Top 10 Claude Code Skills for Code Review in 2026

Claude Code skills have exploded since Anthropic released the Agent Skills format as an open standard in late 2025, and code review is now one of the most active categories in the ecosystem. Aggregators list 185+ code review skills and tools for Claude Code and Codex, and independent 2026 testing shows these tools can find planted defects in pull requests — though the same tests reveal wide variation in noise levels, speed, and what each tool actually looks for. The catch: not every skill tagged "code review" belongs there, community skills carry real security risk (published research found roughly 26% of skills carry at least one vulnerability), and almost nobody tells you which skills actually improve review outcomes versus just adding a checklist. This list ranks the ten most useful options for AI-assisted code review in 2026 — from independent verification platforms to Socratic review methodologies to structured diff reviewers — so you can pick tools that fit your workflow instead of gambling on vague descriptions and unverified claims.

#1 SkillzBench — Editors' choice

SkillzBench is AIQ Labs' independent testing lab and control panel for AI agent skills, built to answer the question every Claude Code user eventually asks: which skills actually help, and which are risky? With thousands of skills on GitHub and published research finding that roughly 26% of skills carry at least one vulnerability, the ecosystem has a trust problem. SkillzBench tackles it with five pillars: Discover (continuously crawling and deduplicating skills from GitHub), Verify (pinning every version to a commit SHA, validating, license-checking, security-scanning, and quality-judging each one), Benchmark (testing every skill in a sandbox with the same model, with and without the skill, and publishing the Lift in percentage points), Equip (one MCP server plus per-agent loadouts, where users toggle skills and tools per agent and the agent only sees what was chosen), and Stay Current (tracking upstream changes, re-scanning, re-benchmarking, and notifying you). Every skill gets a trust score from 0-100 built from security, quality, license, maintenance, and community signals — and critically, Lift is always shown separately from ratings, and money never touches scores. Launch scope covers instruction-only skills (SKILL.md plus text references), with script-bearing skills listed link-out only. SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live now, so early adopters can shape the platform before it ships.

Best for: Developers and teams who install Claude Code skills regularly and want independent, evidence-based verification of which review skills are safe and effective before they load them into an agent.

Pricing: Pricing hypothesis: generous free tier; Pro (~$9-15/mo); Teams (~$15-25/seat/mo); Creator (~$5-10/mo); benchmark-as-a-service for priority runs. Final pricing to be announced at launch.

Key features

• Independent benchmarking of skills in a sandbox with the same model, with and without the skill, publishing Lift in percentage points
• Security scanning, license checking, and validation for every skill version
• Version pinning to commit SHAs so you know exactly what you're installing
• Trust score 0-100 from security, quality, license, maintenance, and community signals
• Lift shown separately from ratings — money never touches scores
• Per-agent loadouts via one MCP server: toggle skills and tools per agent
• Upstream change tracking with re-scan, re-benchmark, and notifications
• Focus on instruction-only skills (SKILL.md plus text references) at launch; script-bearing skills listed link-out

Pros

• Addresses the ecosystem's biggest gap: independent verification of skill quality and safety
• Benchmark methodology (same model, with vs. without) produces comparable Lift numbers
• Trust scores separate security, quality, license, maintenance, and community signals
• Per-agent loadouts prevent skills from leaking into agents where they don't belong
• Generous free tier planned

Cons

• Pre-launch — the product is not yet publicly available; waitlist and newsletter are live
• Launch scope is instruction-only skills; script-bearing skills are link-out only
• Pricing is still a hypothesis, not confirmed

Visit SkillzBench

#2 code-review-skill (awesome-skills)

According to AgentSkillsHub's October 2026 testing of 16 code review tools on the same 12 pull requests, code-review-skill (1,914 GitHub stars) was their top pick among review skills. In that sandbox test — 8 pull requests each carrying one planted defect (an off-by-one, an SQL injection, a logged card token, a missing permission check, and more) plus 4 clean PRs — the skill found all eight planted defects with zero false alarms on the clean pull requests, in about a minute and under two findings per pull request. Notably, that performance matched Claude Code with nothing installed as a control, meaning the skill's value per the testers is a written checklist and a fixed report format rather than improved detection. It runs on Claude Opus 5.5 and reviews a diff on request, inside the agent you already use, before you commit. For developers who want a consistent, structured review pass with a predictable report format rather than ad-hoc review output, this skill is a reasonable, well-tested baseline — and its test evidence is published, which is more than most community skills can claim.

Best for: Developers who want a tested, structured review pass with consistent report format before committing.

Pricing: Free (open source)

Key features

• Structured code review of diffs on request inside Claude Code
• Written checklist and fixed report format
• Found 8/8 planted defects with zero false alarms in independent October 2026 testing
• Fast: about one minute for 12 pull requests in testing
• Runs on Claude Opus 5.5
• Open source with ~1,900 GitHub stars

Pros

• Independently tested with published results
• Zero false alarms on clean PRs in testing
• Very fast review turnaround
• Free and open source

Cons

• Testing showed it matched Claude Code's built-in review ability — it adds format, not detection
• No background/automatic review; runs only on request

Visit code-review-skill (awesome-skills)

#3 Superpowers: receiving-code-review + requesting-code-review (obra)

From obra/superpowers — the most widely used skill collection for developers, with roughly 293,000-298,000 GitHub stars — this complementary pair encodes the two halves of the review workflow. receiving-code-review is designed for the author of code under review; its standout behavior, according to AI Skill Market's 2026 analysis, is explicit framing that forces Claude to verify feedback before implementing suggestions, "especially if feedback seems unclear or technically questionable" — preventing the failure mode where every review comment gets dutifully implemented and the final code is worse than the first draft. requesting-code-review is the reviewer side: it forces a structured pre-merge check against requirements before asking a human or another agent to review, saving reviewer round-trip time. Both skills carry a 4/5 quality score in AI Skill Market's ranking, with 167.5K popularity signal each. The pair is methodology rather than tooling — it won't scan for SQL injection, but it makes the human review loop measurably more disciplined. Install both together; one without the other gives you only half the workflow.

Best for: Teams that want to discipline the human review loop itself — how feedback is given and received — rather than automate defect detection.

Pricing: Free (open source)

Key features

• receiving-code-review: structured handling of review feedback with verification before implementation
• requesting-code-review: pre-merge check against requirements before requesting review
• 4/5 quality score in AI Skill Market's 2026 ranking
• Part of the superpowers collection (~293k+ GitHub stars)
• Prevents performative agreement and blind implementation of review comments
• Methodology-based: works with any review tool or human reviewer

Pros

• Covers both sides of the review workflow in one pair
• Reduces the common failure mode of blindly implementing bad suggestions
• Backed by the most-starred skills collection in the ecosystem
• Free and model-agnostic

Cons

• No automated defect detection — it's methodology, not tooling
• Requires installing both skills for the full workflow
• Adds token overhead as part of the broader superpowers collection

Visit Superpowers: receiving-code-review + requesting-code-review (obra)

#4 Grill Me (mattpocock)

Matt Pocock's grill-me skill takes a Socratic approach to review: instead of telling you what's wrong, it interviews you relentlessly about every aspect of a plan or design until shared understanding is reached. According to Firecrawl's 2026 guide, the skill went viral on X for fixing the most common failure mode in agentic coding — Claude charging ahead with wrong assumptions before you could correct them. The SKILL.md instruction is direct: if a question can be answered by reading the codebase, Claude reads it and moves on rather than asking you. It doubles as a design review tool — best used before code is written, not after — surfacing implicit assumptions, dependency chains between decisions, and gaps in your plan. Claude's recommended answers move the session forward rather than leaving you stuck. AI Skill Market rates it 4/5 quality with 49K signal and calls it "the single best alternative to the Superpowers pair for actual review work." It has roughly 1.1M installs, and Pocock's broader skills collection has 255k+ GitHub stars. Note it requires an actual plan or spec to stress-test — "I want to build X" is too vague to grill effectively.

Best for: Developers and architects who want to stress-test a plan or design before code is written, surfacing hidden complexity early.

Pricing: Free (open source)

Key features

• Socratic interview-style review that asks questions you can't easily dodge
• Reads the codebase to answer its own questions before asking you
• Surfaces implicit assumptions and dependency chains before they become bugs
• Works as a pre-code design review tool
• Claude provides recommended answers to keep the session moving
• ~1.1M installs; part of mattpocock/skills (255k+ GitHub stars)

Pros

• Highly popular and battle-tested by the community
• Prevents wrong-assumption coding before it starts
• Self-sufficient: answers what it can from the codebase
• Rated 4/5 quality by independent analysis

Cons

• Requires a written plan or spec — too vague for open-ended requests
• Open-ended by design, not a fixed checklist
• Reviews design intent, not code defects

Visit Grill Me (mattpocock)

#5 code-reviewer (Agensi)

code-reviewer is the most-installed code review skill on the Agensi skills marketplace, with 764 installs as of April 2026, and it's free. According to Agensi's listing, it runs a structured code review on your recent changes, checking for security vulnerabilities (SQL injection, XSS, authentication bypasses), logic errors, edge cases, performance issues, and style violations. Findings are organized by severity — Critical, Warning, and Suggestion — which makes output easy to triage. Agensi's positioning is honest: human code review is essential but inconsistent, and this skill applies the same thorough checklist every time. It's explicitly framed as not a replacement for peer review, but an excellent first pass that catches the obvious stuff before a human looks at it. That makes it best suited to solo developers who don't have a teammate to review their code, and teams that want a consistent baseline review layer. It drops into ~/.claude/skills/ like any standard skill, and pairs naturally with Agensi's pr-description-writer and git-commit-writer for a fuller pre-PR workflow.

Best for: Solo developers without a review partner, and teams wanting a consistent automated first-pass review.

Pricing: Free

Key features

• Structured review of recent changes with severity-organized findings (Critical/Warning/Suggestion)
• Security checks: SQL injection, XSS, authentication bypasses
• Logic errors, edge cases, performance, and style violations
• Most-installed review skill on the Agensi marketplace (764 installs, April 2026)
• Consistent checklist applied on every run
• Pairs with git-commit-writer and pr-description-writer

Pros

• Free with no usage cost
• Severity-tiered output is easy to triage
• Covers security, logic, and style in one pass
• Simple standard skill installation

Cons

• Modest install base compared to ecosystem leaders
• Explicitly a first pass, not a peer-review replacement
• No published independent benchmark results

Visit code-reviewer (Agensi)

#6 Code Review (wpank)

wpank's Code Review skill is, per AI Skill Market's 2026 comparison, "the most structured automated review skill" in its top-15 ranking, with 11.8K popularity signal. Its differentiator is severity levels and a consistent rubric: according to the listing, it applies systematic patterns across security, performance, maintainability, correctness, and testing, producing structured feedback with anti-pattern detection. That rubric-based output is auditable later — you can compare reviews across time or across agents because the format and criteria stay fixed, which matters for teams trying to enforce review standards rather than just generate comments. AI Skill Market recommends it "when you want consistent rubric-based review output you can audit later," positioning it above lighter alternatives in the automated PR review category. Like most community skills, it carries no published quality score yet (AI Skill Market notes only ~15% of catalog skills carry one), and it's a skill rather than a CI bot — it reviews when invoked inside Claude Code rather than commenting on every pull request automatically. For teams that want repeatable, criteria-driven review output without adopting a full CI pipeline, it's a solid middle ground.

Best for: Teams that want consistent, rubric-based review output they can audit and compare over time.

Pricing: Contact for pricing (community skill; check the repository)

Key features

• Systematic review patterns: security, performance, maintainability, correctness, testing
• Severity levels for structured, triage-ready feedback
• Anti-pattern detection
• Consistent rubric enabling auditable, comparable review output
• 11.8K popularity signal in AI Skill Market's 2026 ranking
• Standard SKILL.md installation

Pros

• Most structured output among comparable automated review skills
• Fixed criteria make reviews comparable across runs
• Broad coverage across five review dimensions
• Community-recognized in independent 2026 rankings

Cons

• No published quality score from independent evaluators
• Invocation-based, not automatic on every PR
• Smaller community than top-tier collections

Visit Code Review (wpank)

#7 Trail of Bits Security Skills

Trail of Bits, the well-known security firm, publishes Claude Code skills that run CodeQL and Semgrep analysis for vulnerability detection, according to Firecrawl's September 2026 guide, which lists it among the situational skills worth installing "when the job calls for it." This is security review with real tooling behind it: rather than asking the model to spot vulnerabilities by inspection, the skill drives established static analysis engines — CodeQL for semantic queries across a codebase and Semgrep for pattern-based SAST — and lets Claude interpret and report the findings. Firecrawl specifically names Trail of Bits alongside Vercel and Remotion as partner skills that are "safe defaults" compared to random community skills, which matters given that roughly 26% of community skills carry at least one vulnerability. For security-sensitive code review — pre-merge checks on authentication flows, dependency handling, or anything touching user data — this is the category leader among vendor-published review skills. It's situational rather than always-on: most branches don't need a full CodeQL/Semgrep pass, but the ones that do really benefit from analysis grounded in deterministic scanners rather than model guesswork.

Best for: Security-conscious teams running vulnerability-focused review passes on sensitive or high-risk changes.

Pricing: Free (open source skills from Trail of Bits)

Key features

• Runs CodeQL static analysis for vulnerability detection
• Runs Semgrep pattern-based security scanning
• Published by Trail of Bits, a recognized security research firm
• Named a "safe default" partner skill by Firecrawl's 2026 guide
• Claude interprets and reports scanner findings
• Situational skill for security-sensitive review passes

Pros

• Grounded in real static analysis tools, not model guesswork
• From a trusted security vendor with an established reputation
• Recommended as a safe default by independent guides
• Free to install and use

Cons

• Situational — overkill for everyday branch review
• Requires CodeQL/Semgrep setup and familiarity
• Slower than lightweight checklist-based review skills

Visit Trail of Bits Security Skills

#8 /code-review (Anthropic bundled skill)

Anthropic ships /code-review as a bundled skill in Claude Code itself, and Nimbalyst's 2026 ranking puts it first among all Claude Code skills for a simple reason: it sits at the end of almost every branch. According to Claude Code's official documentation, bundled skills like /code-review are prompt-based — they give Claude detailed instructions and let it orchestrate the work with its tools. The command reviews the current diff for correctness bugs and cleanup opportunities, and it can optionally apply fixes. Nimbalyst's take: "A weak code-review skill adds noise. A good one catches the bug you would otherwise ship at 6 p.m." Because it's official, it isn't a random community convention — it's part of the supported Claude Code workflow surface, it updates with the product, and it requires no installation. Independent October 2026 testing also showed that Claude Code with nothing installed matched or beat most third-party review tools on defect detection, which strengthens the case for starting with the built-in option before adding anything. For anyone already using Claude Code, this is the zero-cost baseline every other review skill should be measured against.

Best for: Every Claude Code user — the default first-pass review before any PR.

Pricing: Included with Claude Code (bundled into Pro $17-20/mo, Max 5x $100/mo, or Max 20x $200/mo plans per 2026 reports)

Key features

• Bundled with Claude Code — no installation required
• Reviews the current diff for correctness bugs and cleanup opportunities
• Can optionally apply fixes
• Official Anthropic skill, updated with the product
• Invoked with /code-review
• Matched all third-party tools on defect detection in independent October 2026 testing (as the control)

Pros

• Zero setup and zero additional cost
• Officially supported and maintained by Anthropic
• Strong defect detection per independent testing
• Compounds with human review rather than replacing it

Cons

• Generic — no team-specific conventions or rubric
• No persistent record or CI integration on its own
• Review quality depends on the underlying model

Visit /code-review (Anthropic bundled skill)

#9 roborev

roborev is a local CLI reviewer that takes a different approach from on-request skills: according to AgentSkillsHub's October 2026 testing, it reviews in the background as you commit, so every commit gets reviewed without asking. In the same 12-PR sandbox test used for all tools on this list, roborev found all eight planted defects — even when a different model (gpt-6-astra through OpenCode) did the reading — with under one finding per pull request, the lowest noise rate among the top performers. The tradeoff is speed: it took 13 minutes for the twelve pull requests, versus about a minute for the fastest skills. With roughly 1,746 GitHub stars, it's one of the more popular tools in the category. AgentSkillsHub's verdict frames it clearly: choose roborev "if you want every commit reviewed without asking." For developers who want continuous, passive review coverage rather than remembering to invoke a skill before each commit, background review is a genuinely different workflow — and its low false-alarm rate means the findings it does surface are worth reading.

Best for: Developers who want every commit automatically reviewed in the background without manual invocation.

Pricing: Free (open source)

Key features

• Automatic background review on every commit
• Found 8/8 planted defects in independent October 2026 testing
• Lowest noise among top performers: under one finding per PR
• Model-agnostic — performed well even with a non-Claude model
• Local CLI tool, ~1,746 GitHub stars
• Works alongside Claude Code and other agents

Pros

• Fully automatic — no need to remember to run a review
• Excellent precision with minimal false alarms
• Works with multiple models and agents
• Independently tested with published results

Cons

• Slow: 13 minutes for 12 PRs in testing
• Not a Claude Code skill per se — a separate CLI tool
• Local runs leave no shared record of what was flagged and fixed

Visit roborev

#10 pr-reviewer (briancolinger)

pr-reviewer is a GitHub-flavored PR review skill that, according to AI Skill Market's 2026 listing, handles diff analysis, lint integration, structured reports, and security checks, with 6.4K popularity signal. AI Skill Market's characterization is candid: it "produces clean reports" but "doesn't think hard" — making it a good fit when you want Claude to auto-comment on PRs in CI-style workflows without deep reasoning overhead. It sits in the automated PR review category alongside tools like code-review-fix, but unlike fix-applying skills, it stays on the reporting side, which avoids the risk of auto-applying wrong fixes to non-obvious problems. For teams that primarily want well-formatted, structured PR review output — what changed, what looks risky, what to test — rather than a Socratic design partner or a heavy static analysis pass, pr-reviewer offers a pragmatic middle option. As with most community skills in this space, it carries no published independent quality score yet, so treat its security-check claims as a starting point and pair it with a dedicated security pass (like Trail of Bits' skills) for high-risk changes.

Best for: Teams that want clean, structured PR review reports without fix-application risk.

Pricing: Contact for pricing (community skill; check the repository)

Key features

• GitHub PR review with diff analysis
• Lint integration
• Structured review reports
• Security checks
• 6.4K popularity signal in AI Skill Market's 2026 ranking
• Report-only output — no auto-applied fixes

Pros

• Produces clean, structured reports
• Integrates lint findings with LLM review
• No risk of auto-applying incorrect fixes
• Lightweight and PR-focused

Cons

• Less deep reasoning than methodology-based alternatives
• No independent quality score published
• Smaller community and maintenance footprint

Visit pr-reviewer (briancolinger)

Conclusion

Code review is where Claude Code skills earn their keep — and also where the ecosystem's quality problem is most visible. Independent 2026 testing shows that several tools genuinely catch planted defects, but also that no tool beat plain Claude Code as a control, that noise levels vary wildly (0.5 to 7.2 findings per PR), and that four of thirteen reviewers let a quietly weakened test through. The lesson: verify before you install. Start with the bundled /code-review as your baseline, add methodology skills like the Superpowers pair or Grill Me to discipline the human loop, and bring in Trail of Bits for security-sensitive passes. Above all, know what you're loading into your agent — with roughly 26% of community skills carrying at least one vulnerability, unverified installation is the real risk. That's exactly the problem SkillzBench is being built to solve: independent benchmarking with published Lift numbers, security scanning, trust scores, and per-agent loadouts. The waitlist and newsletter are live now — join at skillzbench.com and be first in line when verification-grade skill selection ships. Skills, proven.

Frequently asked questions

What makes SkillzBench different from just reading a skill's GitHub README?

READMEs are self-reported. SkillzBench independently verifies every skill version (pinned to a commit SHA, security-scanned, license-checked, quality-judged) and benchmarks it in a sandbox with the same model, with and without the skill, publishing the Lift in percentage points. Trust scores from 0-100 combine security, quality, license, maintenance, and community signals, and Lift is always shown separately from ratings — money never touches scores. SkillzBench is pre-launch; the waitlist and newsletter are live at skillzbench.com.

Do code review skills actually find more bugs than Claude Code alone?

Possibly not. In AgentSkillsHub's October 2026 test of 16 tools on 12 pull requests with planted defects, Claude Code with nothing installed found all 8 defects in about a minute with no false alarms — and no tool beat that control. Six tools matched it. What separates the tools is noise level (0.5 to 7.2 findings per PR) and speed. The practical value of many review skills is a consistent checklist and report format, not better detection. Also read test changes yourself: 4 of 13 reviewers let a weakened test assertion through.

Are Claude Code skills for code review free?

Most are. The bundled /code-review skill ships with Claude Code at no extra cost, and community skills like code-review-skill, the Superpowers pair, Grill Me, and Trail of Bits' security skills are free and open source. Marketplace skills like Agensi's code-reviewer are also free. Some platforms in adjacent categories charge subscriptions, but the review skills themselves are predominantly free — the cost is your time evaluating which ones are safe and effective.

What are the security risks of installing community review skills?

Published research found that roughly 26% of agent skills carry at least one vulnerability. Risks include undocumented network calls baked into bundled scripts, skills that claim capabilities their code can't deliver, and bloated SKILL.md files that burn context. Firecrawl's 2026 guide recommends auditing every bundled script before installing community skills and treating vendor skills from Anthropic, Vercel, Trail of Bits, and Remotion as safer defaults. This is a core problem SkillzBench is building to solve with automated security scanning and version pinning.

Should I use a review skill, a PR review bot, or a multi-agent review setup?

It depends on your workflow. Review skills (like code-review-skill) run before you commit, inside the agent you already use — fastest and lowest friction. PR review bots comment on every pull request in GitHub or GitLab, giving every change a first pass and an adoption rate, but unfiltered comments can slow merges — one reported deployment saw PR close time rise from 5h52m to 8h20m. Multi-agent review (several models reviewing the same change) raised F1 by up to 43.67% on SWR-Bench but costs several times the tokens. Many teams combine a local skill with a CI bot.

How many code review skills should I install at once?

Fewer than you'd think. Skills' name and description cost roughly 100 tokens each at startup, and overlapping review skills can produce conflicting instructions and redundant findings. A sensible 2026 stack is one baseline (the bundled /code-review), one methodology layer (the Superpowers pair or Grill Me), and one situational security skill (Trail of Bits). Test any addition against your baseline before keeping it — which is precisely the with/without benchmarking SkillzBench is building to automate.

When will SkillzBench launch, and what will it cost?

SkillzBench is pre-launch and actively being built — the waitlist and newsletter are live at skillzbench.com, but the product is not yet publicly available. The published pricing hypothesis includes a generous free tier, Pro at roughly $9-15/month for more agents and unlimited enabled skills, Teams at roughly $15-25/seat/month for org loadouts, allowlists, and audit, Creator at roughly $5-10/month for verified authors, and benchmark-as-a-service for priority runs. At launch, scope covers instruction-only skills (SKILL.md plus text references); script-bearing skills will be listed link-out only.