The Best Code Review Skills for Claude Code

Code review is not one job. Finding bugs, finding vulnerabilities, finding unnecessary code, and understanding a diff are four different skills — and the best ones specialize.

The review cluster is unusually well-differentiated. Most categories have four variants of the same thing; this one has four genuinely different lenses on the same diff.

The skills worth installing

code-reviewer — 9.4 · Developer Tools

Analyzes diffs and files for bugs, security vulnerabilities, and correctness issues. The generalist, and the one to install first if you only install one.

sureforge — 9.4 · Documents

A quality-control workflow for complex, multi-step tasks: research, plan, verify, and check the result before declaring done. Less a reviewer than a process — but it addresses the failure mode that review alone cannot catch, which is an agent confidently finishing work it never verified.

replica-diff — 9.2 · Developer Tools

Compares an app clone against the original with a feature-parity score. A specialized diff tool for the replication use case; the output is a coverage map rather than a list of comments.

security-reviewer — 9.0 · Developer Tools

The security lens specifically: vulnerabilities with severity and remediation. Use it in addition to code-reviewer when the change touches auth, input handling, or anything that reaches a network.

ponytail-review — 9.0 · Developer Tools

Review focused exclusively on over-engineering — what to delete, simplify, or avoid building. Rare and valuable: almost every other review skill only adds findings.

understand-diff — 8.7 · Developer Tools

Comprehends a diff or pull request rather than judging it. Useful before review, and in codebases you did not write.

Four lenses, one diff

The useful way to read this list is as four questions:

• Is it correct and safe? → code-reviewer, optionally + security-reviewer
• Is it too much? → ponytail-review
• Did the agent actually finish? → sureforge
• What changed? → understand-diff

Most teams run only the first. That is why agent-generated code tends to accumulate complexity and why "done" so often means "compiled".

How to choose

• One skill? code-reviewer.
• Agent-generated code? Add ponytail-review and sureforge.
• Security-sensitive change? Add security-reviewer.
• Unfamiliar diff? understand-diff first.

The developer tools category covers the adjacent testing and architecture skills.