Comprehensive code review for pull requests with quality, security, and best practices analysis
/plugin marketplace add teliha/dev-workflows/plugin install dev-workflows@dev-workflowsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
README.mdThis skill automatically activates when:
Before reviewing, understand:
PR Scope
Project Context
Read CLAUDE.md
# Get PR details
gh pr view <PR_NUMBER>
# Get PR diff
gh pr diff <PR_NUMBER>
# Get PR files changed
gh pr view <PR_NUMBER> --json files
PARALLELIZATION OPPORTUNITY: Run review categories in parallel for faster analysis:
Use the Task tool with parallel subagents:
Task 1: Security Review
- Check for vulnerabilities
- Review access control
- Verify input validation
- Check external call safety
Task 2: Code Quality Review
- Check best practices
- Review naming conventions
- Check error handling
- Identify code duplication
Task 3: Performance Review
- Check for inefficiencies
- Review loop optimizations
- Check caching opportunities
- Review database queries (if applicable)
Task 4: Testing Review
- Check test coverage
- Identify missing test cases
- Review test quality
For large PRs with many files: Review files in parallel:
Task 1: Review src/auth/*.ts
Task 2: Review src/api/*.ts
Task 3: Review src/components/*.tsx
...
Each subagent provides findings for its scope, results are combined.
Review code changes systematically across these areas:
What to check:
Severity levels:
What to check:
Quality indicators:
For Solidity/Smart Contracts:
For Web/Backend:
What to check:
Questions to ask:
What to check:
forge fmt complianceFor EVK/EVC integration:
callThroughEVC modifier usage on operatorsevc.getCurrentOnBehalfOfAccount() for user identificationevc.requireAccountStatusCheck() after state changesPost review as a PR comment using:
gh pr comment <PR_NUMBER> --body "## Code Review
### Summary
[Brief overview of the PR and review findings]
### Critical Issues
[List any critical security or functionality issues - MUST be fixed]
### Suggestions
[List improvements and optimizations - SHOULD be considered]
### Questions
[Any clarifications needed from the author]
### Positive Findings
[Highlight well-written code and good practices]
### Recommendation
- [ ] Approve - Ready to merge
- [ ] Request Changes - Issues must be addressed
- [ ] Comment Only - Feedback provided, author decides
"
// BAD: No authentication
export async function GET(req: Request) {
const users = await db.users.findMany();
return Response.json(users);
}
// GOOD: With authentication
export async function GET(req: Request) {
const session = await auth(req);
if (!session) return Response.json({ error: 'Unauthorized' }, { status: 401 });
const users = await db.users.findMany();
return Response.json(users);
}
// BAD: Magic numbers
if (status === 1) { ... }
// GOOD: Named constants
const STATUS_ACTIVE = 1;
if (status === STATUS_ACTIVE) { ... }
// BAD: Reading array length every iteration
for (uint256 i = 0; i < array.length; i++) { }
// GOOD: Cache array length
uint256 length = array.length;
for (uint256 i; i < length;) {
unchecked { ++i; }
}
This skill can be triggered automatically in GitHub Actions:
name: Code Review
on:
pull_request:
types: [opened, synchronize]
jobs:
review:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: anthropics/claude-code-action@v1
with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
claude_args: '--allowed-tools "Bash(gh pr:*),mcp__github_inline_comment__create_inline_comment"'
prompt: |
/code-review
PR #${{ github.event.pull_request.number }}
Repository: ${{ github.repository }}
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.