How to use the Code Review Specialist agent skill

What is an agent skill and what does this one do?

An agent skill is a folder of instructions, and sometimes helper scripts, that an AI agent loads when a task matches the skill's description. The skill tells the agent how to approach that kind of task, so you do not have to explain the method every time.

When this skill is active, the agent reviews code the way a senior engineer would. It checks for security issues such as injection, authentication and authorization problems, sensitive data in logs and weak cryptography. It also looks at performance (algorithmic cost, memory, database queries, caching, concurrency) and at quality and maintainability (function length, complexity, naming, documentation, tests).

• Security: authentication and authorization, data exposure, injection, cryptographic weaknesses, logging of sensitive data
• Performance: algorithm efficiency (Big O), memory use, database query patterns, caching opportunities, concurrency problems
• Quality: SOLID principles, design patterns, naming conventions, documentation, test coverage
• Maintainability: readability, function length (the skill asks for under 50 lines), cyclomatic complexity, dependency management, type safety

How do you install the Code Review Specialist skill?

Download the ZIP for code-review-specialist from this page. Then choose one of the two installation routes below.

For Claude Code, unzip the download into your personal skills folder at ~/.claude/skills/, or into a project's .claude/skills/ folder if you want the skill available only in that project. Afterwards the folder should contain the skill's SKILL.md file.

If you use the Claude apps, upload the ZIP under Settings → Capabilities → Skills instead.

• Personal install: ~/.claude/skills/
• Project install: the .claude/skills/ folder inside your project
• Claude apps: Settings → Capabilities → Skills, then upload the ZIP

How do you trigger the skill with natural requests?

You do not need a special command. The agent decides to use the skill when your request matches its description, so ask in ordinary language. The skill's description names these triggers: asking for a code review, asking for code quality analysis, asking to evaluate a pull request, and mentioning security analysis or performance optimization.

Be specific about the scope. Naming a file, a function or a diff helps the agent focus, and saying which concern matters most (security, speed, maintainability) changes the emphasis of the report.

• Review this file for security issues: [paste or name the file]
• Do a code review of the changes in this pull request before I merge
• Analyze the code quality of the payment module and tell me what to refactor
• Check this function for performance problems and algorithmic cost
• Review src/auth/login.py for authentication and logging problems

What does the review report look like?

The skill asks for a fixed structure, which makes reports easy to compare across reviews. Each reviewed piece of code gets a summary with an overall quality score from 1 to 5, a count of findings and the recommended priority areas.

Critical issues, when present, are listed with a clear description, location (file and line number), impact, severity (critical, high or medium), and an example fix. Remaining findings are grouped under security, performance, quality and maintainability, with each group shown only when it has problems.

• Summary: overall score (1-5), number of issues, priority areas
• Critical issues: problem, location, impact, severity, example fix
• Findings by category: security, performance, quality, maintainability

What do the helper scripts do and when should you run them?

The skill includes two small Python scripts. scripts/analyze-metrics.py counts functions, classes and rough complexity in a Python file. scripts/compare-complexity.py compares complexity before and after a change. Both are useful when you want quick numbers to back up the review.

The scripts use simple regex-based counting on Python-style keywords and syntax. Treat their numbers as rough indicators, not exact measurements, and check the script's own header or code for how to pass it a file before running it.

• Requires Python 3, and only if you run the scripts
• Works on Python files only; other languages are not parsed by the scripts
• Counts are approximate and can miss or misreport some constructs

What should you check before using it on real code?

The skill runs scripts, so it is not a purely text-based instruction set. Review the scripts before running them, and run them only in an environment you trust. The skill does not declare any network use, and the provided files mention no API keys or accounts.

The checks are prompt-driven, so the agent's findings depend on the code it is given and on the model running the skill. Do not send sensitive proprietary code to an external service unless your setup has approved that service.

• Runs scripts: yes. Read them first and run them in a trusted environment.
• Uses network: no, according to the skill's documentation.
• Requires: Python 3 for the scripts; no API keys or accounts are mentioned.
• Not a replacement for a real security audit or penetration test.

What tips help you get better reviews?

Give the agent the smallest unit that makes sense: one file, one module or one pull request diff. Smaller scopes produce more precise findings. Name the concern you care about most so the report can prioritize it.

Use the included review checklist and finding template as a reference when you want the review to follow your team's process. Verify every critical finding yourself before acting on it, because the agent can be wrong about context it cannot see.

• Keep scope small: one file or one diff at a time
• State priorities, such as security before style
• Compare results with templates/review-checklist.md and templates/finding-template.md
• Confirm critical findings manually against the code and its context