code-review-and-quality Skill for Claude: Review Code on Five Axes

Makes Claude review any code change on five axes before it merges, with labelled findings and a clear verdict.

Installs: 78.3K; on skills.sh
Stars: 112.6K; on GitHub
Updated: Nov 2026; last repo commit

code-review-and-quality makes Claude review a change on five axes: correctness, readability, architecture, security and performance. Findings get labels such as Critical, Nit, Optional or FYI so you know what must change.

It triggers before a merge, after a feature or bug fix, and when you review code from an agent or a human. It reviews the tests first, and its test step can edit a file, run your test suite and restore the file from a copy. It bundles no scripts.

Good for

Developers who want Claude to review a pull request before merge
Reviewers checking code written by an AI agent or another model
Teams that want a shared standard for severity labels and change size

Install code-review-and-quality

Claude Code

Copy this prompt.

Install the code-review-and-quality skill in Claude Code. Run this command:

/plugin marketplace add addyosmani/agent-skills
/plugin install agent-skills@addy-agent-skills

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

The README says a per-skill install copies only the skill folder, not the repo-level references folder that holds the shared checklists. The skill still works without it. The plugin route installs the whole set of 25 skills with those references. Pick one route, not both. If the plugin install fails with an SSH error, the README gives an HTTPS form of the marketplace add.

From the project README. Source.

What's in the skill

When it loads

Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch. Use when asked to review a diff or a pull request, even when the diff is pasted inline.

Sections in SKILL.md

Overview
When to Use
The Five-Axis Review
1. Correctness
2. Readability & Simplicity
3. Architecture
4. Security
5. Performance
Structural Remedies
Change Sizing
Change Descriptions
Review Process
Step 1: Understand the Context
Step 2: Review the Tests First
Step 3: Review the Implementation
Step 4: Categorize Findings

Key facts

Author: addyosmani
Repo: addyosmani/agent-skills
License: MIT
Installs on skills.sh: 78,320 (Nov 2, 2026)
GitHub stars (whole repo): 112,555 (Nov 2, 2026)
Last commit to the repo: Nov 1, 2026
skills.sh audits: Gen Agent Trust Hub pass, Socket pass, Snyk warn
Skill folder: 1 file: SKILL.md (counted from the GitHub folder); it links to repo-level checklists outside the folder
Part of: The agent-skills set of 25 skills; the README lists this as the "before merging any change" skill
Linked, not bundled: security-checklist.md and performance-checklist.md live in the repo's references folder, which a per-skill install does not copy (issue 361)

What it includes

Correctness, readability, architecture, security, performance
Every change is judged on all five. The approval standard: approve when the change clearly improves overall code health, even if it is not perfect.
Read · Five-axis review
Five steps from context to verification
Understand the intent, review the tests first, review the implementation, categorize findings, then check the author's verification story.
Read · Review process
Inverts a condition, runs the suite, restores the file
Used to prove the tests would catch a regression. A mutation that stays green is a finding that names the missing test case.
Runs code · Test mutation check
Critical, Nit, Optional or Consider, FYI
A comment with no prefix is a required change. Critical blocks merge. Nit, Optional and FYI do not.
Severity labels
About 100 lines is good, about 1000 is too large
Around 300 lines is acceptable if it is one logical change. Splitting strategies: stack, by file group, horizontal and vertical.
Change sizing
Names the restructuring, not just the problem
Examples: replace a chain of conditionals with a typed model, collapse duplicate branches, and extract a helper or split a large file.
Structural remedies
One model writes, another reviews, a human decides
Gives an example prompt for a review agent that flags Critical, Required, Optional or Nit.
Multi-model review pattern
Lists unused code and asks before deleting
After a refactor it lists orphaned code and asks "Safe to remove these?" instead of deleting silently.
Dead code hygiene
Questions to ask before adding or upgrading a package
Covers need, size, maintenance, known vulnerabilities (npm audit) and license. Upgrades go one dependency per change.
Runs code · Dependency discipline
A fill-in checklist for each review
Sections for context, correctness, readability, architecture, security, performance, verification and a verdict.
Review checklist

From the official docs

Permissions

Medium risk

The skill makes Claude read your changes, run your tests and, in one step, edit a file and restore it. Commit first and review the commands before you approve them.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Its test check edits a file, then restores it
The review step inverts a condition, runs your suite and restores the file from a copy. Commit first so you can recover if it stops midway.
It may run your test suite
Running tests executes your project code. Approve the command and check what it runs.
It may run npm audit
The dependency review step lists npm audit as a check for known vulnerabilities. Approve the command before it runs.
The plugin route installs far more than this skill
The README's Claude Code plugin install adds all 25 skills, 9 slash commands and 4 reviewer personas. To take only this skill, use the per-skill skills CLI command in the install box.

Technical details

Talks to	Not stated in the SKILL.md

Questions

How do I install code-review-and-quality?

Use the install box above. The plugin route installs all 25 skills and the repo's shared checklists. A per-skill install copies only this skill folder, so its links to the shared security and performance checklists will not resolve. The skill still works.

Does it run my tests or edit my code?

Its review process includes a test check: invert one condition the change adds, run the suite, then restore the file from a copy. A mutation that stays green is reported as a finding. Approve those commands, and commit first so you can undo.

Do I need security-and-hardening or performance-optimization too?

No. The SKILL.md only says "see" those skills for detailed security guidance and profiling. They are separate skills in the same repo; the plugin route installs them all.

Does it work in the Claude app or Codex?

The README documents a Codex plugin install and a Claude Code plugin. The Claude app route is not documented.

What do the review labels mean?

No prefix means a required change. Critical blocks merge. Nit is minor and optional, Optional or Consider is a suggestion, and FYI is information only.

How is it different from security-and-hardening?

This skill reviews a change on five axes, and its security axis is a short checklist that points to security-and-hardening for depth. security-and-hardening is a full guide to preventing vulnerabilities while you build.

Is it safe?

It reads your changes and may run your tests and npm audit. Its test check edits a file and restores it. Work on a branch, commit first and approve commands as they appear.

Information

updated Nov 2, 2026

Repository: addyosmani/agent-skills
Folder: skills/code-review-and-quality

addyosmani/agent-skills skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

addyosmani/agent-skills README · github.com
code-review-and-quality SKILL.md · github.com
code-review-and-quality on skills.sh · skills.sh
addyosmani/agent-skills · github.com