code-review
mattpocock/skills · Agent Skill
Automatically checks code changes for standards and spec compliance, comparing them against a specified fixed point.
Jump to install ↓Overview
| Publisher | |
|---|---|
| Repository | mattpocock/skills ↗ |
| Skill folder | code-review |
| Stars | 256,360 |
| Bundled files | 1 |
| License | MIT |
| Last updated | August 18, 2026 |
| Links | Skill source ↗ · Repository ↗ |
Mozgi check
What we found in the skill files. Details come with a subscription.
Installation
A skill is a folder with a SKILL.md file. Pick your agent and run the commands in a terminal (macOS, Linux or Git Bash on Windows) from your project root.
Copy the prompt into Claude, Codex or another assistant: it will review the skill and install it for you.
Install the “code-review” skill from mozgi.io (https://mozgi.io/skills/code-review/) for me. 1. Download the archive: https://mozgi.io/skills/code-review/download If it fails, take the skill folder from the source: https://github.com/mattpocock/skills/tree/main/skills/engineering/code-review 2. Read SKILL.md and the other files. Check the skill is safe: no hidden commands, no sending data elsewhere, no scripts doing something other than described. If anything looks suspicious, stop and tell me. 3. Put the “code-review” folder into your agent's skills folder: .claude/skills/ for Claude Code, .agents/skills/ for Codex, .cursor/skills/ for Cursor, .gemini/skills/ for Gemini CLI. Inside the project if we are in one, otherwise in the home folder (~/.claude/skills/ etc.). 4. Make sure <skills folder>/code-review/SKILL.md exists. 5. Briefly tell me what this skill does and offer to try it on my task. If you cannot do a step yourself, tell me what to click or type.
git clone --depth 1 --branch main https://github.com/mattpocock/skills.git /tmp/skills mkdir -p .claude/skills cp -r /tmp/skills/skills/engineering/code-review .claude/skills/code-review
Restart Claude Code — the skill appears in the list; call it manually with /code-review. For all projects use ~/.claude/skills.
git clone --depth 1 --branch main https://github.com/mattpocock/skills.git /tmp/skills mkdir -p .agents/skills cp -r /tmp/skills/skills/engineering/code-review .agents/skills/code-review
Codex looks for skills in .agents/skills from the current folder up to the repo root; call one with /skills or $code-review. For all projects use ~/.agents/skills.
git clone --depth 1 --branch main https://github.com/mattpocock/skills.git /tmp/skills mkdir -p .cursor/skills cp -r /tmp/skills/skills/engineering/code-review .cursor/skills/code-review
Cursor picks the skill up on start; call it with “/” in Agent chat. Cursor also reads .claude/skills and .agents/skills. For all projects use ~/.cursor/skills.
git clone --depth 1 --branch main https://github.com/mattpocock/skills.git /tmp/skills mkdir -p .gemini/skills cp -r /tmp/skills/skills/engineering/code-review .gemini/skills/code-review
Gemini CLI offers to activate the skill when a task matches — you approve it. For all projects use ~/.gemini/skills.
Read SKILL.md and any companion files before deciding whether to install. Click a file to preview it.
SKILL.md contents
Original author text · read-onlyTwo-axis review of the diff between HEAD and a fixed point the user supplies:
- Standards: does the code conform to this repo's documented coding standards?
- Spec: does the code faithfully implement the originating issue / spec?
Both axes run as parallel sub-agents so they don't pollute each other's context, then this skill aggregates their findings.
The issue tracker should have been provided to you. If docs/agents/issue-tracker.md is missing, tell the user to run /setup-matt-pocock-skills.
Process
1. Pin the fixed point
Whatever the user said is the fixed point (a commit SHA, branch name, tag, main, HEAD~5, etc.). If they didn't specify one, ask for it.
Capture the diff command once: git diff <fixed-point>...HEAD (three-dot, so the comparison is against the merge-base). Also note the list of commits via git log <fixed-point>..HEAD --oneline.
Before going further, confirm the fixed point resolves (git rev-parse <fixed-point>) and the diff is non-empty. A bad ref or empty diff should fail here, not inside two parallel sub-agents.
2. Identify the spec source
Look for the originating spec, in this order:
1. Issue references in the commit messages (#123, Closes #45, GitLab !67, etc.), fetched via the workflow in docs/agents/issue-tracker.md.
2. A path the user passed as an argument.
3. A spec file under docs/, specs/, or .scratch/ matching the branch name or feature.
4. If nothing is found, ask the user where the spec is. If they say there isn't one, the Spec sub-agent will skip and report "no spec available".
3. Identify the standards sources
Anything in the repo that documents how code should be written, such as CODING_STANDARDS.md or CONTRIBUTING.md.
On top of whatever the repo documents, the Standards axis always carries the smell baseline below: a fixed set of Fowler code smells (_Refactoring_, ch.3) that applies even when a repo documents nothing. Two rules bind it:
- The repo overrides. A documented repo standard always wins; where it endorses something the baseline would flag, suppress the smell.
- Always a judgement call. Each smell is a labelled heuristic ("possible Feature Envy"), never a hard violation. Like any standard here, skip anything tooling already enforces.
Each smell reads *what it is* → *how to fix*; match it against the diff:
- Mysterious Name: a function, variable, or type whose name doesn't reveal what it does or holds. → rename it; if no honest name comes, the design's murky.
- Duplicated Code: the same logic shape appears in more than one hunk or file in the change. → extract the shared shape, call it from both.
- Feature Envy: a method that reaches into another object's data more than its own. → move the method onto the data it envies.
- Data Clumps: the same few fields or params keep travelling together (a type wanting to be born). → bundle them into one type, pass that.
- Primitive Obsession: a primitive or string standing in for a domain concept that deserves its own type. → give the concept its own small type.
- Repeated Switches: the same
switch/if-cascade on the same type recurs across the change. → replace with polymorphism, or one map both sites share. - Shotgun Surgery: one logical change forces scattered edits across many files in the diff. → gather what changes together into one module.
- Divergent Change: one file or module is edited for several unrelated reasons. → split so each module changes for one reason.
- Speculative Generality: abstraction, parameters, or hooks added for needs the spec doesn't have. → delete it; inline back until a real need shows.
- Message Chains: long
a.b().c().d()navigation the caller shouldn't depend on. → hide the walk behind one method on the first object. - Middle Man: a class or function that mostly just delegates onward. → cut it, call the real target direct.
- Refused Bequest: a subclass or implementer that ignores or overrides most of what it inherits. → drop the inheritance, use composition.
4. Spawn both sub-agents in parallel
Standards sub-agent prompt should include:
- The full diff command and commit list.
- The list of standards-source files you found in step 3, plus the smell baseline from step 3 pasted in full (the sub-agent has no other access to it).
- The brief: "Report, per file/hunk where relevant, (a) every place the diff violates a documented standard: cite the standard (file + the rule); and (b) any baseline smell you spot: name it and quote the hunk. Distinguish hard violations from judgement calls: documented-standard breaches can be hard, but baseline smells are always judgement calls, and a documented repo standard overrides the baseline. Skip anything tooling enforces. Under 400 words."
Spec sub-agent prompt should include:
- The diff command and commit list.
- The path or fetched contents of the spec.
- The brief: "Report: (a) requirements the spec asked for that are missing or partial; (b) behaviour in the diff that wasn't asked for (scope creep); (c) requirements that look implemented but where the implementation looks wrong. Quote the spec line for each finding. Under 400 words."
If the spec is missing, skip the Spec sub-agent and note this in the final report.
5. Aggregate
Present the two reports under ## Standards and ## Spec headings, verbatim or lightly cleaned. Do not merge or rerank findings, because the two axes are deliberately separate (see _Why two axes_).
End with a one-line summary: total findings per axis, and the worst issue _within each axis_ (if any). Don't pick a single winner across axes: that's the reranking the separation exists to prevent.
Why two axes
A change can pass one axis and fail the other:
- Code that follows every standard but implements the wrong thing → Standards pass, Spec fail.
- Code that does exactly what the issue asked but breaks the project's conventions → Spec pass, Standards fail.
Reporting them separately stops one axis from masking the other.
Frequently asked questions
What does the code-review skill do?
Automatically checks code changes for standards and spec compliance, comparing them against a specified fixed point.
How do I install code-review?
Open the “Installation” block on this page and pick your agent — Claude Code, Codex, Cursor or Gemini CLI — for ready-made commands that copy the skill folder to the right place. Or copy the prompt from the “Via assistant” tab and let the assistant review and install the skill.
Which AI models work with code-review?
Skills are plain Markdown instructions (the Agent Skills format), so code-review works with any agent that reads SKILL.md: Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode and more. The model loads the instructions only when a task matches the skill's description.
Is code-review free?
The skill is published openly by mattpocock under the MIT license. The skill itself costs nothing — you only pay your AI provider for the tokens you use.
Is it safe to install skills?
A skill is a set of instructions your agent will follow, so read SKILL.md and its companion files before installing. Scripts in the skill folder only run if your agent runs them — keep an eye on what it does and do not grant unnecessary permissions.
How is a skill different from an MCP server or a plugin?
An MCP server or plugin gives the model new tools — code that runs and returns a result. A skill gives it knowledge and process: how to approach a task, which steps to follow and what good output looks like. It needs no server or API key.