--- title: Top Code Quality & Review Skills slug: code-quality-review type: primary-category canonical: https://top-agent-skills.com/top-skills-for-code-quality-review skills: 19 rubric: 1.0 updated: 2026-07-28 --- # Top Code Quality & Review Skills **superpowers** is the top-ranked code review Skill at 61/100: Structured multi-step development. Brainstorm → spec → plan → build → review → merge — TDD baked in. Structured reviews, refactoring, simplification passes, and TDD-driven workflows. 19 Skills indexed, ranked by a published composite score (https://top-agent-skills.com/about/methodology). Content last changed 2026-07-28. ## The ranking ### 1. superpowers — score 61/100 (community) Structured multi-step development. Brainstorm → spec → plan → build → review → merge — TDD baked in. - Best for: Long-running engineering tasks where you want each phase to handoff cleanly. - Not ideal for: Quick one-shot tasks — the orchestration overhead is not worth it. - Publisher: obra · MIT - Verified on: claude-code, cursor, codex ```bash npx skills add obra/superpowers ``` Full entry: https://top-agent-skills.com/skill/superpowers (https://top-agent-skills.com/skill/superpowers.md) ### 2. semgrep — score 52/100 (verified-org) Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns. - Best for: Pattern-based vulnerability scanning across a polyglot codebase, and writing custom YAML rules to enforce a house convention the linter cannot express. - Not ideal for: Teams that need a permissive licence. This ships under the Semgrep Rules License v1.0, not MIT or Apache — read it before vendoring the rules into a commercial product. - Publisher: Semgrep · Semgrep Rules License v1.0 - Verified on: claude-code ```bash npx skills add semgrep/skills ``` Full entry: https://top-agent-skills.com/skill/semgrep-scan (https://top-agent-skills.com/skill/semgrep-scan.md) ### 3. code-security — score 52/100 (verified-org) A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration. - Best for: Secure-code review with real depth behind each finding: the skill ships separate references for SQL injection, XSS, SSRF, XXE, CSRF, secrets, regex DoS, memory safety, Docker, Kubernetes, and Terraform on AWS and GCP. - Not ideal for: Running an actual scan — this is guidance, not a scanner. Pair it with the semgrep skill when you need findings rather than review standards. - Publisher: Semgrep · Semgrep Rules License v1.0 - Verified on: claude-code ```bash npx skills add semgrep/skills ``` Full entry: https://top-agent-skills.com/skill/semgrep-code-security (https://top-agent-skills.com/skill/semgrep-code-security.md) ### 4. debug — score 51/100 (official-anthropic) Disciplined debugging loop. Reproduce, isolate, diagnose, fix. - Best for: When behavior diverges from expected and the cause is not obvious from a quick read. - Publisher: Anthropic · MIT - Verified on: claude-code, cursor, codex, antigravity ```bash claude plugin install engineering ``` Full entry: https://top-agent-skills.com/skill/debug (https://top-agent-skills.com/skill/debug.md) ### 5. tech-debt — score 51/100 (official-anthropic) Honest tech-debt audit with a prioritized cleanup backlog. - Best for: Quarterly planning, post-incident review, or any moment the team agrees something has to give. - Publisher: Anthropic · MIT - Verified on: claude-code, cursor, codex, antigravity ```bash claude plugin install engineering ``` Full entry: https://top-agent-skills.com/skill/tech-debt (https://top-agent-skills.com/skill/tech-debt.md) ### 6. simplify — score 50/100 (official-anthropic) Review for reuse, quality, efficiency. Catches over-abstraction and dead code before merge. Full entry: https://top-agent-skills.com/skill/simplify (https://top-agent-skills.com/skill/simplify.md) ### 7. vercel-web-design-guidelines — score 49/100 (verified-org) 100+ accessibility and UX rules from Vercel, applied as a structural audit on your UI code. Full entry: https://top-agent-skills.com/skill/vercel-web-design-guidelines (https://top-agent-skills.com/skill/vercel-web-design-guidelines.md) ### 8. vercel-react-best-practices — score 49/100 (verified-org) 57 React/Next.js performance rules, applied as a structural review on your code. Full entry: https://top-agent-skills.com/skill/vercel-react-best-practices (https://top-agent-skills.com/skill/vercel-react-best-practices.md) ### 9. trail-of-bits — score 49/100 (verified-org) Security audits run by a real security firm. CodeQL + Semgrep + audit workflows. Full entry: https://top-agent-skills.com/skill/trail-of-bits (https://top-agent-skills.com/skill/trail-of-bits.md) ### 10. prisma-orm — score 49/100 (verified-org) Prisma migrations and queries by the book. Index-aware, migration-safe, type-correct. Full entry: https://top-agent-skills.com/skill/prisma-orm (https://top-agent-skills.com/skill/prisma-orm.md) ### 11. next-js-app-router — score 49/100 (verified-org) Next.js App Router by the book. Server components, streaming, parallel routes. Full entry: https://top-agent-skills.com/skill/next-js-app-router (https://top-agent-skills.com/skill/next-js-app-router.md) ### 12. code-review-security — score 49/100 (verified-org) OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary. Full entry: https://top-agent-skills.com/skill/owasp-security-skills (https://top-agent-skills.com/skill/owasp-security-skills.md) ### 13. sentry-error-handling — score 48/100 (verified-org) Sentry the right way. Source maps, releases, breadcrumbs, performance, structured tags. Full entry: https://top-agent-skills.com/skill/sentry-error-handling (https://top-agent-skills.com/skill/sentry-error-handling.md) ### 14. security-review — score 48/100 (official-anthropic) Pre-merge security sweep on the current branch's diff. Full entry: https://top-agent-skills.com/skill/security-review (https://top-agent-skills.com/skill/security-review.md) ### 15. code-review — score 48/100 (official-anthropic) The canonical Anthropic code review. Effort levels from quick to ultra. Full entry: https://top-agent-skills.com/skill/code-review-builtin (https://top-agent-skills.com/skill/code-review-builtin.md) ### 16. review — score 48/100 (official-anthropic) PR review with inline GitHub comments via gh. Full entry: https://top-agent-skills.com/skill/review-pr (https://top-agent-skills.com/skill/review-pr.md) ### 17. composition-patterns — score 47/100 (verified-org) Boolean prop hell → compound components. Cleaner React component APIs by construction. Full entry: https://top-agent-skills.com/skill/composition-patterns (https://top-agent-skills.com/skill/composition-patterns.md) ### 18. tdd-skill — score 46/100 (community) TDD with red/green/refactor as a concrete TypeScript walkthrough. Full entry: https://top-agent-skills.com/skill/tdd-skill (https://top-agent-skills.com/skill/tdd-skill.md) ### 19. code-review-plugin — score 45/100 (official-anthropic) Structured PR reviews with severity-tagged findings — bugs, security, perf, style. Full entry: https://top-agent-skills.com/skill/code-review-plugin (https://top-agent-skills.com/skill/code-review-plugin.md) ## About this category The best agent skills for code quality and review in 2026 are Claude Code's built-in code-review and simplify Skills — code-review runs the structured security-and-correctness pass a senior engineer makes on a PR, while simplify catches reuse and altitude problems that accumulate in working code. Code quality and review Skills turn an AI agent from a code writer into a disciplined code reviewer. They encode the structured pass — security, correctness, performance, simplification — that senior engineers run on a PR, and apply it consistently every time. The Anthropic-authored code-review and simplify Skills are the canonical examples; both ship inside Claude Code and replicate the rubric the Claude Code team uses internally. The workflows are familiar. Reviewing an uncommitted diff before opening a PR. Catching N+1 queries and missing edge cases in a feature branch. Running a simplification pass on a refactor that grew too clever. Producing PR comments inline, or applying the fixes directly to the working tree. Test-driven workflows: drafting tests first, watching them fail, then implementing. Skills here also cover the meta-level — choosing between Claude Opus and Claude Sonnet for review, running multi-agent ultrareviews, and writing the review-bot persona for a specific repo's house style. Engineering managers, staff engineers, and any team paying for code review at scale use these. We rank by composite score; provenance (Anthropic, well-known engineering orgs) and install count dominate, with documentation depth and cross-agent compatibility as tiebreakers. Skills that integrate with gh pr and post comments score higher for production use than read-only reviewers. ## Common questions **What is the difference between /code-review and /simplify?** code-review hunts for correctness bugs and security issues. simplify focuses on reuse, deduplication, and altitude cleanups — quality without bug-hunting. Use code-review before merge; use simplify after the change works. **Do code-review Skills replace senior engineers?** No. They catch the mechanical issues — injection patterns, missing null checks, race conditions, N+1 queries — so human reviewers can focus on architecture, naming, and intent. Best teams run both. **Can these Skills post inline PR comments?** The official Claude Code code-review Skill supports --comment to post findings as inline GitHub PR comments via gh, and --fix to apply them to the working tree. **Which model is best for code review?** Opus 4.7+ is the default for high-effort reviews. Sonnet 4.6 is the cost-efficient choice for routine reviews. The ultra mode runs a multi-agent review in the cloud. **Are review Skills cross-agent?** The Anthropic Skills are deepest on Claude Code. Cursor and Codex have community-published equivalents; Gemini CLI compatibility varies. Filter by agent on the listing page to see verified support. --- _Top Agent Skills. Machine-readable twin of https://top-agent-skills.com/top-skills-for-code-quality-review._ _JSON: https://top-agent-skills.com/top-skills-for-code-quality-review.json · whole catalog: https://top-agent-skills.com/skills.json (CC BY 4.0)_