Best Claude skills for code review in 2026

Thorough code review — checks correctness, security, performance, readability, and test coverage. Gives actionable feedback ranked by severity.

Security audit and vulnerability assessment for any codebase. Scans for authentication bypasses, missing auth middleware, broken JWT validation (algorithm confusion, weak secrets, missing expiry), OAuth state and PKCE flaws, IDOR and horizontal privilege escalation.

Systematic code refactoring — extract functions, reduce complexity, eliminate duplication, improve naming, and split large files. Preserves behavior with tests.

Scan a codebase for security vulnerabilities — OWASP Top 10, secrets in code, dependency CVEs, auth flaws, injection risks, and misconfigurations. Fixes what it finds.

Review API design against REST best practices and internal consistency. Triggers: you need to review an API, audit REST endpoints, check API consistency, fix HTTP status codes, add pagination.

Architect-level story review with component reuse, domain consistency, data privacy, service architecture, and infrastructure checks. Design review before coding or implementation validation after.

Review or design REST/GraphQL APIs — checks naming, versioning, pagination, error handling, authentication, rate limiting, and consistency against industry standards.

Review database schema design, query patterns, and data access layer for correctness and performance. Triggers: you need to review a database schema, find missing indexes, detect N+1 queries, audit data types.

Design or review database schemas — checks normalization, indexes, constraints, naming, migrations, and query performance. Supports PostgreSQL, MySQL, SQLite, and MongoDB.

Review game code architecture for component coupling, ECS vs OOP design, update loop organization (deltaTime, fixed timestep, frame budget), state machine quality (boolean soup, string states), save/load serialization (versioning, migration, corruption handling).