Menu
Full code review for large or security-sensitive changes. Gathers requirements first, loads all relevant language references, runs the linter where applicable, applies the full review checklist with security as the top priority.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Computes the optimal Claude usage-window ping schedule from work hours and creates or reconciles the scheduled cloud routines that pin the window boundaries.
Reviews changes to prose files (markdown, text, blog posts, docs). Focuses on voice, grammar, factual claims, dead links, and structure. Loads the project's voice or style guide when one exists. Skips linter and Actions hash verification.
Reviews infrastructure changes: GitHub Actions workflows, Terraform, Dockerfiles, docker-compose, IaC. Focuses on supply-chain pinning, secret handling, least-privilege permissions, action versions, and CI failure modes. Always verifies action hash pins when present.
Abbreviated code review for small or low-stakes code changes. Skips requirements gathering. Skips the linter in PR mode (CI runs it). Focuses on correctness against obvious intent, readability, and pattern consistency. For large or security-sensitive diffs, use code-review-deep instead.
Orchestrator. Triages a PR, local diff, patch file, or staged/branch changes into one of four review types (content, code-lite, code-deep, infra) and dispatches to the matching child skill. Use this when you don't already know which depth or type of review you want. For a known type, invoke the child skill directly.
Produces a one-shot devil's-advocate critique of a plan, design, or decision: steel-manned strengths first, then severity-tagged findings each with a concrete alternative, then a verdict.
| name | code-review-deep |
| description | Full code review for large or security-sensitive changes. Gathers requirements first, loads all relevant language references, runs the linter where applicable, applies the full review checklist with security as the top priority. |
| when_to_use | Use for code reviews on large diffs (500+ lines) or any change touching security-sensitive paths (auth, crypto, sql, migration, secret, token, .env). Invoked directly with a PR URL or diff file path, or dispatched by `/code-review`. Follow all steps in order; do not shortcut based on this description. |
| argument-hint | [PR URL | path to diff file] [--source=...] [--pr=<URL>] [--file=<path>] [--requirements=<text>] [--lint] |
| effort | xhigh |
| allowed-tools | Bash(git *) Bash(gh *) Bash(composer *) Bash(npm *) Bash(make *) Read Grep |
Read ~/.claude/skills/code-review/references/review-shared.md and follow its source detection and diff fetching sections. If --source and the corresponding identifier args were passed, use those and skip any prompting.
If --requirements=... was passed, use that text as the requirements. Otherwise ask:
"Do you have specific requirements I should keep in mind? (e.g. a ticket description, acceptance criteria, or expected behaviour)"
Wait for the response. If declined, proceed without requirements but note in the final output that correctness was assessed against inferred intent only.
Skip the linter when source mode is pr and --lint was not passed (CI runs the linter on the PR).
Otherwise run the linter per the linter detection section of the shared doc.
If any changed path matches \.(js|jsx|ts|tsx|mjs|cjs)$, read ~/.claude/skills/code-review/references/js-security.md.
If the diff contains any line matching ^\+\s*uses:\s+\S+@[0-9a-f]{40}, run the verification per the shared doc.
Read ~/.claude/skills/code-review/references/review-checklist.md and apply every principle.
Priorities in order:
Apply the common review rules from the shared doc (review only changed lines, surface project-wide patterns separately, never run tests, never run auto-fixers).
Format per the output section of ~/.claude/skills/code-review/references/review-shared.md.
