Code Reviewing
Read-only code review with a 4-part checklist and a severity-graded report format
Test report
- Verdict
- Tested · Works
- Score
- Tested
- Jul 21, 2026
- Environment
- Claude Code 2.x (agent harness)
- Upstream re-checked
- Aug 10, 2026 · 5520c42
Located the SKILL.md via the GitHub tree API (an identical copy also sits at 04-Skills/projects/00-basic-skill/SKILL.md, HTTP 200 on both raw fetches); frontmatter parses with name, description and allowed-tools [Read, Grep, Glob], the body references no external files or scripts, and I found no curl|sh, base64 blobs, or injection text. For output I wrote my own unseeded 31-line Express router (SQL string concatenation, an N+1 item loop, a module-level cache, client-supplied item prices) rather than the repo's pre-annotated src/auth.js, then produced a baseline review before opening the body and a second review following it strictly: baseline listed 6 issues unranked with no verdict, the skill run produced 13 with line numbers, severity buckets and a "Request Significant Changes" verdict, and its checklist surfaced two things the baseline missed outright — no ownership/authorization check on GET /orders/:id, and no tests. Real friction to flag: the description advertises "mentions reviewing changes" but allowed-tools omits Bash, so the skill cannot run git diff to fetch those changes; you must name files yourself. The repo is a Chinese-language course companion (~1k stars, no LICENSE file) and the skill is one of ~10 teaching demos, so the README is tutorial prose about skill structure rather than usage docs.
Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works
- Installs cleanly 5/5
- Triggers reliably 5/5
- Output vs. baseline 6/10
- Docs & honesty 3/5
What Code Reviewing does
A single-file Claude Code skill that turns an ad-hoc "look at my code" request into a structured review: a checklist covering quality, security, performance and maintainability, followed by a fixed report format with Critical/Major/Minor severity buckets, strengths, prioritized recommendations and an Approved / Needs Changes verdict. It triggers when you ask for a code review, want feedback on a file, or ask whether code has security or quality problems. Tool access is restricted to Read, Grep and Glob, so the review never edits or runs anything.
How to install Code Reviewing
mkdir -p ~/.claude/skills/code-reviewing
curl -sL -o ~/.claude/skills/code-reviewing/SKILL.md \
"https://raw.githubusercontent.com/huangjia2019/claude-code-engineering/HEAD/04-Skills/projects/00-basic-skill/.claude/skills/code-reviewing/SKILL.md"
# project-scoped instead: swap ~/.claude for ./.claude
# single file, no dependencies; restart Claude Code to pick it up
Skills live in ~/.claude/skills/ (global) or .claude/skills/
(per-project). Restart Claude Code after installing.
Commands — how to trigger Code Reviewing
-
/code-reviewingRead-only code review with a 4-part checklist and a severity-graded report format
It also activates on plain-language prompts like these:
-
Review this code before I merge it -
Give me feedback on this pull request -
Check this function for security issues
Frequently asked questions
- Is the Code Reviewing skill free?
- Yes. The skill itself is free from huangjia2019/claude-code-engineering. SkillProof publishes the install command and an independent test verdict at no cost.
- Does Code Reviewing work with Claude Code?
- We tested it with Claude Code 2.x (agent harness) on Jul 21, 2026. Verdict: Tested · Works. Located the SKILL.md via the GitHub tree API (an identical copy also sits at 04-Skills/projects/00-basic-skill/SKILL.md, HTTP 200 on both raw fetches); frontmatter parses with name, description and allowed-tools [Read, Grep, Glob], the body references no external files or scripts, and I found no curl|sh, base64 blobs, or injection text. For output I wrote my own unseeded 31-line Express router (SQL string concatenation, an N+1 item loop, a module-level cache, client-supplied item prices) rather than the repo's pre-annotated src/auth.js, then produced a baseline review before opening the body and a second review following it strictly: baseline listed 6 issues unranked with no verdict, the skill run produced 13 with line numbers, severity buckets and a "Request Significant Changes" verdict, and its checklist surfaced two things the baseline missed outright — no ownership/authorization check on GET /orders/:id, and no tests. Real friction to flag: the description advertises "mentions reviewing changes" but allowed-tools omits Bash, so the skill cannot run git diff to fetch those changes; you must name files yourself. The repo is a Chinese-language course companion (~1k stars, no LICENSE file) and the skill is one of ~10 teaching demos, so the README is tutorial prose about skill structure rather than usage docs.
- What is the Code Reviewing SkillProof Score?
- 7.6/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 6/10, docs & honesty 3/5.
- How do I install Code Reviewing?
- Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
- Can I use Code Reviewing with Cursor, Copilot, Gemini CLI, Codex or other AI tools?
- The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.