Top 7 Free Claude Skills for Code Review in 2026

Code review is the highest-leverage activity in software engineering — and in 2026, AI coding agents do more of it than ever. Claude Skills (SKILL.md instruction packages introduced by Anthropic in October 2025 and released as an open standard that December) let you install a reusable review playbook into Claude Code, Codex, Cursor, Gemini CLI and other agents, so every diff gets checked against the same checklist instead of whatever happens to be in context that day. But the ecosystem has exploded faster than anyone can vet it: thousands of community skills are floating around GitHub, and published research suggests roughly 26% of agent skills carry at least one vulnerability. That means the real question in 2026 isn't just 'which code review skill should I install?' — it's 'which one can I trust?' This list covers seven free options that genuinely improve code review, from structured multi-agent reviewers to security-grade audits. We've also included SkillzBench, a free directory and MCP connector that helps you discover, verify and benchmark agent skills before you install them, because choosing the right skill safely is now half the battle. All seven picks are free to use; you typically pay only for your underlying model usage.

#1 SkillzBench — Editors' choice

SkillzBench (skillzbench.com) is AIQ Labs' free, independent directory of AI agent skills plus a free MCP tool that connects any agent to the skills you choose — and it earns the top spot here because it solves the problem every other entry on this list creates: how do you know a code review skill is safe, current, and actually good before you wire it into your workflow? Agent skills are everywhere, but nobody can tell which ones help and which are risky; published research found that ~26% of skills carry at least one vulnerability. SkillzBench is being built around five pillars: Discover (continuously crawling and deduplicating skills from GitHub), Verify (pinning every version to a commit SHA, validating, license-checking, security-scanning and quality-judging), Benchmark (testing every skill in a sandbox with the same model, with and without the skill, and publishing the Lift in percentage points), Equip (one free MCP server plus per-agent loadouts, where you toggle skills and tools per agent and the agent only sees what you chose), and Stay Current (tracking upstream changes, re-scanning, re-benchmarking and notifying you). Every skill gets a 0–100 trust score built from security, quality, license, maintenance and community signals — and Lift is always shown separately from ratings, with money never touching scores. Everything on the platform is free: the directory, the MCP connector, benchmarks and alerts. Revenue comes from advertising around blog articles, never from charging users, and ad money never influences scores or listings. SkillzBench is currently pre-launch — the waitlist and newsletter are live — so it's one to watch closely if you're installing code review skills in 2026.

Best for: Developers, agent builders and teams who want to install code review skills safely — discovering, verifying and benchmarking skills before they touch their agents

Pricing: Free (all features; ad-supported)

Key features

• Free, independent directory of AI agent skills (SKILL.md packages) continuously crawled and deduplicated from GitHub
• Security scanning, license checks, validation and quality judging for every skill
• Every skill version pinned to a commit SHA for reproducible installs
• Sandbox benchmarking with the same model, with and without the skill, publishing Lift in percentage points
• 0–100 trust score from security, quality, license, maintenance and community signals
• Free MCP server plus per-agent loadouts — the agent only sees the skills and tools you toggle on
• Upstream change tracking with re-scans, re-benchmarks and notifications
• Everything free; ad-supported blog revenue never influences scores or listings

Pros

• Addresses the ~26% vulnerability rate in community skills with security scans and SHA-pinned versions
• Lift benchmarking shows whether a skill actually improves performance, not just whether it exists
• Free MCP connector works across agents with per-agent loadouts
• Independent: money never touches scores or rankings
• Everything free — directory, MCP, benchmarks and alerts

Cons

• Pre-launch: the product is not yet public; waitlist and newsletter are live
• Benchmark results and skill counts are still being built out, not yet published at scale

Visit SkillzBench

#2 The /code-review Skill by Matt Pocock

Matt Pocock's code-review skill (mattpocock/skills) is one of the most-discussed review skills of 2026, and its design is genuinely thoughtful. According to its documentation, it reviews the diff between HEAD and a fixed point you name (a commit, branch, tag, main, or HEAD~5) along two independent axes: Standards, asking whether the code follows how your repo writes code, and Spec, asking whether the code does what the originating issue or spec asked for. Each axis runs in its own sub-agent so neither sees the other's reasoning, and the skill deliberately never merges the two into a single verdict — a change can pass one axis and fail the other, which prevents a passing axis from hiding a failing one. The Standards axis reads whatever your repo documents (CODING_STANDARDS.md, CONTRIBUTING.md and the like) and falls back on a built-in baseline of twelve code smells from Fowler's Refactoring. Every finding must carry a citation — a standards rule, a named smell plus its hunk, or a spec line — which makes findings checkable rather than vague. Installation is a one-liner via npx, and the skill is free. Be aware of documented caveats: it collides with Claude Code's own built-in /code-review command, it has a known open bug where sub-agents can re-invoke the skill and fan out (one report reached more than 50 agents), and the maintainers recommend running it from a fresh session rather than the one that wrote the code.

Best for: Engineers who want reviews checked against their repo's own documented standards and the originating spec, not generic lint-style feedback

Pricing: Free (you pay only for Claude usage)

Key features

• Reviews a diff against a fixed point you supply (commit, branch, tag, main, HEAD~5)
• Two independent sub-agent axes: Standards (repo conventions) and Spec (issue/spec compliance)
• Standards axis reads repo docs like CODING_STANDARDS.md and CONTRIBUTING.md
• Built-in smell baseline of twelve code smells from Fowler's Refactoring
• Every finding requires a citation (standards rule, smell plus hunk, or spec line)
• Validates the ref resolves and the diff is non-empty before spawning sub-agents
• Free install via npx skills add mattpocock/skills --skill=code-review

Pros

• Standards and Spec are evaluated independently, avoiding blended verdicts that hide failures
• Cited findings make every review comment checkable
• Repo documentation always overrides the built-in baseline
• Fails fast on mistyped refs or empty diffs

Cons

• Name collision with Claude Code's built-in /code-review is a documented, unresolved problem
• Known open bug where sub-agents re-invoke the skill and spawn runaway agent counts
• Does not re-verify each claim against files, so findings can cite wrong locations

Visit The /code-review Skill by Matt Pocock

#3 Code Reviewer (Agensi)

The code-reviewer skill on the Agensi marketplace is described as one of the most-used skills in its catalog, with 764 installs reported as of its 2026 listing, and it's free. According to Agensi's documentation, it runs a structured review that checks for security vulnerabilities (SQL injection, XSS, authentication bypasses, insecure data handling), logic errors, edge cases, performance issues, and style violations, with findings organized by severity: Critical, Warning, and Suggestion. What sets it apart, per Agensi, is its systematic approach — it follows a defined checklist rather than free-form analysis, which means it catches the same categories of issues every time, a meaningful contrast to asking Claude to 'review my changes' without a skill, where review depth varies with how you phrase the request. It's also cross-agent: Agensi lists it as working with Claude Code, OpenClaw, Codex CLI, and Cursor. Agensi positions it well for solo developers who lack a second reviewer and for teams that want a consistent baseline before human review. The honest limitation is that it's a generalist: it won't know your repo's specific conventions the way a project-local skill or a standards-driven reviewer does, and like any first-pass reviewer it complements rather than replaces human review. Access is through an MCP-connected agent per Agensi's setup guidance.

Best for: Solo developers without a human second reviewer, and teams wanting a consistent, security-aware first pass on every diff

Pricing: Free

Key features

• Structured review checking security vulnerabilities, logic errors, edge cases, performance and style
• Findings grouped by severity: Critical, Warning, Suggestion
• Defined checklist approach for consistent results across runs
• Security focus: SQL injection, XSS, authentication bypasses, insecure data handling
• Works with Claude Code, OpenClaw, Codex CLI, and Cursor
• Free to use through a connected agent

Pros

• Consistent checklist-driven review every time
• Strong security coverage per Agensi's documentation
• Cross-agent compatibility (Claude Code, OpenClaw, Codex CLI, Cursor)
• Free with no setup cost

Cons

• Generic — doesn't encode your repo's specific conventions or standards
• Requires an MCP-connected agent setup per Agensi's guidance
• First-pass only; not a replacement for peer review

Visit Code Reviewer (Agensi)

#4 Trail of Bits Security Skills

Trail of Bits is one of the most respected offensive security firms in the world, and its security skills package bring that posture to every pull request. According to AI Skill Market's 2026 roundup, trail-of-bits-security-skills catches injection, deserialization, secret leaks, and supply chain risks, and is billed as 'the closest free thing to a real security audit on every PR.' Firecrawl's 2026 guide to Claude Code skills similarly lists Trail of Bits Security as a top pick, noting that it runs CodeQL and Semgrep analysis for vulnerability detection and includes differential review and supply-chain audits. This matters for code review specifically because generic reviewers tend to be weakest on security: in one 2026 sandbox test of 13 review tools, a reviewer focused on design decay passed a logged card token at 100/100, and four of 13 reviewers let through a pull request that quietly weakened a test's assertion. A security-grade skill is the counterweight to that gap. The skills come from a vendor Firecrawl explicitly names as a safe default source alongside Anthropic's own repository, which is a meaningful trust signal in an ecosystem where ~26% of community skills carry at least one vulnerability. It's free to install; you pay only for underlying model usage. The trade-off is focus — this is a security specialist, not a full general-purpose reviewer, so most teams should pair it with a broader review skill rather than relying on it alone.

Best for: Teams that want security-grade review on every PR, especially for code handling authentication, payments, or sensitive data

Pricing: Free (you pay only for Claude usage)

Key features

• Security-grade review catching injection, deserialization, secret leaks, and supply chain risks
• Runs CodeQL and Semgrep static analysis for vulnerability detection (per Firecrawl's 2026 guide)
• Differential review and supply-chain audit capabilities
• From a top offensive security firm — listed as a trusted default source
• Pre-merge security review use case
• Free to install

Pros

• Security expertise from a top-tier offensive security firm
• Covers risks generic reviewers miss: injection, secret leaks, supply chain
• From a vendor widely cited as a safe, trusted skill source
• Free

Cons

• Security-focused, not a full general-purpose code reviewer
• Best paired with a broader review skill rather than used alone
• Static analysis tooling (CodeQL/Semgrep) may add setup overhead for some repos

Visit Trail of Bits Security Skills

#5 code-review by Sentry

Sentry's code-review skill packages how one of the industry's most engineering-focused companies approaches review internally, and it earned one of the top evaluation scores in Tessl's February 2026 assessment of agent skills for AI code review. According to Tessl's registry evaluation, it scored 86% overall, with an Implementation Score of 88% (structure, clarity, actionability) and an Activation Score of 82% (how well the skill is described and discoverable) — the highest activation score among the reviewer-category skills Tessl evaluated, which means it triggers reliably when a review task appears rather than sitting unused. Tessl categorizes it among 'The Reviewers': skills that generate review content — comments, risk notes, and suggested diffs — as opposed to workflow orchestrators or integration plumbing. That makes it a workhorse: install it, and your agent produces structured review feedback based on how Sentry's engineers think about code quality rather than generic surface-level comments like 'looks good, consider adding comments.' Installation is a single command via the Tessl package manager (tessl i github:getsentry/skills --skill code-review), which also gives you version pinning to specific releases and a manifest tracking all skills in your project — a meaningful safety improvement over manually copying files from GitHub. It's free. The main consideration is that it reflects Sentry's conventions, so teams with very different standards may want to supplement it with repo-specific guidance in CLAUDE.md.

Best for: Engineering teams that want a battle-tested, reliably-triggering reviewer skill with independently evaluated quality

Pricing: Free (you pay only for Claude usage)

Key features

• Encodes Sentry's internal engineering review approach
• Tessl Review Score: 86%, Implementation Score: 88%, Activation Score: 82%
• Generates review comments, risk notes, and suggested diffs
• High discoverability/activation — triggers reliably on review tasks
• Installable via Tessl package manager with version pinning
• Free

Pros

• Independently evaluated with strong scores across implementation and activation
• Backed by Sentry's real internal review practices
• High activation score means it triggers when needed
• Tessl install gives version pinning and project manifests

Cons

• Reflects Sentry's conventions, which may not match your team's standards
• Validation score (12/16) suggests some metadata gaps per Tessl's checks
• Requires the Tessl CLI for the documented install path

Visit code-review by Sentry

#6 evidence-code-review (akkie76/code-review-skills)

This evidence-based code review skill adapts ideas from a published code review textbook for AI coding agents, targeting both Codex and Claude Code, and it stands out for how seriously it takes verifiability. According to its GitHub documentation (listed on SkillsLLM with 83 stars, added September 2026), it establishes the requested scope and repository-specific rules, traces changed behavior through affected code paths — not just changed lines — and checks correctness, interfaces, design, security, reliability, tests, and documentation according to risk. Its output convention is what makes it distinctive: actionable comments start with an action level (MUST for demonstrated issues that must be resolved before merge, SHOULD for concrete risks, BETTER for optional alternatives with specific benefits, NITS for minor non-blocking corrections) plus a viewpoint such as Functionality, Test, Simplicity, or Document, followed by location, evidence, when it occurs, impact, and a proportionate suggested direction. That structure forces the agent to demonstrate problems with evidence rather than assert them, which addresses the most common complaint about AI reviews — vague, unactionable comments. The project is MIT-licensed, explicitly states that review decisions remain model- and context-dependent, and recommends pinning an install to a release tag for a known version. It also reviews code without modifying files unless you separately ask. SkillsLLM's automated security scan (September 2026) reported a pass with no issues, including prompt-injection heuristics — though as with any third-party skill, that's an automated check, not a certification.

Best for: Developers who want disciplined, evidence-backed review comments with clear merge-blocking severity levels

Pricing: Free (open source, MIT license)

Key features

• Evidence-based review tracing changed behavior through affected code paths, not just changed lines
• MUST/SHOULD/BETTER/NITS action levels with viewpoints (Functionality, Test, Simplicity, Document)
• Checks correctness, interfaces, design, security, reliability, tests, and documentation by risk
• Reviews code without modifying files unless separately requested
• Works with both Codex and Claude Code
• MIT licensed, v1.0.0 with stable documented output format
• Passed SkillsLLM's automated security scan (September 2026)

Pros

• Evidence-first format makes findings verifiable rather than assertive
• Clear action levels separate merge blockers from nice-to-haves
• Traces behavior through code paths, catching cross-file breakage
• Open source, MIT licensed, with release-tag installs

Cons

• Smaller community (83 GitHub stars) than higher-profile alternatives
• Project-specific context (AGENTS.md/CLAUDE.md) needed for best accuracy
• Documentation explicitly notes findings are model- and context-dependent

Visit evidence-code-review (akkie76/code-review-skills)

#7 Claude Code Built-in /code-review

Don't overlook the skill you already have. Claude Code ships its own built-in /code-review as part of the official workflow surface, and multiple 2026 evaluations suggest it's more capable than its 'default' status implies. In an October 2026 sandbox test of 16 code review tools and skills by Agent Skills Hub, Claude Code with nothing installed served as the control — and it found all 8 planted defects (an off-by-one, an SQL injection, a card token in logs, a missing permission check, a retry that never ends, a swallowed error, an inverted condition, and a weakened test) in about a minute with zero false alarms on clean pull requests. Six dedicated tools matched that result and none beat it, leading the testers to conclude that what separates tools is noise and speed, not raw detection. Nimbalyst's 2026 ranking places the built-in /code-review first overall, noting it 'reviews the current diff for correctness bugs and cleanup opportunities' and can optionally apply fixes, sitting 'at the end of almost every branch.' The honest downsides: Agensi and others note that without a skill's structure, review depth varies with how you phrase the request and what's in context, and the same model that wrote the code reviews it — reviewers recommend asking a second model for important changes, and running review from a fresh session to avoid confirmation bias. For quick, zero-setup review passes, though, it remains the highest-value free option in 2026.

Best for: Anyone who wants solid code review with zero setup — quick pre-PR passes on any branch

Pricing: Free (included with Claude Code; you pay for Claude usage)

Key features

• Ships built into Claude Code — zero installation required
• Reviews the current diff for correctness bugs and cleanup opportunities
• Can optionally apply fixes to issues it finds
• Found all 8 planted defects with zero false alarms in an October 2026 sandbox test
• Triggered by natural language or the /code-review command
• Ranked the #1 skill overall in Nimbalyst's 2026 ranking

Pros

• No install, no configuration, no skill-collisions to manage
• Matched or beat every dedicated tool in the 2026 sandbox defect test
• Optionally applies fixes, not just reports them
• Officially maintained as part of Claude Code

Cons

• Review depth varies with phrasing and context — less consistent than structured skills
• Same session and same model that wrote the code does the reviewing (confirmation-bias risk)
• Doesn't know your repo's documented standards the way a tuned skill does

Visit Claude Code Built-in /code-review

Conclusion

In 2026, AI code review is table stakes — the question is which skill you can trust to do the first pass. The built-in /code-review in Claude Code is a surprisingly strong zero-setup default, while structured skills like Matt Pocock's /code-review, Sentry's code-review, and the evidence-based reviewer from akkie76 add the consistency and citation discipline that raw prompting lacks, and Trail of Bits brings security-grade coverage to every PR. But every one of these is a third-party instruction package running inside your agent, and with research showing roughly 26% of community skills carrying at least one vulnerability, how you choose matters as much as what you choose. That's where SkillzBench comes in: its free directory, security scans, SHA-pinned versions, sandbox Lift benchmarks, and free MCP connector are being built to let you discover, verify, and benchmark code review skills before they ever touch your agent — with trust scores that money can't influence. The product is pre-launch, so join the waitlist and newsletter at skillzbench.com today, and be first in line when verified, benchmarked code review skills go live. Skills, proven.

Frequently asked questions

Are these Claude code review skills really free?

Yes. Every option on this list is free to install and use — the skills themselves carry no charge, and Trail of Bits, Sentry, Matt Pocock's, and akkie76's skills are open source. The only cost is your underlying Claude usage (API tokens or subscription), since the skill runs on whatever model powers your agent. SkillzBench is also entirely free — the directory, MCP connector, benchmarks, and alerts are funded by advertising around its blog articles, and ad money never influences scores or listings.

Do code review skills replace human reviewers?

No — and none of the sources behind this list claim they do. The consensus in 2026 is that these skills do the first pass: they catch the obvious defects, apply the same checklist every run, and free human reviewers to focus on architecture and judgment. Think of them as a consistent, tireless junior reviewer whose work still needs a senior sign-off. The evidence-based reviewer from akkie76 even encodes this in its output format, distinguishing MUST-fix merge blockers from BETTER optional suggestions.

Why is SkillzBench ranked #1 when it's a directory, not a review skill?

Because in 2026 the biggest risk in code review skills isn't picking a mediocre one — it's installing a risky one. Published research found that ~26% of agent skills carry at least one vulnerability, and most developers install community skills with no verification at all. SkillzBench addresses that directly: it security-scans and license-checks every skill, pins versions to commit SHAs, benchmarks each skill in a sandbox with and without the skill to publish a Lift score, and assigns a 0–100 trust score from security, quality, license, maintenance, and community signals. It's the layer that makes every other pick on this list safer to adopt. Note that SkillzBench is pre-launch — the waitlist and newsletter are live, and the product itself is still being built.

What's the difference between Claude Code's built-in /code-review and Matt Pocock's code-review skill?

They do different jobs, which is why the name collision is a documented pain point. The built-in /code-review hunts bugs in the diff — correctness issues like null paths, races, and off-by-one errors — and can optionally apply fixes. Matt Pocock's skill checks two other axes: Standards (does the code follow how your repo writes code, per your documented standards) and Spec (does it do what the originating issue or spec asked). In sandbox testing, the built-in reviewer found all 8 planted defects in about a minute; Pocock's skill adds spec-compliance and convention checking the built-in doesn't attempt. If you install both, one shadows the other depending on install method, so pick deliberately.

How can I tell if a code review skill is safe to install?

Look for three things. First, provenance: skills from vendors like Trail of Bits, Sentry, and Anthropic's own repository are widely cited as safe defaults, while random community skills deserve scrutiny. Second, verification: check whether the skill has been security-scanned (SkillsLLM runs automated dependency and prompt-injection scans; SkillzBench is building security scanning, license checks, and SHA-pinned versions into its free directory). Third, behavior: read the full SKILL.md and audit any bundled scripts before installing — undocumented network calls baked into scripts are a red flag flagged by multiple 2026 guides. SkillzBench's free MCP connector also lets you control exactly which skills your agent can see via per-agent loadouts.

Do these skills work with agents other than Claude Code?

Often, yes. The SKILL.md format was released as an open standard in December 2025 and is now supported by Claude Code, Claude.ai, the Claude API, OpenAI Codex, Cursor, Gemini CLI, Antigravity, and Windsurf. On this list specifically: Agensi's code-reviewer is documented as working with Claude Code, OpenClaw, Codex CLI, and Cursor; akkie76's evidence-code-review ships distributions for both Codex and Claude Code; and Matt Pocock's skills install via npx for any compatible coding agent. SkillzBench's free MCP connector is being built to work across agents, with per-agent loadouts so each agent only sees the skills you've chosen for it.

Should I run the review in the same session that wrote the code?

Prefer a fresh session. As one reviewer quoted in Matt Pocock's documentation put it: 'Same context reviewing itself isn't review, it's confirmation bias with a slash command.' An agent reviewing in the authoring session carries every assumption that shaped the code, while an independent session doesn't. This applies even to the built-in reviewer — the 2026 sandbox testing also noted that the same model that wrote the code reviews it, so for important changes it's worth asking a second model or a fresh session to review. Per-ticket reviews keep diffs small and specs clear; a final branch-level pass catches cross-ticket interactions.