How to use the Code Review Specialist agent skill

What the Code Review Specialist skill makes the agent do

The skill focuses the agent on four review areas. For security, it looks at authentication and authorization problems, data leak risks, injection vulnerabilities, weak cryptography and sensitive data written to logs. For performance, it looks at algorithm efficiency (Big O analysis), memory use, database query problems, caching opportunities and concurrency issues.

For code quality, it checks SOLID principles, design patterns, naming, documentation and test coverage. For maintainability, it checks readability, function size (under 50 lines is the stated goal), cyclomatic complexity, dependency management and type safety.

Install the skill from the ZIP download

Download the ZIP for this skill from this page and unzip it. The skill folder contains SKILL.md, templates/finding-template.md and templates/review-checklist.md. Place the folder in one of these locations:

• Personal skills: ~/.claude/skills/ (available across your projects)
• Project skills: the .claude/skills/ folder inside a specific project
• Claude apps: upload the skill under Settings → Capabilities → Skills

Trigger the skill with natural requests

You do not need a special command. The skill's description says it applies when you ask for code review, code quality analysis or pull request evaluation, or when you mention code review, security analysis or performance optimization. Ask in ordinary language and include the code or files you want reviewed.

• Review this pull request for security problems before I merge it.
• Do a code quality and maintainability review of src/services/payments.ts.
• Check this function for performance issues such as N+1 queries.
• Give me a prioritized list of risks in this unfamiliar module.

Read the review output

Each review follows the same structure so that results are easy to compare across contributors. The summary gives an overall quality score from 1 to 5, the number of main findings and the recommended priority areas.

• Critical issues: each has an Issue description, Location (file and line), Impact, Severity (Critical, High or Medium) and a suggested Fix.
• Findings by category: Security, Performance, Quality and Maintainability, listed only where problems were found.
• Finding template: a per-issue template with severity levels from Critical (blocks deployment) to Low, plus a What / Why it matters / Current behavior / Expected behavior structure.

Use the review checklist alongside the agent

The templates/review-checklist.md file lists checks grouped into security, performance, quality and testing. Examples include hardcoded credentials, parameterized SQL queries, logging of sensitive data, N+1 queries, pagination for large datasets, and a test coverage target of 80% or more. Use it as a manual pass to confirm what the agent reported, or ask the agent to work through it for your code.

Safety notes: scripts, network and confidential code

According to the listing, this skill runs no scripts and uses no network access, and it lists no required tools or packages. The review itself is produced by the AI model reading your code, so the code you share is processed by the AI service you use. Do not use the skill on code containing secrets or confidential data unless that AI service is approved for that data.

The review is only as reliable as the model's reading of the code. It can miss issues or report false positives, so it does not replace a human security audit for production systems.