review

review is a skill for Claude Code from This-HW/claude-code-kit. It costs 29 tokens per session (2,493 once invoked), scanned A, original, MIT.

A full code-review workflow for current changes or selected files. It runs static checks when relevant, then performs code review and security scanning in sequence.

In plain words
What is it for?
Use it before merging code to check Python files with ruff when applicable, review the changes for correctness, and scan them for security problems.
Why use it?
It brings common quality and security checks into one repeatable review process. It also reports complexity as a signal for review attention rather than treating it alone as a failure.

Skill for Claude Code

Written for Claude Code: effort in frontmatter. Also seen: model in frontmatter.

Part of the claude-code-kit plugin — 20 skills, 4 hooks shipped together

Good fit Use it before merging code to check Python files with ruff when applicable, review the changes for correctness, and scan them for security problems.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/this-hw/claude-code-kit/review
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add This-HW/claude-code-kit --skill review
Clone the repo
git clone --depth 1 https://github.com/This-HW/claude-code-kit

Made for: Claude Code.

Or install claude-code-kit, the plugin that ships this one along with the rest of its 20 skills, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for review

README.md
[![agentmods](https://agentmods.dev/badge/skills/this-hw/claude-code-kit/review/github.svg)](https://agentmods.dev/skills/this-hw/claude-code-kit/review)
Your own site
<a href="https://agentmods.dev/skills/this-hw/claude-code-kit/review"><img src="https://agentmods.dev/badge/skills/this-hw/claude-code-kit/review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for review

Your own site · 80×15
<a href="https://agentmods.dev/skills/this-hw/claude-code-kit/review"><img src="https://agentmods.dev/badge/skills/this-hw/claude-code-kit/review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 29 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,493 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00029 $0.02493
Opus 5.5 $0.00012 $0.00997
Sonnet 5.5 $0.00006 $0.00499
Haiku 4.5 $0.00003 $0.00249

Measured 1mo ago against content hash 065894269843, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/common/skills/review/SKILL.md · 291 lines

How it starts

The opening of the file, as written. The whole thing — 291 lines — stays where its author put it; the contents beside it link to each section on GitHub.

코드 리뷰 실행

즉시 실행하세요. 설명하지 말고 바로 실행합니다.

파이프라인 구조

┌──────────────┐   ┌──────────────┐   ┌───────────────┐
│ 리뷰 대상    │ → │ review-code  │ → │ security-scan │
│ 파악 (Main)  │   │ (opus)       │   │ (sonnet)      │
└──────────────┘   └──────────────┘   └───────────────┘

0단계: 정적 분석 (Python 파일 포함 시)

리뷰 대상에 .py 파일이 포함되어 있으면 ruff check를 먼저 실행합니다.

# 특정 파일 지정 시
ruff check [대상 파일 또는 디렉토리]

# git diff 대상 시 (변경된 .py 파일 추출 후)
git diff HEAD --name-only | grep '\.py$' | xargs ruff check 2>/dev/null

결과 처리:

  • ruff check 출력이 있으면: 리뷰 컨텍스트에 포함하여 review-code 에이전트에 전달
  • ruff check 통과 시: "정적 분석: 통과" 메시지만 출력
  • ruff가 설치되지 않은 경우: "스킵됨 (ruff 미설치)" 메시지 출력

형식:

## 0단계: 정적 분석 (ruff)
- 대상: [파일 목록 또는 "없음 (Python 파일 없음)"]
- 결과: [통과 | N건 발견]
- 발견된 이슈: [있을 때만 출력]

0.5단계: 복잡도 flag — 하이브리드 (advisory 전용, Python 파일 포함 시)

결정론 flag → LLM 판단 2단 하이브리드입니다. 복잡도 수치는 리젝 사유가 아니라 리뷰 초점 신호입니다.

# mccabe 복잡도 flag (ruff 내장, 기본 임계 10)
ruff check --select C901 [0단계와 동일한 대상 파일]

결과 처리:

  • flag된 함수가 있으면: 목록을 review-code 에이전트 컨텍스트에 다음 지시와 함께 전달 —

    아래 함수들은 복잡도 임계를 넘었다(결정론 flag). 줄수·복잡도 수치 자체를 리젝 사유로 삼지 말고, 다음 관점으로만 분리 타당성을 판단하라: ① 모듈/함수 경계가 단일 책임인가 ② IN/OUT 계약(인자·반환·부수효과)이 명확히 분리 가능한가 ③ 분리 시 계약이 단순해지는가(아니면 그대로가 응집적인가). 응집적이면 flag를 기각하고 그 근거를 명시하라.

  • flag 없으면: "복잡도: 통과" 한 줄만.
  • 절대 blocking 아님: 이 단계는 어떤 경우에도 리뷰를 실패시키지 않는다 (전역 lint(E,F)·stop-validator와 무관 — advisory 전용).
  • ruff 미설치: "스킵됨 (ruff 미설치)" — fail-open.

형식:

## 0.5단계: 복잡도 flag (advisory)
- flag: [없음 | 함수 N건 (파일:라인, 복잡도)]
- 처리: [review-code 판단 위임 | 통과]

1단계: 리뷰 대상 파악

$ARGUMENTS가 있으면:

  • 해당 파일/디렉토리를 읽어서 리뷰

$ARGUMENTS가 없으면:

  • git diff HEAD로 변경사항 확인
  • 변경사항이 없으면 git diff HEAD~1로 마지막 커밋 확인

1.5단계: 자동 범위 판단 (Auto-Scope)

변경 파일을 분석하여 리뷰 범위를 자동으로 결정합니다.

수동 오버라이드 확인

$ARGUMENTS에 --quick이 포함되어 있으면:

  • scope = 'quick' (사용자 명시 오버라이드)
  • security_scan_needed = false
  • "수동으로 quick 모드가 지정되었습니다" 메시지 출력
  • 1.5단계 나머지 스킵하고 2단계로 진행

Read the full file on GitHub · 291 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 291 lines · 29 tokens per session scan A 065894269843

Subscribe to this mod's changes

review is a skill published in the GitHub repository This-HW/claude-code-kit (4 stars, last pushed 1mo ago), licensed MIT. It adds 29 tokens to every session and 2,493 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

code-standards

Prabhdeep (Sonu) Singh's personal coding standards — the house rules and quality bar for how code gets written. INVOKE before writing, generating, refactoring, or reviewing ANY code in ANY language — schemas, endpoints, queries, logging, validation, error handling — even when nobody says "standards" or "style".…

PrabhdeepSingh/claude-plugins · 81 tokens

self-review

Surface the riskiest parts of the current diff so a reviewer knows where to look hardest — one inline pass on small diffs, one cold read on a cheaper model tier with in-session synthesis on substantial ones. INVOKE PROACTIVELY whenever a change is finished and about to be handed off, reviewed, or shipped. It points…

PrabhdeepSingh/claude-plugins · 79 tokens

bug-finder

Hunt for one real, previously unreported defect and file it as a well-evidenced ticket — proactive discovery, not reactive diagnosis. INVOKE when asked to sweep code for bugs or hunt risky areas, and when /sonu:factory runs a bug-hunt pass. A known symptom is [[debugging]]; a pending diff is [[self-review]]. It files…

PrabhdeepSingh/claude-plugins · 94 tokens

java-jpa

Reviews Spring Data JPA for N+1 queries, fetch strategies, projections, and Specifications. Use when user asks to "review JPA", "check for N+1", "JPA performance", "review my entities", "check fetch strategy", or "review my repositories".

ducpm2303/claude-java-plugins · 57 tokens

java-health

Runs a holistic code health check scoring Security, Tests, Performance and Quality with A-F grades. Use when user asks to "check health", "score this project", "health check", "how good is this code", "overall assessment", or "code quality score".

ducpm2303/claude-java-plugins · 54 tokens

java-cache

Use when the user asks to add caching, configure Redis or Caffeine cache, use @Cacheable/@CacheEvict/@CachePut, optimize repeated database or API calls, or review existing Spring Boot cache configuration.

ducpm2303/claude-java-plugins · 46 tokens