# 9 Best Claude Skills for Code Review

> Choose Claude skills for security, correctness, maintainability, and focused pull request review without relying on one vague review prompt.

The best Claude code-review setup is a small review pipeline, not a single giant prompt. Start with dependency-audit and least-privilege-auditor for risk, add coverage-gap-finder for behavioral confidence, then invoke specialist skills such as auth-flow-reviewer or bundle-analyzer only when the diff touches those areas.

The best Claude skills for code review divide the job into explicit checks. A dependency review needs vulnerability evidence; a permissions review needs a map of principals and actions; a test review needs changed branches and failure modes. One prompt that says “review this PR” tends to blur all three.

Use the following shortlist as a menu. Install the checks your repository actually needs, and invoke specialist skills only when the diff enters their domain.

| Skill | Best for | Main output | Read-only by default? |
| --- | --- | --- | --- |
| [dependency-audit](/skills/security/dependency-audit) | Package changes and known vulnerabilities | Prioritized upgrade plan | Yes |
| [least-privilege-auditor](/skills/security/least-privilege-auditor) | IAM, CI, cloud roles, and tokens | Excess-permission findings | Yes |
| [auth-flow-reviewer](/skills/security/auth-flow-reviewer) | Login, sessions, authorization | Trust-boundary review | Yes |
| [coverage-gap-finder](/skills/testing/coverage-gap-finder) | Untested changed behavior | Ranked coverage gaps | Yes |
| [secret-scanner](/skills/security/secret-scanner) | Credentials in code or history | Secret findings and response steps | Yes |
| [license-compliance-checker](/skills/security/license-compliance-checker) | Dependency license policy | Compatibility exceptions | Yes |
| [dead-code-finder](/skills/refactor/dead-code-finder) | Obsolete exports and paths | Evidence-backed removal candidates | Yes |
| [bundle-analyzer](/skills/performance/bundle-analyzer) | Front-end dependency impact | Ranked size reductions | Yes |
| [skill-auditor](/skills/workflow/skill-auditor) | Reviewing SKILL.md contributions | Structure and safety findings | Yes |

## 1. dependency-audit: review third-party risk

[dependency-audit](/skills/security/dependency-audit) turns lockfile or manifest changes into a prioritized report. It separates reachable, exploitable risk from noisy advisories and identifies the smallest safe upgrade path. Use it whenever a pull request adds, removes, or upgrades packages.

## 2. least-privilege-auditor: inspect permissions

[least-privilege-auditor](/skills/security/least-privilege-auditor) is the default reviewer for IAM policies, GitHub Actions permissions, cloud roles, service accounts, Kubernetes RBAC, and token scopes. It traces who can do what against which resource, then distinguishes necessary access from wildcard or inherited access that the change does not justify.

It reports evidence before proposing a narrower policy, which makes it useful even when the reviewer cannot safely edit deployment configuration.

## 3. auth-flow-reviewer: follow identity through the system

[auth-flow-reviewer](/skills/security/auth-flow-reviewer) reviews authentication and authorization as a complete flow: credential entry, session creation, identity propagation, access checks, refresh, logout, and recovery. Invoke it when a diff touches middleware, cookies, JWT validation, account linking, password reset, or permission checks.

## 4. coverage-gap-finder: find untested behavior

[coverage-gap-finder](/skills/testing/coverage-gap-finder) connects coverage data to important code paths. It ranks missing tests by business and failure risk rather than treating every uncovered line equally. This is the right review companion when a PR changes branching logic, error handling, retries, or state transitions.

## 5. secret-scanner: stop credential leaks

[secret-scanner](/skills/security/secret-scanner) checks tracked files and relevant history for credentials and high-entropy tokens. A good finding includes the location, likely credential type, confidence, and containment steps. Treat a confirmed secret as an incident: revoke or rotate it before merely deleting the string.

## 6. license-compliance-checker: catch policy conflicts

[license-compliance-checker](/skills/security/license-compliance-checker) inventories dependency licenses and compares them with the project's distribution model and policy. It is especially useful for commercial products, redistributed binaries, and repositories with approved-license lists.

## 7. dead-code-finder: prove code is unused

[dead-code-finder](/skills/refactor/dead-code-finder) looks for unused exports, unreachable branches, stale feature paths, and obsolete files. Its value in review is evidence: references, runtime registration, generated entry points, and framework conventions must be checked before deletion is recommended.

## 8. bundle-analyzer: quantify front-end cost

[bundle-analyzer](/skills/performance/bundle-analyzer) belongs on reviews that add UI packages, client components, polyfills, editors, charts, or large utility libraries. It measures the built artifact, identifies duplication and eager loading, and ranks changes by expected byte savings.

## 9. skill-auditor: review Claude skills themselves

[skill-auditor](/skills/workflow/skill-auditor) checks new or modified `SKILL.md` files for trigger clarity, unsafe permissions, ambiguous instructions, and missing output contracts. Use it when the pull request changes the AI workflow layer rather than application code.

## A practical review stack

For a normal application PR, start with `dependency-audit`, `least-privilege-auditor`, and `coverage-gap-finder`. Add one domain specialist based on the files changed. A login change gets `auth-flow-reviewer`; a client dependency gets `bundle-analyzer`; a Claude customization gets `skill-auditor`.

Install the core stack at project scope:

```bash
npx agentscamp add skills/dependency-audit
npx agentscamp add skills/least-privilege-auditor
npx agentscamp add skills/coverage-gap-finder
```

Keep review and remediation separate. First ask Claude to produce findings with file references, impact, confidence, and a verification step. Then approve only the fixes whose behavior you understand.

---

_Source: https://agentscamp.com/guides/skills/best-claude-skills-for-code-review — Guide on AgentsCamp._