{
  "$schema": "https://top-agent-skills.com/schemas/catalog.v1.json",
  "type": "primary-category",
  "slug": "code-quality-review",
  "title": "Code Quality & Review",
  "shortTitle": "Code Review",
  "description": "Structured reviews, refactoring, simplification passes, and TDD-driven workflows.",
  "canonical": "https://top-agent-skills.com/top-skills-for-code-quality-review",
  "alternates": {
    "html": "https://top-agent-skills.com/top-skills-for-code-quality-review",
    "markdown": "https://top-agent-skills.com/top-skills-for-code-quality-review.md",
    "json": "https://top-agent-skills.com/top-skills-for-code-quality-review.json"
  },
  "rubricVersion": "1.0",
  "methodology": "https://top-agent-skills.com/about/methodology",
  "contentLastUpdated": "2026-07-28",
  "count": 19,
  "topPick": {
    "slug": "superpowers",
    "name": "superpowers",
    "score": 61,
    "tagline": "Structured multi-step development. Brainstorm → spec → plan → build → review → merge — TDD baked in.",
    "url": "https://top-agent-skills.com/skill/superpowers"
  },
  "ranking": [
    {
      "rank": 1,
      "slug": "superpowers",
      "name": "superpowers",
      "score": 61,
      "tagline": "Structured multi-step development. Brainstorm → spec → plan → build → review → merge — TDD baked in.",
      "bestFor": "Long-running engineering tasks where you want each phase to handoff cleanly.",
      "notIdealFor": "Quick one-shot tasks — the orchestration overhead is not worth it.",
      "provenance": "community",
      "publisher": "obra",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add obra/superpowers",
      "url": "https://top-agent-skills.com/skill/superpowers",
      "json": "https://top-agent-skills.com/skill/superpowers.json"
    },
    {
      "rank": 2,
      "slug": "semgrep-scan",
      "name": "semgrep",
      "score": 52,
      "tagline": "Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns.",
      "bestFor": "Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express.",
      "notIdealFor": "Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product.",
      "provenance": "verified-org",
      "publisher": "Semgrep",
      "license": "Semgrep Rules License v1.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "npx skills add semgrep/skills",
      "url": "https://top-agent-skills.com/skill/semgrep-scan",
      "json": "https://top-agent-skills.com/skill/semgrep-scan.json"
    },
    {
      "rank": 3,
      "slug": "semgrep-code-security",
      "name": "code-security",
      "score": 52,
      "tagline": "A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration.",
      "bestFor": "Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP.",
      "notIdealFor": "Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards.",
      "provenance": "verified-org",
      "publisher": "Semgrep",
      "license": "Semgrep Rules License v1.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "npx skills add semgrep/skills",
      "url": "https://top-agent-skills.com/skill/semgrep-code-security",
      "json": "https://top-agent-skills.com/skill/semgrep-code-security.json"
    },
    {
      "rank": 4,
      "slug": "debug",
      "name": "debug",
      "score": 51,
      "tagline": "Disciplined debugging loop. Reproduce, isolate, diagnose, fix.",
      "bestFor": "When behavior diverges from expected and the cause is not obvious from a quick read.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex",
        "antigravity"
      ],
      "install": "claude plugin install engineering",
      "url": "https://top-agent-skills.com/skill/debug",
      "json": "https://top-agent-skills.com/skill/debug.json"
    },
    {
      "rank": 5,
      "slug": "tech-debt",
      "name": "tech-debt",
      "score": 51,
      "tagline": "Honest tech-debt audit with a prioritized cleanup backlog.",
      "bestFor": "Quarterly planning, post-incident review, or any moment the team agrees something has to give.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex",
        "antigravity"
      ],
      "install": "claude plugin install engineering",
      "url": "https://top-agent-skills.com/skill/tech-debt",
      "json": "https://top-agent-skills.com/skill/tech-debt.json"
    },
    {
      "rank": 6,
      "slug": "simplify",
      "name": "simplify",
      "score": 50,
      "tagline": "Review for reuse, quality, efficiency. Catches over-abstraction and dead code before merge.",
      "bestFor": "Pre-merge review pass on a feature branch.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor"
      ],
      "install": "Bundled with Claude Code by default — invoke with /simplify.",
      "url": "https://top-agent-skills.com/skill/simplify",
      "json": "https://top-agent-skills.com/skill/simplify.json"
    },
    {
      "rank": 7,
      "slug": "vercel-web-design-guidelines",
      "name": "vercel-web-design-guidelines",
      "score": 49,
      "tagline": "100+ accessibility and UX rules from Vercel, applied as a structural audit on your UI code.",
      "bestFor": "Pre-PR audits, accessibility compliance, design system enforcement.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Vercel",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add github.com/vercel-labs/agent-skills --skill web-design-guidelines",
      "url": "https://top-agent-skills.com/skill/vercel-web-design-guidelines",
      "json": "https://top-agent-skills.com/skill/vercel-web-design-guidelines.json"
    },
    {
      "rank": 8,
      "slug": "vercel-react-best-practices",
      "name": "vercel-react-best-practices",
      "score": 49,
      "tagline": "57 React/Next.js performance rules, applied as a structural review on your code.",
      "bestFor": "Performance reviews on React/Next.js codebases.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Vercel",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add github.com/vercel-labs/agent-skills --skill vercel-react-best-practices",
      "url": "https://top-agent-skills.com/skill/vercel-react-best-practices",
      "json": "https://top-agent-skills.com/skill/vercel-react-best-practices.json"
    },
    {
      "rank": 9,
      "slug": "trail-of-bits",
      "name": "trail-of-bits",
      "score": 49,
      "tagline": "Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.",
      "bestFor": "Pre-release vulnerability scans, ongoing security review.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Trail of Bits",
      "license": "Apache-2.0",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add trailofbits/skills",
      "url": "https://top-agent-skills.com/skill/trail-of-bits",
      "json": "https://top-agent-skills.com/skill/trail-of-bits.json"
    },
    {
      "rank": 10,
      "slug": "prisma-orm",
      "name": "prisma-orm",
      "score": 49,
      "tagline": "Prisma migrations and queries by the book. Index-aware, migration-safe, type-correct.",
      "bestFor": "TypeScript backends on Prisma where schema migrations should be reviewable and safe.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Prisma",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add prisma/skills",
      "url": "https://top-agent-skills.com/skill/prisma-orm",
      "json": "https://top-agent-skills.com/skill/prisma-orm.json"
    },
    {
      "rank": 11,
      "slug": "next-js-app-router",
      "name": "next-js-app-router",
      "score": 49,
      "tagline": "Next.js App Router by the book. Server components, streaming, parallel routes.",
      "bestFor": "Next.js 13+ teams that want App Router patterns idiomatic and not Pages-Router-flavored.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Vercel",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add github.com/vercel-labs/agent-skills --skill next-js-app-router",
      "url": "https://top-agent-skills.com/skill/next-js-app-router",
      "json": "https://top-agent-skills.com/skill/next-js-app-router.json"
    },
    {
      "rank": 12,
      "slug": "owasp-security-skills",
      "name": "code-review-security",
      "score": 49,
      "tagline": "OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary.",
      "bestFor": "Pre-merge security gates mapped to a standard a reviewer can cite, and threat modelling multi-agent systems against the OWASP Multi-Agentic guide and CSA MAESTRO layers.",
      "notIdealFor": "Vendoring into a product. The bundle is CC-BY-4.0 — a content licence, not a software licence — so check your obligations before redistributing the rules.",
      "provenance": "verified-org",
      "publisher": "OWASP Foundation",
      "license": "CC-BY-4.0",
      "compatibility": [
        "claude-code"
      ],
      "install": "/plugin marketplace add OWASP/secure-agent-playbook",
      "url": "https://top-agent-skills.com/skill/owasp-security-skills",
      "json": "https://top-agent-skills.com/skill/owasp-security-skills.json"
    },
    {
      "rank": 13,
      "slug": "sentry-error-handling",
      "name": "sentry-error-handling",
      "score": 48,
      "tagline": "Sentry the right way. Source maps, releases, breadcrumbs, performance, structured tags.",
      "bestFor": "Teams adding or improving error monitoring with Sentry.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Sentry",
      "license": "Apache-2.0",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "/plugin marketplace add getsentry/skills",
      "url": "https://top-agent-skills.com/skill/sentry-error-handling",
      "json": "https://top-agent-skills.com/skill/sentry-error-handling.json"
    },
    {
      "rank": 14,
      "slug": "security-review",
      "name": "security-review",
      "score": 48,
      "tagline": "Pre-merge security sweep on the current branch's diff.",
      "bestFor": "Every PR before merge — catches the mechanical security issues a hurried human review misses.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "Built into Claude Code. Invoke with /security-review.",
      "url": "https://top-agent-skills.com/skill/security-review",
      "json": "https://top-agent-skills.com/skill/security-review.json"
    },
    {
      "rank": 15,
      "slug": "code-review-builtin",
      "name": "code-review",
      "score": 48,
      "tagline": "The canonical Anthropic code review. Effort levels from quick to ultra.",
      "bestFor": "Every change before merge, with effort sized to the change's risk.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "Built into Claude Code. Invoke with /code-review.",
      "url": "https://top-agent-skills.com/skill/code-review-builtin",
      "json": "https://top-agent-skills.com/skill/code-review-builtin.json"
    },
    {
      "rank": 16,
      "slug": "review-pr",
      "name": "review",
      "score": 48,
      "tagline": "PR review with inline GitHub comments via gh.",
      "bestFor": "Reviewing teammates' PRs without leaving the terminal.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "Built into Claude Code. Invoke with /review.",
      "url": "https://top-agent-skills.com/skill/review-pr",
      "json": "https://top-agent-skills.com/skill/review-pr.json"
    },
    {
      "rank": 17,
      "slug": "composition-patterns",
      "name": "composition-patterns",
      "score": 47,
      "tagline": "Boolean prop hell → compound components. Cleaner React component APIs by construction.",
      "bestFor": "Component library refactoring, API design improvements.",
      "notIdealFor": null,
      "provenance": "verified-org",
      "publisher": "Vercel",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor"
      ],
      "install": "npx skills add github.com/vercel-labs/agent-skills --skill composition-patterns",
      "url": "https://top-agent-skills.com/skill/composition-patterns",
      "json": "https://top-agent-skills.com/skill/composition-patterns.json"
    },
    {
      "rank": 18,
      "slug": "tdd-skill",
      "name": "tdd-skill",
      "score": 46,
      "tagline": "TDD with red/green/refactor as a concrete TypeScript walkthrough.",
      "bestFor": "New features with clear requirements, bug fixes, complex business logic.",
      "notIdealFor": "UI layout changes, simple CRUD, exploratory code.",
      "provenance": "community",
      "publisher": "obra",
      "license": "MIT",
      "compatibility": [
        "claude-code",
        "cursor",
        "codex"
      ],
      "install": "npx skills add obra/superpowers --skill tdd",
      "url": "https://top-agent-skills.com/skill/tdd-skill",
      "json": "https://top-agent-skills.com/skill/tdd-skill.json"
    },
    {
      "rank": 19,
      "slug": "code-review-plugin",
      "name": "code-review-plugin",
      "score": 45,
      "tagline": "Structured PR reviews with severity-tagged findings — bugs, security, perf, style.",
      "bestFor": "Pre-merge review with consistent format that PR comments can quote directly.",
      "notIdealFor": null,
      "provenance": "anthropic",
      "publisher": "Anthropic",
      "license": "MIT",
      "compatibility": [
        "claude-code"
      ],
      "install": "Bundled with Claude Code — invoke with /review.",
      "url": "https://top-agent-skills.com/skill/code-review-plugin",
      "json": "https://top-agent-skills.com/skill/code-review-plugin.json"
    }
  ],
  "faqs": [
    {
      "question": "What is the difference between /code-review and /simplify?",
      "answer": "code-review hunts for correctness bugs and security issues. simplify focuses on reuse, deduplication, and altitude cleanups — quality without bug-hunting. Use code-review before merge; use simplify after the change works."
    },
    {
      "question": "Do code-review Skills replace senior engineers?",
      "answer": "No. They catch the mechanical issues — injection patterns, missing null checks, race conditions, N+1 queries — so human reviewers can focus on architecture, naming, and intent. Best teams run both."
    },
    {
      "question": "Can these Skills post inline PR comments?",
      "answer": "The official Claude Code code-review Skill supports --comment to post findings as inline GitHub PR comments via gh, and --fix to apply them to the working tree."
    },
    {
      "question": "Which model is best for code review?",
      "answer": "Opus 4.7+ is the default for high-effort reviews. Sonnet 4.6 is the cost-efficient choice for routine reviews. The ultra mode runs a multi-agent review in the cloud."
    },
    {
      "question": "Are review Skills cross-agent?",
      "answer": "The Anthropic Skills are deepest on Claude Code. Cursor and Codex have community-published equivalents; Gemini CLI compatibility varies. Filter by agent on the listing page to see verified support."
    }
  ],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "attribution": "Top Agent Skills (https://top-agent-skills.com)"
}