code-review (fork)

by evelemans

Thorough code review — checks correctness, security, performance, readability, and test coverage. Gives actionable feedback ranked by severity.

v1.0.02 installs

Signing

SignedSLSA L2

Signed by: skills-hub.ai distributor
Method: Distributor-signed by skills-hub.aiCryptographically signed by the skills-hub.ai distributor key at publish time.
Signed: Aug 31, 2026, 12:34 PM

Install this skill

Run this command in your terminal. No account required — it auto-detects your AI tool and installs the skill file.

npx @skills-hub-ai/cli install code-review-fork-4

Or download directly:

Browse all CLI commands →

Setup by platform

Claude Code

~/.claude/skills/<skill>/SKILL.md

Setup guide →

Cursor

~/.cursor/skills/<skill>/SKILL.md

Setup guide →

Codex CLI

~/.codex/skills/<skill>/SKILL.md, or reference via codex.md instructions file

Setup guide →

Install

One-click setup for your editor

Run in your project root

npx @skills-hub-ai/cli install code-review-fork-4 --target claude-code

Examples

Prompt

Please review the recent changes in the user authentication module for potential security issues and code quality.

Output

[SEC] Missing input validation on login form; potential injection risk. Add server-side validation.
[READ] Variable naming inconsistent; rename `usr` to `user` for clarity.
[PERF] Repeated database calls inside loops; refactor to batch fetch users.
[TEST] No tests covering failed login attempts; add edge case tests.
Overall, improve input validation and reduce database calls for better security and performance.

Prompt

Review the latest pull request with the new payment processing feature.

Output

[CORRECTNESS] Payment amount not validated before processing; add validation to prevent negative or zero amounts.
[SEC] Sensitive API keys hardcoded in the codebase; move to environment variables.
[PERF] External API call made synchronously; convert to async with proper error handling.
[READABILITY] Function `processPayment` is too long; split into smaller, well-named functions.
[TEST] Missing tests for failed API responses; include mock failures to ensure robustness.
Address these issues to improve security, correctness, and maintainability.

Instructions

This skill doesn’t include stateful context yet, instructions only. Learn about stateful skills.

Security

Loading security scan...

Reviews (0)

View full changelog & diffs →

More Review skills

Browse category →

code-reviewThorough code review — checks correctness, security, performance, readability, and test coverage. Gives actionable feedback ranked by severity.287 installs security-reviewSecurity audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation, vertical privilege escalation via role manipulation, SQL injection, NoSQL injection, XSS (stored, reflected, DOM), command injection, path traversal, SSRF, CSRF, hardcoded secrets and API keys (sk_live_, AKIA, ghp_), .env and credential file exposure, PII leaking in logs and error responses, overfetching sensitive fields, CORS misconfiguration, session fixation, missing secure/httpOnly/sameSite cookie flags, and Firebase/Firestore rule weaknesses. Produces a severity-ranked findings report with exploit scenarios and fix recommendations. Covers OWASP Top 10.48 installs refactorSystematic code refactoring — extract functions, reduce complexity, eliminate duplication, improve naming, and split large files. Preserves behavior with tests.44 installs security-auditScan a codebase for security vulnerabilities — OWASP Top 10, secrets in code, dependency CVEs, auth flaws, injection risks, and misconfigurations. Fixes what it finds.28 installs api-reviewReview API design against REST best practices and internal consistency. Audits naming conventions, HTTP method semantics, status code correctness, pagination and filtering patterns, error response format, versioning strategy, rate limiting, idempotency keys, HATEOAS links, and content negotiation. Works with Express, Fastify, Hono, Flask, Django REST, Spring, Rails, Gin, and any HTTP API framework. Use when you need to review an API, audit REST endpoints, check API consistency, fix HTTP status codes, add pagination, or prepare an API for public release.11 installs arch-reviewArchitect-level story review with component reuse, domain consistency, data privacy, service architecture, and infrastructure checks. Design review before coding or implementation validation after.10 installs

Frequently asked questions about code-review (fork)

What does the code-review (fork) skill do?

Thorough code review — checks correctness, security, performance, readability, and test coverage. Gives actionable feedback ranked by severity. It's a reusable SKILL.md instruction set that loads into your AI coding assistant on demand, no prompt engineering, no copy-pasting every session.

How do I install the code-review (fork) skill?

Run `npx @skills-hub-ai/cli install code-review-fork-4` from your terminal. The CLI writes the SKILL.md to the correct location for your AI tool (e.g. ~/.claude/skills/code-review-fork-4/ for Claude Code or ~/.cursor/skills/ for Cursor with --target cursor) and adds it to your project's .skills.json lockfile.

Which AI tools does code-review (fork) work with?

code-review (fork) runs in Claude Code, Cursor, Codex CLI. It follows the open Agent Skills standard (SKILL.md), so the same skill works in every supported tool without modification.

Is the code-review (fork) skill free?

Yes. Every skill on skills-hub.ai is free and open-source. There are no premium tiers, paywalls, or usage limits. You only pay for whatever AI assistant you're already using.

How do I use code-review (fork) after installing it?

In Claude Code, type `/code-review-fork-4` (or whatever slash command the skill registers) and the AI follows the skill's instructions immediately. You can also reference it by name in natural language, your AI loads the skill into context when relevant.

Can I share the code-review (fork) skill with my team?

Yes. Commit your project's .skills.json lockfile and teammates run `npx @skills-hub-ai/cli install` (no args) to install every skill at the exact version you pinned. Organization-scoped installs work via skills-hub.ai organizations.