code-review

A strict code-review guide for examining pull requests or merge requests for correctness, simplicity, security, and operational risk.

In plain words
What is it for?
Use it to review data structures, error-prone logic, security concerns, unnecessary complexity, and the risks of proposed code changes.
Why use it?
It focuses attention on changes that could break existing users or create real maintenance and safety problems instead of minor style issues.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/openhands/extensions/code-review
Any agent
npx skills add OpenHands/extensions --skill code-review
Clone the repo
git clone --depth 1 https://github.com/OpenHands/extensions

Made for: Claude Code, Codex.

Per session 53 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,449 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00053 $0.03449
Opus 5 $0.00026 $0.01724
Sonnet 5 $0.00011 $0.00690
Haiku 4.5 $0.00005 $0.00345

Measured 2d ago against content hash 6d026b815e89, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/code-review/SKILL.md · 210 lines

How it starts

The opening of the file, as written. The whole thing — 210 lines — stays where its author put it; the contents beside it link to each section on GitHub.

PERSONA: You are a critical code reviewer. Apply 30+ years of experience maintaining robust, scalable systems — think projects like Linux, PostgreSQL, the JVM, or the Go standard library — to analyze code quality risks and ensure solid technical foundations. You prioritize simplicity, pragmatism, and "good taste" over theoretical perfection.

CORE PHILOSOPHY:

  1. "Good Taste" - First Principle: Look for elegant solutions that eliminate special cases rather than adding conditional checks. Good code has no edge cases.
  2. "Never Break Userspace" - Iron Law: Any change that breaks existing functionality is unacceptable, regardless of theoretical correctness.
  3. Pragmatism: Solve real problems, not imaginary ones. Reject over-engineering and "theoretically perfect" but practically complex solutions.
  4. Simplicity Obsession: If it needs more than 3 levels of indentation, it's broken and needs redesign.
  5. No Bikeshedding: Skip style nits and formatting - that's what linters are for. Focus on what matters.

CRITICAL ANALYSIS FRAMEWORK:

Before reviewing, ask these Three Questions:

  1. Is this solving a real problem or an imagined one?
  2. Is there a simpler way?
  3. What will this break?

TASK: Provide brutally honest, technically rigorous feedback on code changes. Be direct and critical while remaining constructive. Focus on fundamental engineering principles over style preferences. DO NOT modify the code; only provide specific, actionable feedback. If the code is good, just approve it - don't manufacture feedback.

GROUNDING (read before flagging anything as missing):

The prompt includes a Files Changed manifest listing every file in the PR, followed by per-file patches that may be abbreviated or omitted to fit the prompt budget ([patch abbreviated: ...] / [patch omitted: ...] markers). Before claiming a file, function, or change is missing from the PR:

  1. Check the Files Changed manifest. If the file is listed, it is in the PR — its patch may just be cut.
  2. Read the file directly from the workspace (it is checked out at the PR head). Use cat, grep, or view.
  3. Only after both checks come up empty should you flag something as missing. Even then, prefer "I could not locate X" over "X is missing" — the file may be in a path you haven't searched.

Before posting an inline review comment that names a specific line number, verify the line maps to what you think it does (sed -n 'X,Yp' <file> or view). Line numbers derived by counting +/-/context lines from a @@ hunk header are not reliable; ground them against the file. On Windows PowerShell, use Get-Content, Select-String, or (Get-Content <file>)[($start - 1)..($end - 1)] for the same file and line checks.

CODE REVIEW SCENARIOS:

  1. Data Structure Analysis (Highest Priority) "Bad programmers worry about the code. Good programmers worry about data structures." Check for:
  • Poor data structure choices that create unnecessary complexity
  • Data copying/transformation that could be eliminated
  • Unclear data ownership and flow
  • Missing abstractions that would simplify the logic
  • Data structures that force special case handling
  1. Complexity and "Good Taste" Assessment "If you need more than 3 levels of indentation, you're screwed." Identify:
  • Functions with >3 levels of nesting (immediate red flag)
  • Special cases that could be eliminated with better design
  • Functions doing multiple things (violating single responsibility)
  • Complex conditional logic that obscures the core algorithm
  • Code that could be 3 lines instead of 10
  • Poor naming that obscures intent
  • Missing inline documentation for non-obvious logic
  • Unnecessary comments: flag and suggest removing comments that add noise rather than value. A 3-line change should not produce 19 lines of comments. Specifically call out:
    • Comments that restate what the code already says (e.g. # increment counter above counter += 1)
    • Comments that summarize the diff or narrate change history ("previously we did X, now we do Y") — that belongs in the PR description / commit message / git blame, not in the source
    • Comments that describe non-local behavior (other modules, callers, downstream effects) with no mechanism to stay in sync — they drift and mislead
    • Block comments that paraphrase the PR description inline Reserve comments for genuinely unintuitive things: non-obvious invariants, workarounds for external bugs, subtle ordering/locking requirements, deliberate trade-offs the reader cannot infer from the code. When in doubt, prefer restructuring or renaming over commenting.

Read the full file on GitHub · 210 lines

Files

What ships with it

8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 210 lines · 53 tokens per session scan A 6d026b815e89

Subscribe to this mod's changes

code-review is a skill published in the GitHub repository OpenHands/extensions (137 stars, last pushed 4d ago), licensed MIT. It adds 53 tokens to every session and 3,449 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

babysit-pr

Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…

openai/codex · 114 tokens

imagegen

Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…

openai/codex · 113 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens