Manual code review is a bottleneck. Senior engineers spend hours per week reading diffs, leaving comments, and catching the same categories of bugs. Agent skills can handle the repeatable parts — scanning for vulnerabilities, flagging risky patterns, generating missing tests — so human reviewers focus on architecture and design decisions.

This guide walks through the skills that automate different pieces of the code review workflow, how to install them, and how to combine them into a review pipeline that runs before you ever open a PR.

The Review Stack

A full automated review touches four areas:

  1. Code quality — bugs, readability, performance issues
  2. Security — OWASP patterns, exposed secrets, injection vectors
  3. Dependencies — CVEs, deprecated packages, license conflicts
  4. Test coverage — untested paths, missing edge cases

No single skill covers all four. The practical approach is to install one skill per area and run them together. Here are the ones that work.

Code Reviewer: Structured Feedback on Diffs

The Code Reviewer skill reads a diff or file and returns structured feedback with severity ratings. It checks for bugs, security issues, performance problems, and readability — not just style nits.

Compatible with: Claude Code, Codex, Cursor, Windsurf Category: Engineering Install:

gh skill install wshobson/agents/code-reviewer

Once installed, point it at a file or a set of changes:

Review the changes in src/api/handler.ts. Focus on error handling and edge cases.

The skill returns findings grouped by severity (critical, warning, suggestion) with specific line references and proposed rewrites. This replaces the first pass a human reviewer would do — catching null checks, missing error boundaries, and logic that silently swallows failures.

When to use it: Before opening a PR. Run it on your own changes to catch issues before anyone else sees them.

PR Summarizer: Readable Descriptions from Diffs

The PR Summarizer skill generates human-readable pull request descriptions from raw diffs. It explains what changed, why it matters, and flags sections reviewers should look at closely.

Compatible with: Claude Code, Codex, Cursor, Windsurf Category: Engineering Install:

gh skill install wshobson/agents/pr-summarizer

Usage is straightforward:

Summarize the current branch changes as a PR description.

The output includes a change summary, a list of files modified with context, and a section highlighting breaking changes or migrations. This saves the five minutes you spend writing a PR description and produces a more thorough one than most developers write by hand.

When to use it: Right before opening a PR. Pipe the output directly into your PR description.

Security Auditor: OWASP Scanning

The Security Auditor skill scans codebases for common vulnerabilities: exposed secrets, SQL injection, XSS, insecure dependencies, and OWASP Top 10 patterns. It returns a prioritized finding report with fix recommendations.

Compatible with: Claude Code, Codex, Cursor Category: Security Install:

gh skill install wshobson/agents/security-auditor

Run it against a directory or specific files:

Scan src/ for security vulnerabilities. Focus on API endpoints and database queries.

The skill checks for hardcoded credentials, unparameterized queries, missing input validation, and insecure HTTP configurations. Each finding includes a severity level and a suggested fix.

When to use it: Before any PR that touches authentication, API endpoints, database queries, or user input handling. Also useful as a periodic full-codebase scan.

Dependency Auditor: CVEs and License Checks

The Dependency Auditor skill audits your dependency tree for known CVEs, deprecated packages, license conflicts, and version drift. It works with npm, pip, and cargo.

Compatible with: Claude Code, Codex, Cursor Category: Security Install:

gh skill install alirezarezvani/claude-skills/dependency-auditor

Point it at your project root:

Audit the dependencies in this project. Flag any known CVEs or deprecated packages.

The output ranks findings by severity and suggests specific version bumps or replacement packages. This catches the class of issues that npm audit flags but with more context about what each vulnerability actually means for your application.

When to use it: After adding new dependencies, during periodic maintenance, or before releases.

Test Generator: Filling Coverage Gaps

The Test Generator skill generates unit, integration, and edge-case tests from existing code. It reads function signatures, understands side effects, and produces tests that cover the paths most likely to break.

Compatible with: Claude Code, Codex, Cursor, Windsurf Category: Engineering Install:

gh skill install sickn33/antigravity-awesome-skills/test-generator

Give it a file or function to cover:

Generate tests for src/services/billing.ts. Include edge cases for zero amounts and expired subscriptions.

The skill produces tests using your project’s existing test framework (Jest, pytest, or whatever it detects in your config). It includes happy paths, error conditions, and boundary cases.

When to use it: After writing new code, or when you inherit a codebase with thin coverage and need to add tests before refactoring.

Combining Skills into a Review Pipeline

These skills work best when combined. A practical pre-PR workflow:

  1. Test Generator — generate tests for new code, run them, fix failures
  2. Security Auditor — scan changed files for vulnerabilities
  3. Dependency Auditor — check if new packages introduce CVEs
  4. Code Reviewer — review the full diff for bugs and readability
  5. PR Summarizer — generate the PR description

In Claude Code, you can run this as a single prompt:

Run the code reviewer on the files changed in this branch. Then run the security
auditor on src/. Then summarize the changes as a PR description.

The agent executes each skill sequentially and returns a combined report. Some developers set this up as a pre-commit hook or a CI step that runs before review assignment.

What Skills Do Not Replace

Automated review handles pattern matching well: known vulnerability signatures, missing null checks, untested code paths. It does not handle:

  • Architectural fitness — whether this change belongs in this module
  • Product alignment — whether the feature does what the spec intended
  • Performance at scale — whether this query will hold up under production load
  • Team conventions — project-specific patterns that are not codified anywhere

Skills reduce the volume of mechanical review work. The senior engineer still needs to look at the PR. They just spend less time on the parts a machine can handle.

FAQ

Q: Do these skills work with GitHub Actions or CI/CD pipelines? A: Not directly. Skills run inside your agent environment (Claude Code, Cursor, etc.), not as standalone CLI tools. Some teams trigger a Claude Code session from CI to run review skills, but that requires API access and a runner with the agent installed.

Q: Can I customize what the Code Reviewer checks for? A: Yes. You can add project-specific instructions in your CLAUDE.md or prompt. For example: “When reviewing, flag any direct database queries outside the repository layer” or “Ignore style issues, focus on correctness.” The skill follows your instructions alongside its built-in checks.

Q: How do these compare to tools like SonarQube or ESLint? A: Linters and static analysis tools check for known patterns with fixed rules. Agent skills understand context — they can reason about whether a null check is actually needed given the call site, or whether a SQL query is safe given the ORM in use. Use both: linters for fast, deterministic checks; skills for the reasoning-heavy review work.