Comprehensive code review covering security, correctness, bash compatibility, test coverage, and code quality. Use for PRs, commits, or any code changes.
61
72%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./.claude/skills/code-review/SKILL.mdQuality
Discovery
67%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
The description adequately communicates its purpose as a code review skill and includes an explicit 'Use for...' clause, which is good for completeness. However, it lists review categories rather than concrete actions, and the inclusion of 'bash compatibility' alongside general code review concerns creates an unclear scope. The trigger terms cover common cases but miss several natural variations users might employ.
Suggestions
Replace category labels with concrete actions, e.g., 'Identifies security vulnerabilities, checks logic correctness, verifies test coverage, and flags code quality issues' instead of just listing categories.
Expand trigger terms to include common variations like 'pull request', 'diff', 'review my code', 'MR', 'merge request', or 'code feedback'.
Clarify the 'bash compatibility' aspect — either remove it if the skill is general-purpose, or explain it more clearly to avoid confusion about the skill's scope.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (code review) and lists several areas of focus (security, correctness, bash compatibility, test coverage, code quality), but these are categories rather than concrete actions. It doesn't specify what actions are performed, like 'identifies vulnerabilities', 'checks for race conditions', or 'suggests test cases'. | 2 / 3 |
Completeness | Clearly answers both 'what' (comprehensive code review covering security, correctness, bash compatibility, test coverage, and code quality) and 'when' ('Use for PRs, commits, or any code changes'). The 'Use for...' clause serves as an explicit trigger guidance. | 3 / 3 |
Trigger Term Quality | Includes some natural keywords like 'code review', 'PRs', 'commits', and 'code changes' that users would say. However, it misses common variations like 'pull request', 'diff', 'review my code', 'code quality check', or 'security audit'. 'Bash compatibility' is a surprisingly narrow trigger term for a general code review skill. | 2 / 3 |
Distinctiveness Conflict Risk | While 'code review' is a recognizable niche, the broad scope covering security, correctness, and code quality could overlap with dedicated security analysis skills, linting skills, or test coverage tools. The mention of 'bash compatibility' adds some distinctiveness but is oddly specific for an otherwise general description. | 2 / 3 |
Total | 9 / 12 Passed |
Implementation
77%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This is a highly actionable and well-structured code review skill tailored for a security-critical restricted shell interpreter. Its greatest strengths are the concrete, executable guidance across all review dimensions, the clear severity classification system, and the thorough PR submission workflow with API calls. The main weakness is its length — at ~300 lines with no progressive disclosure to supporting files, it consumes significant context window for every invocation, though the security-critical domain justifies much of the detail.
Suggestions
Consider splitting the PR Review Submission section (steps 0-3 with emoji reactions) into a separate referenced file, as it's a mechanical workflow distinct from the review logic itself.
The Pentest Checklist and Finding Severity sections could be extracted into referenced files (e.g., PENTEST_VECTORS.md, SEVERITY_GUIDE.md) to reduce the main skill's token footprint while keeping them accessible.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is comprehensive and most content earns its place given the security-critical domain, but there's some verbosity — the pentest checklist table, the full severity badge markdown definitions, and the detailed PR submission workflow with emoji reactions add bulk. Some sections (e.g., explaining what each Go test type covers) could be tightened. However, the domain complexity justifies much of the length. | 2 / 3 |
Actionability | Highly actionable throughout — concrete bash commands for determining scope (gh pr diff, git diff), specific code patterns to look for (os.Open, os.Stat), exact API calls for PR submission with full JSON payloads, specific test vector tables, and a clear coverage table template. The review output format is copy-paste ready with badge markdown. | 3 / 3 |
Workflow Clarity | The workflow is clearly sequenced: determine scope → read code → review across 6 dimensions → produce findings with severity → submit review. Each dimension has explicit checklists. The PR submission section includes validation logic (self-review check, finding-based event selection) and error recovery (retry on invalid line position). The test coverage section has a 4-step sub-workflow with explicit inventory → check → check → summarize structure. | 3 / 3 |
Progressive Disclosure | The content is well-organized with clear headers and logical sections, but it's a monolithic ~300-line document with no references to external files. The pentest checklist, PR submission workflow, and detailed review dimensions could be split into separate referenced files. For a skill this complex, the single-file approach creates a large context load. However, no bundle files exist, so there's nothing to split into — but the content would benefit from it. | 2 / 3 |
Total | 10 / 12 Passed |
Validation
90%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 10 / 11 Passed
Validation for skill structure
| Criteria | Description | Result |
|---|---|---|
frontmatter_unknown_keys | Unknown frontmatter key(s) found; consider removing or moving to metadata | Warning |
Total | 10 / 11 Passed | |
00bdc03
Table of Contents
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.