Morgan Linton's rust-review skill, from the BeautifulRust repository, reviews existing Rust code, from a single file to a crate or pull request. It runs the usual tools first when it can, then looks at idiomatic style, public interfaces, how errors are handled, unsafe code and long-term upkeep, most important first. The report sorts findings into must fix, should fix and consider, each naming the guideline involved and a concrete fix.
Review pull requests using Sentry's engineering checklistSentry's code-review skill gives an agent the checklist Sentry engineers use on pull requests. It covers runtime errors, performance traps such as N+1 queries, side effects, backward compatibility and security holes, then asks whether the design fits the existing architecture and whether tests cover the real requirements. It says which kinds of change, like schema or API contract changes, should go to a senior engineer, and how to word feedback politely and usefully.Coding agentSentryCode review
Review code before mergingThis skill reviews a diff or pull request for correctness, readability, architecture, speed, and security. It works for code from a person or an agent, and also checks change size and the change description before the code is merged.Coding agentCode ReviewQuality
Caveman ReviewReviews code with Caveman evidence-first standards—tight diffs, proofs, no fluff.Coding agent
Run a multi-phase security audit with independently checked findingsCloudflare's security audit skill helps a coding agent find vulnerabilities that cross a real trust boundary and report them with source evidence, a safe way to reproduce, a priority and the smallest fix. By default it only gives guidance for focused questions; a full audit runs only when you ask for one explicitly. A full run goes through six phases: reconnaissance, hunting waves by separate agents, validation of each candidate by a fresh verifier, schema-checked findings in JSON, an independent re-check of every record, and a final report. It must either finish with validated output or record that the run is incomplete and why.Coding agentApplication securityCode audit
Static XSS audit for React, TypeScript and JavaScript codesongjianyang's xss-audit skill reviews a React, TypeScript or JavaScript codebase for cross-site scripting without changing any code. It works through 14 layers of checks, including HTML and attribute sinks, URLs, script-embedded JSON, SVG and MathML, markdown pipelines, sanitiser bypasses and Trusted Types, and follows the data path behind every risky-looking hit. Findings go into an xss-audit-report.md file, and the skill notes that static review alone cannot catch every case.Coding agentSecurityFrontend
Code review (Matt Pocock)Reviews changes since a fixed git point along Standards and Correctness axes for real-engineering rigor.Coding agent
