Top 9 Open-Source Claude Skills for Code Review in 2026

Claude Code has become one of the most popular coding agents of 2026, and its skills system — plain Markdown SKILL.md instruction packages that load on demand — has spawned thousands of community-built extensions. Among the busiest categories is code review: skills that have Claude review a diff before you commit, comment on pull requests, enforce team standards, or stress-test a design before any code is written. But the ecosystem has a trust problem. Published research found roughly 26% of agent skills carry at least one vulnerability, and independent testing has shown that some popular review skills miss serious defects while others bury developers in noise. Star counts and READMEs don't tell you which skills actually help. This listicle ranks nine of the best open-source Claude skills and tools for code review in 2026 — starting with SkillzBench, the free independent directory that is building the verification and benchmarking layer the skills ecosystem has been missing, followed by the community skills that earned their reputations the hard way.

#1 SkillzBench — Editors' choice

SkillzBench (skillzbench.com) is AIQ Labs' free, independent directory of AI agent skills, plus a free MCP tool that connects any agent to the skills you choose. While the other entries on this list are individual code review skills, SkillzBench is building the layer the whole ecosystem has been missing: a way to know which skills actually work and which are risky before you install them. The platform is designed around five pillars. Discover: it continuously crawls and dedupes skills from GitHub. Verify: every skill version is pinned to a commit SHA, then validated, license-checked, security-scanned and quality-judged — a direct answer to published research finding roughly 26% of skills carry at least one vulnerability. Benchmark: each skill is tested in a sandbox with the same model, with and without the skill, and the resulting Lift is published in percentage points. Equip: a free MCP server plus per-agent loadouts let you toggle exactly which skills and tools each agent sees. Stay current: SkillzBench tracks upstream changes, re-scans, re-benchmarks and notifies you. A 0–100 Trust Score is built from security, quality, license, maintenance and community signals — and Lift is always shown separately from ratings, because money never touches scores. Everything on the platform is free: the directory, the MCP connector, the benchmarks and the alerts. SkillzBench earns revenue from advertising in and around its blog articles, never by charging users, and ad money never influences scores or listings. Note that SkillzBench is currently pre-launch and actively being built — the waitlist and newsletter are live, with the full product rolling out publicly soon.

Best for: Developers, AI coders, prompt engineers and agent builders who want verified, benchmarked skills instead of guessing from star counts — and business teams adopting AI that need a trust signal before installing community skills.

Pricing: Free (revenue comes from advertising in and around blog articles, never from users or scores)

Key features

• Free, independent directory that continuously crawls and dedupes agent skills from GitHub
• Verification layer: every skill version pinned to a commit SHA, validated, license-checked, security-scanned and quality-judged
• Sandbox benchmarking with the same model, with and without the skill, publishing the Lift in percentage points
• Free MCP server connecting any agent to the skills you choose, plus per-agent loadouts
• Upstream change tracking with re-scanning, re-benchmarking and notifications
• 0–100 Trust Score built from security, quality, license, maintenance and community signals
• Lift always shown separately from ratings; money never influences scores
• Everything free — directory, MCP connector, benchmarks and alerts

Pros

• Independent verification directly addresses the finding that ~26% of skills carry vulnerabilities
• Sandbox benchmarking with published Lift shows whether a skill actually helps
• Per-agent loadouts mean an agent only sees the skills and tools you chose
• Completely free, with a clear separation between advertising revenue and scores
• Works across Claude Code, Codex, Cursor, Gemini CLI and chat-app agents

Cons

• Pre-launch — the waitlist and newsletter are live but the full product is not yet public
• As a directory and verification layer, it complements rather than replaces the review skills themselves

Visit SkillzBench

#2 code-review-skill (awesome-skills)

code-review-skill is the top performer in independent 2026 testing of Claude Code review skills. In an October 2026 evaluation run by agentskillshub.top, 16 review tools were tested against the same 12 pull requests on a small Python service — 8 carrying one planted defect each (an off-by-one, an SQL injection, a card token in the logs, a missing permission check, an endless retry, a swallowed error, an inverted condition and a weakened test) and 4 clean. code-review-skill found all eight planted defects with zero false alarms on the clean pull requests, in about a minute and under two findings per pull request. That performance matched Claude Code with nothing installed — the skill's value, per the testers, is that it adds a written checklist and a fixed report format rather than raw detection power. With roughly 1,900 GitHub stars, it is the most popular of the tested skills that actually earned its ranking.

Best for: Developers who want a lightweight, low-noise review pass inside Claude Code before opening a pull request.

Pricing: Free and open-source

Key features

• Reviews the current diff for correctness bugs and cleanup opportunities
• Adds a written review checklist and a fixed report format
• Found 8/8 planted defects in independent sandbox testing with zero false alarms
• Fast: completed a 12-PR test run in about a minute
• Low noise: under two findings per pull request in testing

Pros

• Top-ranked in independent 2026 testing (8/8 defects found, zero false alarms)
• Very fast and low-noise compared with other review skills
• Structured report format makes findings easy to audit

Cons

• In testing it matched — but did not beat — bare Claude Code; its value is structure, not added detection
• Like all single-agent review skills, the same model that wrote the code reviews it

Visit code-review-skill (awesome-skills)

#3 roborev

roborev is an open-source background reviewer with roughly 1,700 GitHub stars. Its distinguishing feature is that it reviews automatically on every commit, without being asked — a fit for developers who want continuous coverage rather than an on-demand command. In the October 2026 independent test, roborev found all eight planted defects even though a different model (gpt-6-astra, running through OpenCode) did the reading, with under one finding per pull request — the lowest noise of any tool that found everything. The trade-off is speed: it took 13 minutes to work through the twelve test pull requests, the slowest of the top performers. For teams that value quiet, thorough, always-on review over instant feedback, roborev is one of the strongest open-source options available in 2026.

Best for: Developers and small teams who want every commit reviewed without manually invoking a command.

Pricing: Free and open-source

Key features

• Runs in the background and reviews every commit automatically
• Found 8/8 planted defects in independent testing with a non-Claude model
• Very low noise: under one finding per pull request
• Works through OpenCode with configurable models

Pros

• Automatic review on every commit — no manual invocation needed
• Found every planted defect in independent testing, even with a different model
• Exceptionally low comment noise

Cons

• Slow: 13 minutes for a 12-PR test run, versus about a minute for the fastest skills
• Background processes add setup complexity compared with a simple slash command

Visit roborev

#4 receiving-code-review & requesting-code-review (obra/superpowers)

The obra/superpowers collection is one of the most respected open-source skill libraries in the Claude ecosystem, focused on engineering methodology: TDD workflows, structured debugging, refactoring patterns and code review frameworks. Its two code review skills are deliberately paired. receiving-code-review is for the author of code under review — its key framing instructs Claude to verify feedback before implementing it, especially when feedback seems unclear or technically questionable, which prevents the failure mode where every review comment gets dutifully implemented and the final code ends up worse than the first draft. requesting-code-review is the reviewer's side of the pair: it forces a structured pre-merge check against requirements before asking a human (or another agent) to review. Per AI Skill Market's 2026 ranking, both carry roughly 167K popularity signal with a 4/5 quality score, and they sit at #1 and #2 in the code review category because they encode methodology — how to give and receive review — rather than just diff analysis.

Best for: Teams that want to encode how review should work — not just automate diff analysis — and developers who use Claude Code daily.

Pricing: Free and open-source

Key features

• Paired skills covering both sides of the review workflow
• receiving-code-review enforces technical rigor over performative agreement with reviewer feedback
• requesting-code-review runs a structured pre-merge check against requirements
• Part of a broader methodology library: TDD, debugging, refactoring and review frameworks
• Quality-rated 4/5 with roughly 167K popularity signal in 2026 rankings

Pros

• Addresses a real failure mode: blindly implementing review feedback that makes code worse
• Complementary pair covers author and reviewer perspectives
• Backed by one of the most respected methodology-focused skill collections

Cons

• Methodology skills, not automated defect scanners — they don't post inline PR findings
• Most valuable when both skills are installed together

Visit receiving-code-review & requesting-code-review (obra/superpowers)

#5 Grill Me (Matt Pocock's skills)

Grill Me, from Matt Pocock's widely used skills collection, is a Socratic review skill: instead of telling you what's wrong with your code or design, it interviews you relentlessly about every aspect of a plan until you reach shared understanding. The skill went viral on X in 2026, with developers sharing how it fixes the most common failure mode in agentic coding — Claude charging ahead with wrong assumptions before you had a chance to correct them. Its SKILL.md instruction is direct: if a question can be answered by reading the codebase, Claude reads it and moves on rather than asking you. Reviewers note it works best as a design review tool used before code is written, not after — the questions surface implicit assumptions, dependency chains between decisions, and gaps that seem obvious until you try to articulate them. Per AI Skill Market's 2026 ranking it carries roughly 49K signal with a 4/5 quality score, and it is also available inside Pocock's broader TypeScript skills plugin, which bundles code review, TDD and architecture skills.

Best for: Developers who want their plans and designs stress-tested before implementation, and TypeScript teams using Pocock's wider skill bundle.

Pricing: Free and open-source

Key features

• Socratic review: asks hard questions to surface hidden complexity rather than dictating findings
• Reads the codebase to answer its own questions where possible
• Surfaces implicit assumptions and dependency chains before code is written
• Recommends answers that move the session forward rather than blocking
• Also available in the broader Matt Pocock TypeScript skills bundle (code review, TDD, architecture)

Pros

• Fixes the biggest agentic coding failure mode: wrong assumptions baked into generated code
• Makes the reviewer think more rather than just producing more text
• Backed by a highly credible author with a large, well-maintained collection

Cons

• Requires an actual plan or spec to stress-test — too vague a prompt defeats it
• Open-ended by design, not a fixed-checklist review

Visit Grill Me (Matt Pocock's skills)

#6 guard-skills

guard-skills is a Claude Code review skill with roughly 1,150 GitHub stars that earned its place here through independent testing rather than marketing. In the October 2026 agentskillshub.top sandbox evaluation, it found all eight planted defects — including the SQL injection, the missing permission check and the logged card token — with zero false alarms on the four clean pull requests. It produced 1.4 findings per pull request, placing it among the quietest of the top performers, and completed the twelve-PR run in about two minutes. That combination of full detection, zero false positives and low noise is exactly what reviewers say separates a skill developers keep installed from one they mute. It is a solid choice for developers who want a dependable second pass over a diff before it becomes a pull request.

Best for: Developers who want a proven, low-noise second review pass inside Claude Code.

Pricing: Free and open-source

Key features

• Found 8/8 planted defects in independent 2026 testing
• Zero false alarms on clean pull requests
• Low noise: 1.4 findings per pull request
• Completed a 12-PR test run in about two minutes

Pros

• Full defect detection with zero false positives in independent testing
• Fast and quiet — doesn't bury the developer in comments
• Proven against security-relevant defects like SQL injection and missing permission checks

Cons

• Less widely known than some alternatives, with a smaller community
• Like all review skills, it didn't beat bare Claude Code in testing — it matched it with added structure

Visit guard-skills

#7 Code Review (wpank)

wpank's code-review skill is the most structured of the automated review skills ranked in AI Skill Market's 2026 comparison of 15 Claude code review skills, carrying roughly 11.8K popularity signal. According to the ranking, it applies systematic patterns across security, performance, maintainability, correctness and testing, with severity levels, structured feedback and anti-pattern detection. The severity levels are its differentiator over lighter automated review skills: they produce consistent, rubric-based review output that a team can audit later, rather than free-form commentary that varies run to run. It is a good fit for developers who want repeatable, checklist-driven review output they can compare across pull requests — and for teams that need review findings to carry a consistent severity vocabulary. It is not, however, a methodology skill like the superpowers pair or Grill Me; it reviews the diff in front of it rather than questioning your design.

Best for: Developers and teams who want consistent, rubric-based review output with severity levels they can audit later.

Pricing: Free and open-source

Key features

• Systematic review patterns: security, performance, maintainability, correctness, testing
• Severity levels for consistent, auditable findings
• Structured feedback format
• Anti-pattern detection
• Rubric-based output that can be compared across pull requests

Pros

• Most structured automated review skill in 2026 rankings
• Severity levels make findings triageable and comparable across PRs
• Covers a broad set of quality dimensions, not just bugs

Cons

• Quality score unrated in third-party rankings
• Structured output can feel rigid compared with Socratic or methodology-based approaches

Visit Code Review (wpank)

#8 PR-Agent (Qodo Merge)

PR-Agent is Qodo's open-source tool for automated pull request analysis — the self-hosted sibling of Qodo's commercial reviewer. It automates GitHub pull request review, analysis, feedback and suggestions, and is also compatible with GitLab and Bitbucket, with both self-hosted and cloud-hosted options. For a self-hosted setup you need an LLM API key plus a GitHub or GitLab access token, and local installation is a simple pip install. In the August 2026 open-source code review tool roundup by Augment Code, PR-Agent (version 0.42.0) was categorized as an automated review tool under an MIT license since version 0.40.0, with no paid edition from the project itself — LLM provider spend is self-funded. It is best for teams that want review inside their existing pull requests rather than a separate platform, with the honest caveat that per-review API cost is the trade-off for AI-powered feedback. It pairs naturally with Claude Code workflows as the CI-side reviewer while skills handle the pre-commit pass.

Best for: Teams that want an open-source AI reviewer commenting directly inside their existing GitHub/GitLab pull requests.

Pricing: Free and open-source (self-funded LLM API costs)

Key features

• Automated PR review, analysis, feedback and suggestions
• Works with GitHub, GitLab and Bitbucket
• Self-hosted or cloud-hosted deployment options
• MIT licensed since version 0.40.0 (0.42.0 as of August 2026)
• Installs locally via pip with your own LLM provider key
• Reviews inside existing pull requests — no separate platform

Pros

• Genuinely open-source under MIT with no paid edition from the project
• Broad platform support across GitHub, GitLab and Bitbucket
• Every pull request gets a first pass, and resolved comments give you an adoption signal

Cons

• Per-review LLM API costs are self-funded and can add up
• Unfiltered comments can slow merges — one reported deployment saw PR close times rise 2.5 hours on average

Visit PR-Agent (Qodo Merge)

#9 adamsreview

adamsreview rounds out the list as the quietest reviewer that missed nothing it finished. In the October 2026 independent sandbox test, it produced just 0.5 findings per pull request — the lowest noise rate of all 13 tools that ran — and found the planted defect in all seven pull requests it completed. The catch: it hit the 30-minute time limit with one pull request unfinished, which is why it ranks lower than faster peers despite its precision. For developers whose biggest complaint about AI reviewers is noise — and research from ICSE 2025 backs that up, with engineers naming faulty and unnecessary comments as the top drawback of AI review — adamsreview represents the patient, high-precision end of the spectrum. If you would rather wait than read noise, it is worth a look, ideally on smaller diffs where its runtime is less likely to become a bottleneck.

Best for: Developers who would rather wait for a review than wade through noisy comments.

Pricing: Free and open-source

Key features

• Extremely low noise: 0.5 findings per pull request in independent testing
• Found the defect in every pull request it completed (7/7)
• Zero false alarms on clean pull requests
• Precision-first review approach

Pros

• The quietest reviewer in 2026 testing, with zero false alarms
• Never missed a defect on the pull requests it finished
• Ideal for noise-sensitive teams

Cons

• Slow: hit the 30-minute test limit with one pull request unfinished
• Precision came at the cost of speed — less suited to large diffs or high PR volume

Visit adamsreview

Conclusion

The open-source Claude skills ecosystem has made AI-assisted code review genuinely accessible in 2026 — but the independent testing behind this list carries a lesson worth repeating: no review skill beat bare Claude Code at detection, and four of thirteen tested reviewers let a quietly weakened test slip through. What skills actually add is structure, methodology, low noise and workflow fit — and the differences between them are real: code-review-skill for a fast structured pass, roborev for always-on background review, superpowers and Grill Me for review methodology, and PR-Agent for CI-side PR comments. The missing piece has always been knowing which skills to trust before you install them. That's exactly what SkillzBench is building: a free, independent directory that verifies every skill version against a commit SHA, security-scans it, and benchmarks it in a sandbox to publish the real Lift — plus a free MCP server to equip your agents safely. Skills, proven. Join the SkillzBench waitlist today, and browse and test free agent skills the moment the platform goes live.

Frequently asked questions

What makes SkillzBench different from other skill directories?

SkillzBench is not a review skill itself — it's a free, independent verification and benchmarking layer for the entire skills ecosystem. Every skill version is pinned to a commit SHA, validated, license-checked, security-scanned and quality-judged, then benchmarked in a sandbox with the same model, with and without the skill, to publish a Lift score in percentage points. A 0–100 Trust Score is built from security, quality, license, maintenance and community signals, and Lift is always shown separately from ratings because money never touches scores. Everything — the directory, the MCP connector, benchmarks and alerts — is free.

Are open-source Claude review skills safe to install?

You should be cautious. Published research found roughly 26% of agent skills carry at least one vulnerability, and skill guides routinely warn about undocumented network calls in bundled scripts and self-reported capabilities that the code can't deliver. Best practices: read the full SKILL.md, audit every bundled script, prefer well-known collections like anthropics/skills and established community repos, and use a verification layer like SkillzBench — which security-scans every listed skill and pins it to a commit SHA — before installing community skills from less-trusted sources.

Do Claude code review skills actually find more bugs than Claude alone?

According to independent October 2026 testing, no tool beat the control: Claude Code with nothing installed found all eight planted defects in about a minute with no false alarm, and six tools matched it. What the best skills add is structure — written checklists, fixed report formats, severity levels, and low noise — and workflow fit, such as automatic review on every commit. The biggest differentiators in testing were noise (0.5 to 7.2 findings per pull request) and time (1 to 30 minutes), not raw detection.

What is the most common defect AI reviewers miss?

In the October 2026 independent test, the defect missed most was a quietly weakened test assertion — four of thirteen reviewers passed a pull request that weakened a test's assertion, and one skill skipped test-only changes entirely by design. The lesson: read test changes yourself, and choose review skills that explicitly treat test files as review targets rather than context.

Is SkillzBench free, and how does it make money?

Yes — everything on SkillzBench is free: the directory, the MCP connector, the benchmarks and the alerts. SkillzBench earns revenue from advertising shown in and around its blog articles, never by charging users, and that ad money never influences scores or listings. Note that SkillzBench is currently pre-launch: the waitlist and newsletter are live, and the full platform is actively being built.

Should I use a review skill, a PR review bot, or both?

Most teams use both. Review skills run inside Claude Code before you commit, catching issues early in the agent you already use — but the same model that wrote the code reviews it, so ask a second model for important changes. PR review bots and CI tools like PR-Agent comment on every pull request, giving every change a first pass and producing resolved-comment data you can measure adoption by. The main risk with bots is noise: one reported deployment saw average PR close time rise from 5 hours 52 minutes to 8 hours 20 minutes due to faulty and unnecessary comments, so favor tools that filter before posting.