Borrowing it
Nothing to install: this file belongs to rohanmistry231/Claude-Code-Project-Structure-Learning-Repository. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rohanmistry231/Claude-Code-Project-Structure-Learning-Repository/main/.claude/skills/code-review/SKILL.mdgit clone --depth 1 https://github.com/rohanmistry231/Claude-Code-Project-Structure-Learning-RepositoryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rohanmistry231/claude-code-project-structure-learning-repository/code-review)<a href="https://agentmods.dev/skills/rohanmistry231/claude-code-project-structure-learning-repository/code-review"><img src="https://agentmods.dev/badge/skills/rohanmistry231/claude-code-project-structure-learning-repository/code-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rohanmistry231/claude-code-project-structure-learning-repository/code-review"><img src="https://agentmods.dev/badge/skills/rohanmistry231/claude-code-project-structure-learning-repository/code-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00471 |
| Opus 5.5 | $0.00000 | $0.00188 |
| Sonnet 5.5 | $0.00000 | $0.00094 |
| Haiku 4.5 | $0.00000 | $0.00047 |
Grade A, and why
code-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill: Code Review
Description
Perform a thorough code review of changed or specified files, checking for bugs, security issues, style violations, and adherence to the project's CLAUDE.md rules.
When to Use
Trigger this skill when the user says:
- "review this", "review my code", "code review"
- "check for issues", "look for bugs"
- "/review"
Instructions
You are performing a code review for the Blog API project. Follow these steps in order:
Step 1 — Understand the change
Read the files provided or recently edited. If the user didn't specify files, check git diff HEAD
to find what changed.
Step 2 — Check against CLAUDE.md rules
Go through each rule in CLAUDE.md and verify the code does not violate it:
- No
SELECT *in raw SQL - Every route has a docstring
- Schemas are in
schemas.py, not inline - DB writes go through service functions in
arc/services/ - No
print()statements - Errors use
HTTPException
Step 3 — Check for common bugs
- Unhandled edge cases (empty list, None values, 0 IDs)
- Missing input validation
- Off-by-one errors in pagination
- N+1 query problems (loading related objects in a loop)
Step 4 — Check for security issues
- SQL injection risk (raw string interpolation in queries)
- Missing authentication on protected routes
- Sensitive data (passwords, tokens) returned in responses
- CORS settings that are too permissive
Step 5 — Style & readability
- Function names are snake_case
- Variable names are descriptive
- No functions longer than 40 lines
Output Format
Structure your review as:
## Code Review: <filename(s)>
### Critical Issues (must fix)
- <issue>: <file>:<line> — <explanation>
### Warnings (should fix)
- <issue>: <file>:<line> — <explanation>
### Suggestions (optional improvements)
- <suggestion>
### Verdict
APPROVE / REQUEST CHANGES
If there are no issues, say "LGTM — no issues found." with a one-line summary.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 68 lines · 0 tokens per session scan A a78e6e58bb2e
code-review is a skill published in the GitHub repository rohanmistry231/Claude-Code-Project-Structure-Learning-Repository (2 stars, last pushed 7mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 471 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
memstack-development-code-reviewer
Use this skill when the user says 'review code', 'code review', 'check my code', 'audit this', 'review PR', 'review changes', 'what's wrong with this', or is requesting a structured review of code quality, security, performance, or maintainability. Do NOT use for refactoring plans or test generation.
shard
Use when the user says 'shard this', 'split file', or when working with files over 1000 lines.
design-patterns
Detect, suggest, and evaluate GoF design patterns in TypeScript/JavaScript codebases. Use when refactoring code, applying singleton/factory/observer/strategy patterns, reviewing pattern quality, or finding stack-native alternatives for React, Angular, NestJS, and Vue.
eval-skills
Audit a project or library of skills for metadata, trigger boundaries, workflow completion criteria, local resource closure, instruction economy, tool scope, effort, and routing evidence. Use before shipping skills, after importing a skill collection, or when a skill triggers too often or not at all.
pr-triage
4-phase PR backlog management with audit, deep code review, validated comments, and optional worktree setup. Use when triaging pull requests, catching up on pending code reviews, or managing a backlog of open PRs. Args: 'all' to review all, PR numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit…
audit-agents-skills
Audit Claude Code agents, skills, and commands for quality and production readiness. Use when evaluating skill quality, checking production readiness scores, or comparing agents against best-practice templates.