The 8 Best Claude Code Skills for Code Review in 2026

Code review is the last gate before AI-generated code hits your main branch, which makes review skills the most consequential category to get right. Pick the wrong skill and it either flags code that follows your conventions or waves through the violation that breaks production. This guide covers eight verified code review skills for Claude Code in 2026 — every one attributable to a real author and installable through the open-source skillrank registry — plus how to standardize review across your team using the BuildBetter CLI (ZeroShot, run as bb), the context layer that carries skills across every agent your engineers use.

The skills below split into two groups most lists collapse into one: skills that make the agent a better reviewer, and skills that teach the agent to handle review feedback well. Both matter. Only one usually gets covered.

Why Code Review Is the Highest-Leverage Skill Category

Code review is where agent output actually gets checked. As machine-authored code accounts for a rising share of commits in teams that have adopted coding agents, review becomes the primary quality-control point — and the single place a bad skill costs you the most.

Two distinct jobs get conflated under "code review skills," and most lists only cover the first:

• Reviewing — skills that make the agent a sharper critic of a diff.
• Receiving — skills that make the agent accept, triage, and correctly apply the feedback it gets back.

An agent that reviews brilliantly but botches applied feedback creates net churn. It argues with valid comments, reverts good changes, or applies fixes literally without grasping intent. Handling feedback well is a discrete skill, not an automatic byproduct of reviewing well.

Generic AI review has a deeper blind spot: it has no memory of your repo. It doesn't know your naming conventions, your error-handling patterns, or the reason an odd-looking function exists (a perf fix, a vendor quirk, a deliberate deviation). A model without that context flags conforming code and lets real violations through — confidently.

The real limitation of stock reviewer skills isn't intelligence. It's the absence of institutional memory. "We don't do X because of Y" lives in the feedback loop, and a reviewer without that context is confidently wrong.

Every skill named below is real, verified, and traceable to an author. None are invented references.

How to Evaluate a Code Review Skill (Before You Trust It)

The honest test for any review skill is whether it catches something a bare agent misses on your repo. The tool that answers this is skillrank, an open-source CLI that indexes the public agent-skill registry. It also runs under ZeroShot as bb skills <command>.

skillrank exposes five signals per skill, so you're not installing blind:

• Author/slug ref — who wrote it, e.g. mattpocock/code-review.
• One-line description — what it claims to do.
• GitHub source — the actual code you're about to run.
• Security scan rating — safe, low, medium, high, or unknown.
• Detected stacks and eval results — which languages/frameworks it targets, and how it performed.

The commands you'll use most:

• skillrank search code-review — find review skills.
• skillrank show <ref> — inspect a skill's full metadata and live security rating.
• skillrank recommend — suggests skills for your repo's detected stack.
• skillrank install <ref> — hash-verified install.
• skillrank eval <ref> — a paired local eval that runs your agent with and without the skill and compares output.

A review skill is only earning its tokens if skillrank eval shows it catching something the bare agent missed. Generic benchmarks don't reflect your stack, conventions, or decision history — run the eval before you standardize on anything.

Security matters more here than in any other category. A review skill reads your entire diff. Check the security scan rating with skillrank show before you install, and use the hash-verified installer.

The 8 Best Code Review Skills for 2026

Below are the eight skills worth your attention, split into the two groups that matter: the agent as reviewer, and the agent handling review feedback.

Group A — The Agent as Reviewer

1. mattpocock/code-review

A general-purpose PR review skill and the best default for TypeScript- and JavaScript-heavy teams. It runs a structured pass over a diff — checking type safety, obvious logic errors, and common footguns — and returns organized, actionable comments rather than a wall of prose. Its detected stacks lean toward TS/JS ecosystems, which makes it a strong first pick for most B2B SaaS front-end and Node backends.

When to reach for it: your default reviewer on TypeScript projects. Inspect it with skillrank show mattpocock/code-review and confirm the current security rating before install.

2. luongnv89/code-review-specialist

A deeper, more opinionated reviewer than the general-purpose option. Where mattpocock/code-review gives you a solid default pass, luongnv89/code-review-specialist pushes harder on architecture, maintainability, and design smells — useful when you want the agent to challenge structure, not just catch bugs.

When to reach for it: larger or more complex changes where you want a critical second opinion on design. Run skillrank show luongnv89/code-review-specialist to check its detected stacks and scan rating.

3. addyosmani/security-and-hardening

A dedicated security review pass. Security defects and secret leakage are among the most common and highest-severity issues surfaced in review, which is why they deserve a separate lens rather than being folded into general review. This skill targets injection risks, leaked secrets, and unsafe patterns.

When to reach for it: any diff touching auth, input handling, external calls, or configuration. Pair it with the first-party Anthropic guidance below. Verify with skillrank show addyosmani/security-and-hardening — security ratings matter most on a skill that reads your whole diff.

4. anthropics/security-guidance

First-party security guidance from Anthropic, best used as your baseline security lens. It gives the agent a grounded set of security principles to apply during review. It complements rather than replaces addyosmani/security-and-hardening — think of Anthropic's guidance as the baseline and Addy's skill as the deeper, pattern-specific pass.

When to reach for it: as the standing security baseline on every review. Inspect with skillrank show anthropics/security-guidance.

5. mattpocock/qa

A QA-oriented review that focuses on test coverage and edge cases rather than style. Instead of critiquing how code is written, it asks what could break: missing test paths, unhandled inputs, boundary conditions. This complements pure code-review skills — one checks the code, the other checks whether the code is actually verified.

When to reach for it: features with meaningful branching logic or anything customer-facing where regression risk is high. Check skillrank show mattpocock/qa.

Group B — The Agent Handling Review Feedback

6. obra/requesting-code-review

Structures how the agent asks for review. Instead of dumping a diff and hoping the reviewer figures out the point, it surfaces what changed and why — so a human or a second agent reviews the right thing. Framing the diff is the step most workflows skip, and skipping it undermines everything downstream.

When to reach for it: the front of every agent-driven review loop. Inspect with skillrank show obra/requesting-code-review.

7. obra/receiving-code-review

The most under-appreciated skill in the category. It teaches the agent to accept, triage, and correctly apply review feedback instead of overcorrecting, ignoring comments, or applying fixes literally without understanding intent. This is where a lot of agent-driven review quietly falls apart — a great review means nothing if the agent botches the fix.

When to reach for it: always, if your agent is applying its own review feedback. Check skillrank show obra/receiving-code-review.

8. mattpocock/setup-pre-commit

Shifts a whole class of review left. A meaningful fraction of review comments in typical PRs are style and formatting nits that pre-commit tooling can eliminate entirely. This skill sets up that tooling so formatting and lint issues never reach review — freeing human attention for logic instead of whitespace.

When to reach for it: once, per repo, before you standardize on reviewer skills. Inspect with skillrank show mattpocock/setup-pre-commit.

Reviewing vs. Receiving: The Split Most Lists Miss

obra's requesting-code-review and receiving-code-review are a matched pair, and the interesting insight is that handling feedback well is a skill in its own right — not an automatic result of reviewing well.

Consider what goes wrong without a receiving skill. An agent gets a valid comment and reverts a good change because it misread the intent. Or it applies a fix literally, satisfying the letter of the comment while breaking the spirit. Or it argues with feedback it should have accepted. Each of these creates net churn — more work than if the agent had done nothing.

The workflow that actually holds together treats review as a pipeline, not a single step:

1. Frame — obra/requesting-code-review structures the diff so the reviewer sees what changed and why.
2. Critique — a reviewer skill (mattpocock/code-review or luongnv89/code-review-specialist) produces the actual review.
3. Apply — obra/receiving-code-review takes the feedback and applies it cleanly.

Skip the framing and the reviewer critiques the wrong thing. Skip the receiving and the agent mangles good feedback. For teams, the receiving stage is where prior decisions live — "we don't do X because of Y." A receiving skill without that context will happily re-litigate settled decisions every time it hits a comment. That gap is exactly what a team-encoded review standard closes.

Comparison Table: The 8 Skills at a Glance

Skill (author/slug)	Reviewer vs. Receiver	Primary focus	Best-fit stack	Security scan rating	skillrank eval
BuildBetter /bb-review	Reviewer (team-encoded)	Your team's conventions + prior decisions across every agent	Any (cross-agent)	Open source, verifiable	Yes (via bb skills eval)
mattpocock/code-review	Reviewer	General PR review	TypeScript / JS	Run skillrank show	Check live
luongnv89/code-review-specialist	Reviewer	Deeper, opinionated design review	Multi-stack	Run skillrank show	Check live
addyosmani/security-and-hardening	Reviewer	Injection, secrets, unsafe patterns	Multi-stack	Run skillrank show	Check live
anthropics/security-guidance	Reviewer	Baseline security lens (first-party)	Multi-stack	Run skillrank show	Check live
mattpocock/qa	Reviewer	Test coverage & edge cases	TypeScript / JS	Run skillrank show	Check live
obra/requesting-code-review	Receiver (frames)	Structuring the review request	Any	Run skillrank show	Check live
obra/receiving-code-review	Receiver	Applying feedback correctly	Any	Run skillrank show	Check live
mattpocock/setup-pre-commit	Shift-left	Catch nits before review	TypeScript / JS	Run skillrank show	Check live

Security ratings and eval availability change as skills are updated. Run skillrank show <ref> for the live values rather than trusting a static table.

What Generic AI Review Still Can't Do

The best off-the-shelf reviewer skill still misses three things that matter most on a real team.

• Team conventions. Your naming rules, error-handling patterns, and approved libraries aren't in any public skill. A stock reviewer flags code that follows your conventions and waves through code that violates them, because it's measuring against a generic standard, not yours.
• Prior decisions. The reason a seemingly odd pattern exists — a performance fix, a vendor quirk, a deliberate deviation — lives in your history, not in the model. Without memory of that decision, the review confidently suggests "fixing" something that was fixed on purpose.
• Cross-teammate context. One engineer's review learnings don't propagate to the next engineer's agent. Each session starts cold, so the same convention gets re-explained and the same settled decision gets re-argued across the team.

This is the gap that motivates encoding your review standard once — as a skill your whole team shares — rather than re-prompting it per session, per engineer, forever.

Making Review Skills Work Across Your Whole Team

A review skill only helps if it actually runs in whatever agent each teammate uses, and if you can tell whether it helped. That's the problem BuildBetter CLI (ZeroShot, run as bb, at tryzeroshot.com) solves. It's a context layer, not another coding agent — it carries skills across Claude Code, Cursor, Codex, GitHub Copilot, Gemini CLI, and Windsurf, so a review standard set once applies in every agent your engineers reach for.

Three capabilities make it work for teams:

• /bb-review encodes your team's actual review playbook — conventions and prior decisions — so every PR review runs against the same standard instead of a generic one. That's the difference between a reviewer that knows "we don't do X because of Y" and one that keeps flagging it.
• Cross-teammate session memory. bb agent-sessions resume picks up any teammate's session on your machine, in any agent, so review context and learnings compound instead of resetting cold each time.
• It embraces the AGENTS.md standard. BB-Skills extends AGENTS.md with composable, conditional skill packs that load only when relevant — open source at github.com/buildbetter-app/BB-Skills. Adopt, extend, contribute back. No lock-in.

Be honest about scope: BuildBetter CLI doesn't review your code — the skills above do. It carries them across agents, keeps their context so it doesn't reset per session, and pairs with skillrank's eval so you can tell which skills earn their tokens. With an optional BuildBetter API key, it can also pull customer evidence from BuildBetter.ai into specs and reviews, so you're checking code against what customers actually asked for. Teams like Brex, PostHog, and Procore use it to make individual-agent productivity compound across the whole org.

Where Other Tools Fit (and Where They Win)

Pick the layer that matches your actual bottleneck. A few tools solve adjacent problems well:

• agent-hop (agent-hop.com, open source) — search and resume any chat across agents, local-only, no account. If you only need cross-agent resume and want zero cloud, it's a leaner fit than the full BuildBetter CLI resume workflow.
• HQ by Indigo (hqforwork.com) — file-based company memory with reusable /skills shared across a team, plus persistent agents in Slack and email. Strong if you want a broader company brain beyond code.
• Xirp (xirp.spotify.com, on Backstage) — gives agents service ownership and architecture context with auto-updating docs. The best fit if your review gap is architectural or service knowledge and you already run Backstage.
• Factory.ai and the agentic software factory model — standardized inputs to validated changes across code, review, test, and deploy. A fuller pipeline if you want review as one stage of an end-to-end factory.

BuildBetter CLI's differentiator is combining three things the others don't all do together: cross-agent session memory, team-conventional skills, and customer evidence from BuildBetter.ai. If your bottleneck is that review context resets every session and never travels between teammates or agents, that's the layer to reach for.

Frequently Asked Questions

What's the single best code review skill for Claude Code in 2026?

There isn't one. The strongest setup pairs a reviewer skill (mattpocock/code-review or luongnv89/code-review-specialist) with obra/receiving-code-review and a security pass (anthropics/security-guidance, optionally addyosmani/security-and-hardening). Run skillrank eval to confirm the combination actually catches issues on your repo.

How do I know a review skill is actually catching anything?

Run skillrank eval <ref>. It runs a paired local eval on your own agent, comparing output with and without the skill so you can see whether it surfaces real issues a bare agent misses — before you standardize on it.

What's the difference between requesting-code-review and receiving-code-review?

They're a matched pair from obra. requesting-code-review structures how the agent asks for review — surfacing what changed and why — so the right thing gets reviewed. receiving-code-review teaches the agent to accept, triage, and correctly apply feedback instead of overcorrecting, reverting good work, or applying fixes literally.

Are these code review skills safe to install?

Check the security scan rating via skillrank show <ref> (safe/low/medium/high/unknown) and install with hash-verified skillrank install <ref>. Review skills read your full diff, so verifying before adoption matters more here than in most skill categories.

Can I use these skills in Cursor or Codex, not just Claude Code?

Individual skill support varies by agent. BuildBetter CLI (run as bb, at tryzeroshot.com) carries skills across Claude Code, Cursor, Codex, Copilot, Gemini CLI, and Windsurf so the same review standard applies everywhere instead of being re-set per tool.

How do I encode my team's own review standard?

Extend AGENTS.md with BB-Skills, or use a /bb-review skill, so your team conventions and prior decisions travel into every PR review instead of being re-prompted each session by each engineer.

Ship at the speed of insight.

The eight skills above make your agent a better reviewer and a better recipient of feedback. BuildBetter CLI makes them work across every agent your team uses — with shared session memory and your team's review playbook encoded once. Install BuildBetter CLI and put your review standard everywhere.