Code Reviewer Skill

A Claude Code skill that automates pull request analysis, diff review, and code quality assessment — flagging bugs, security issues, performance problems, and style violations with actionable feedback.

When to Use This Skill

Choose this skill when:

• Reviewing pull requests before merging to production branches
• Performing automated first-pass code review to save human reviewer time
• Analyzing large diffs that are difficult to review manually
• Enforcing consistent review standards across a team
• Auditing changes to critical code paths (auth, payments, data handling)

Consider alternatives when:

• You need real-time pair programming feedback (use an IDE assistant)
• You need static analysis enforcement only (use ESLint, SonarQube)
• You need security-only review (use a dedicated security scanning skill)

Quick Start

Copy
# Add to your Claude Code project
claude mcp add code-reviewer

# Review the current branch against main
claude "review changes between main and this branch"

# Review a specific PR
claude "review PR #42 for bugs, security issues, and style"

Copy
# .claude/skills/code-reviewer.yml
name: code-reviewer
description: Automated code review with multi-dimensional analysis
triggers:
  - "review code"
  - "review PR"
  - "check this diff"
config:
  depth: standard
  categories: [correctness, security, performance, readability]
  severity_threshold: suggestion

Core Concepts

Review Dimensions

Dimension	What It Checks	Example Finding
Correctness	Logic errors, edge cases, null handling	Off-by-one in pagination loop
Security	Injection, auth bypass, secret exposure	User input passed directly to SQL query
Performance	N+1 queries, memory leaks, blocked I/O	Database query inside a loop
Readability	Naming, complexity, function length	200-line function with 6 nesting levels
Testing	Missing tests, weak assertions, coverage	New endpoint with no integration test
Compatibility	Breaking API changes, migration needs	Removed field still used by mobile client

Review Output Format

Copy
## Review Summary
- **Files changed**: 12
- **Lines added**: 340 | **Lines removed**: 128
- **Findings**: 2 blockers, 3 warnings, 5 suggestions

### 🔴 Blocker: SQL Injection in UserService
**File**: src/services/userService.ts:45
```typescript
// Current: User input interpolated into query
const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);

// Recommended: Use parameterized query
const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);

🟡 Warning: Missing error handling in API route

File: src/routes/orders.ts:78 The createOrder handler doesn't catch database transaction failures. Add try/catch with proper rollback logic.

## Configuration

| Parameter | Type | Default | Description |
|-----------|------|---------|-------------|
| `depth` | string | `"standard"` | Review depth: quick, standard, thorough |
| `categories` | array | `["correctness", "security", "performance", "readability"]` | Review dimensions to check |
| `severity_threshold` | string | `"suggestion"` | Minimum severity: blocker, warning, suggestion |
| `max_findings` | number | `25` | Maximum findings per review |
| `include_praise` | boolean | `true` | Include positive feedback on well-written code |
| `diff_base` | string | `"main"` | Base branch for diff comparison |
| `ignore_patterns` | array | `["*.test.*", "*.spec.*"]` | File patterns to skip |

## Best Practices

1. **Run automated review before human review** — let the skill catch mechanical issues (missing null checks, unused imports, obvious bugs) so human reviewers can focus on architecture, design, and business logic.

2. **Configure severity thresholds per project maturity** — new projects benefit from `suggestion` threshold to establish good patterns early; mature projects can use `warning` to reduce noise on well-established codebases.

3. **Review test changes alongside implementation** — always include test files in the review scope; changes without corresponding test updates are a common source of regressions.

4. **Act on blockers immediately, batch suggestions** — blocker findings should be fixed before merge; group suggestion-level findings into a follow-up task rather than blocking the current PR.

5. **Customize ignore patterns for generated code** — exclude auto-generated files (migrations, API clients, lock files) to avoid noisy findings on code that shouldn't be manually maintained.

## Common Issues

**Too many low-severity findings obscure real problems** — If every review produces dozens of suggestions, reviewers learn to ignore them. Raise the `severity_threshold` to `warning` and use a linter for style enforcement.

**False positives on intentional patterns** — The skill may flag code that looks wrong but is intentional (e.g., catch-all error handlers, intentional type coercion). Add inline `// review-ignore: reason` comments to suppress specific findings.

**Review misses cross-file dependencies** — The skill analyzes changed files but may miss impacts on unchanged files that import the modified code. Use `depth: thorough` for critical changes, which analyzes the dependency graph beyond the diff.