Guide · Agent skill
How to use the ponytail-review agent skill for code review
Updated · written with AI from the project's own documentation and checked against our catalogue data
ponytail-review is an agent skill that makes an AI agent review a code change the way an experienced senior developer would before it ships. It is useful for developers who want a second pair of eyes on a diff or pull request, and for small teams without a dedicated reviewer. After this guide you will know what the skill does, how to install it, how to ask for a review and how to read the findings.
Ponytail Code ReviewDietrichGebert/ponytail · MIT Download the skill Quick start
- 1Download the ZIP. Download the ponytail-review skill ZIP from the skill page on this site.
- 2Unzip into the skills folder. Unzip the file into ~/.claude/skills/ for all projects, or into the project's .claude/skills/ folder for one project.
- 3Or upload in the Claude apps. In the Claude apps, go to Settings → Capabilities → Skills and upload the ZIP.
- 4Name the change to review. Ask the agent to review uncommitted changes, a branch, a PR link or specific files.
- 5Read the findings. Work through the Must fix group first, then Should fix and Nice to have.
- 6Apply the fixes you choose. The skill changes no code, so make the fixes yourself or ask the agent to apply the ones you pick.
What is an agent skill and what does ponytail-review do?
An agent skill is a folder with a SKILL.md file that tells an AI agent how to handle a specific kind of task. When the skill is installed, the agent follows its instructions when you ask for that task.
ponytail-review tells the agent to review a code change. The agent reads the changed code, the code that calls it, the tests and the README. It then lists problems in order of importance: bugs, security risks, problems under real load, missing tests, slowness and unnecessary code.
- Bugs: wrong results, crashes, missed edge cases such as empty input or time zones
- Security risks: for example injection, weak randomness, secrets or missing input checks
- Problems under real load: code that works for one user but fails for many
- Missing tests: risky new logic with no test that would fail if it broke
- Slowness and unnecessary code: things to delete, reuse or simplify
How to install the ponytail-review skill
Download the ZIP file of the skill from the skill page on this site. Then choose one of the two install routes below.
For a personal skill that works in all your projects, unzip the file into ~/.claude/skills/. For a skill that only one project uses, unzip it into that project's .claude/skills/ folder.
If you use the Claude apps instead, upload the ZIP under Settings → Capabilities → Skills.
- Personal install: unzip into ~/.claude/skills/
- Project install: unzip into the project's .claude/skills/ folder
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
How do you trigger the review with a natural request?
You do not need a special command. Ask the agent in plain words and name what to review. The skill reviews whatever you name. If you name nothing, it reviews your uncommitted changes, or the last commit if there are none.
Good requests name the change, for example uncommitted or staged changes, a branch, a pull request link, or specific files.
- Review my uncommitted changes before I commit.
- Review the staged changes for bugs and security problems.
- Review the branch feature/invoice-export before I merge it.
- Review this pull request: [paste PR link]
- Review src/billing/close_day.py and its callers.
What does a finding look like?
The report starts with a short summary of what the change does. Findings are then grouped as Must fix, Should fix and Nice to have. Each finding is numbered, so you can reply with something like fix 2 and 5.
Every finding has four parts: what this is, the problem, the fix and what happens if you skip it. Each finding also names the file and lines it concerns. Findings must include a concrete case where the code gives a wrong result. The skill does not raise vague worries or style preferences.
- What this is: a short plain-English description of the code
- Problem: what goes wrong and in which situation
- Fix: the smallest change that solves it
- If we skip it: the result of leaving it as it is
What does the skill need and what are its safety limits?
The skill lists no requirements. It does not run scripts and does not use the network. It only reads the code you give it and writes a report.
The skill changes no code. It lists findings and suggests fixes, and you decide what to apply. It cannot replace a formal security audit. It can also miss issues in very large changes, because the agent may not be able to read every caller of every changed function.
- Runs scripts: no
- Uses network: no
- Changes code: no, it only lists findings
- Replaces a formal security audit: no
Tips for getting better reviews
Name the exact scope of the change so the agent reads the right diff. Tell the agent about the expected load if the README does not describe it, because the skill judges scale against the load it assumes. The skill also respects shortcuts that are marked in code with a comment naming their limit, unless the expected load already exceeds that limit.
- Give a branch, PR link or file list rather than a vague request
- State how many users or runs you expect, for example one script or thousands of users
- Keep the change focused; very large diffs may be reviewed less completely
- Ask for a re-review after you fix findings, using the same scope
What people use it for
- Checking a feature branch for bugs and missing edge cases before opening a pull request
- Getting a second opinion on a pull request in a small team with no dedicated reviewer
- Spotting code that will slow down or fail when many users or processes run at once
- Finding risky new logic, such as payment or data-write code, that has no test
- Getting plain-English explanations of technical risks to share with non-specialists
Frequently asked questions
Is the ponytail-review skill free to use?
The skill is published under the MIT licence, as stated on this page. Check the licence file in the source repository for the full terms before you reuse or redistribute it.
What do I need to run ponytail-review?
The skill lists no requirements. It does not run scripts and does not use the network, so you only need an AI agent that can load skills and read your code.
How do I install an agent skill in Claude?
Download the ZIP and unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder. In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
Will ponytail-review fix my code automatically?
No. The skill is written to list findings and change no code. Each finding includes a suggested fix that you can apply yourself or ask the agent to apply.
Can ponytail-review replace a security audit?
No. The skill only reads the code it is given and cannot replace specialist review. Use a formal security audit for projects that need one.
What kinds of problems does it find?
It looks for bugs, security risks, data loss, problems under real load, missing tests, slowness and unnecessary code. It also suggests deleting dead code or reusing helpers the repo already has.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use ponytail-review if you want a consistent, plain-English checklist for diffs and pull requests before merging, especially on a small team. Pick something else if you need a formal security audit, automatic fixes, or a reliable review of very large changes where every caller must be read.
Download the skill