Code Review Skills

A collection of 22 focused code-review and security-audit skills, built to the Agent Skills open standard and packaged as a Claude Code plugin.

Each skill is a deliberate, single-purpose audit you run on demand. These are granular where the bundled /code-review and /security-review are broad. They do deep dive reviews of your code, when you want it to. They started life as the prompts in Claude-Code-Reviewing-Prompts.

What you get

• Spec-compliant skills. Every skill is a folder with a SKILL.md (name + description required, both within the spec's limits). They work in any tool that implements the Agent Skills standard, not just Claude Code.
• Claude Code extras, layered on top. disable-model-invocation (so these fire only when you ask), allowed-tools, and argument-hint are added as frontmatter. Tools that don't understand those keys simply ignore them — the skill still works.
• Two ways to install (below): as a Claude Code plugin, or by copying individual skill folders into any agent.

Install as a Claude Code plugin

/plugin marketplace add JeremyMorgan/code-review-skills
/plugin install code-audit@code-audit

Skills then appear under the plugin's namespace, e.g. /code-audit:solid-principles. Pass a path to scope the review:

/code-audit:secrets-management-audit src/auth

With no argument, each skill reviews the whole codebase. Findings are written to an audits/ folder.

Use standalone (any Agent Skills tool)

Copy any skill folder into your skills directory. No plugin required:

cp -r skills/solid-principles ~/.claude/skills/

Each folder is self-contained, so this works in any agent that follows the Agent Skills spec.

Skills

Code quality

• code-duplication-detection — duplicated and near duplicate code
• code-quality-metrics-standards — complexity and standards compliance
• design-pattern-implementation — pattern usage and fit
• error-handling-resilience — error-handling coverage and recovery
• exception-flow-analysis — exception propagation on critical paths
• initial-software-design-analysis — first-pass architecture review
• readability-and-naming — readability and naming conventions
• resilience-fault-tolerance — failure modes, retries, degradation
• solid-principles — SOLID adherence with concrete fixes
• testing-implementation — test quality and coverage gaps

Security

• api-and-infrastructure — API and infra hardening
• authentication-flow-review — login, sessions, tokens, credentials
• authorization-implementation — access control and privilege flaws
• business-logic-vulnerabilities — workflow bypasses, race conditions
• comprehensive-security-report — consolidated report from the audits above
• database-security — injection, access, encryption, data exposure
• file-handling-business-logic — upload/handling and traversal risks
• initial-security-analysis — first pass attack surface map
• input-validation — validation and sanitization of untrusted input
• logging-monitoring — security logging and leakage
• secrets-management-audit — hardcoded secrets, rotation, key management
• session-cookie-security — session and cookie configuration

Repository layout

code-review-skills/
├── .claude-plugin/
│   ├── plugin.json        # Claude Code plugin manifest
│   └── marketplace.json   # single-plugin marketplace (one-command install)
├── skills/
│   └── <skill-name>/SKILL.md
├── LICENSE
└── README.md

License

CC0-1.0. See LICENSE.