill	15	5mo ago	Apache-2.0	A	45	Claude Code, Codex
autoreviewopenclaw/clawhub	Skill	9.5k	yesterday	MIT	A	17	Claude Code, Codex
agent-teams-simplify-and-hardenLeoYeAI/openclaw-master-skills	Skill	2.2k	6d ago	MIT	A	115	Claude Code, Codex
omh-code-reviewrlaope/oh-my-hermes	Skill	5.2k	yesterday	MIT	A	48	Claude Code, Codex
revdiff-planumputun/revdiff	Skill	945	yesterday	MIT	A	84	Claude Code
explore-unknownsdzhng/skills	Skill	1.4k	2d ago	MIT	A	162	Claude Code, Codex
re0-mergeLilMGenius/paperthin	Skill	1.4k	4d ago	MIT	A	70	Claude Code