code-review-pro SKILL.md skillA
code-review-pro from onewave-ai/claude-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add onewave-ai/claude-skills/code-review-pro@git:20260923.537406aPins git:20260923.537406a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- onewave-ai/claude-skills
- Path
code-review-pro/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260923.537406a, committed Sep 23, 2026
- First version recorded
- Oct 22, 2025
- Size
- 4,705 bytes
- Repository stars
- 421
- License
- MIT
Performs a deep code review of files, modules, a diff, or a branch - finding security vulnerabilities (mapped to OWASP Top 10:2025), correctness bugs, performance problems, and maintainability issues - and returns severity-ranked findings with evidence and concrete fixes. Use when the user asks to review, audit, or sanity-check code, asks "is this safe", "what's wrong with this", "find bugs", or wants a security or performance pass before shipping. For posting line comments on a GitHub pull…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Code Review Pro Find the problems that matter, prove each one, and show the fix. A short list of real issues beats a long list of maybes. ## Workflow 1. **Set the scope.** Decide what is under review: a pasted snippet, specific files, the working-tree diff (`git diff`, `git diff --staged`), or a branch against its base (`git diff main...HEAD`). For a diff, review the changed lines but read enough surrounding code to know how they are called. 2. **Learn the context before judging.** Identify language, framework and version (check `package.json`, `pyproject.toml`, `go.mod`, and so on), how the code is reached (HTTP handler, job, CLI, library), what input is untrusted, and any repo conventions (linters, `CLAUDE.md`, existing patterns). A pattern that is a bug in one framework can be safe in another; for example, React escapes JSX text, so XSS lives in `dangerouslySetInnerHTML`, `href` values, and raw HTML sinks. 3. **Review in priority order**, using [references/checklist.md](references/checklist.md): 1. Security 2. Correctness and edge cases 3. Performance 4. Maintainability and conventions …
Read the whole file at its exact version.
How to install
mdr add onewave-ai/claude-skills/code-review-pro@sha256:3fc021fd2c4ae9e1The line at the top of this page pins the label git:20260923.537406a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_dt3zmpktx26unllp)
7 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Oct 22, 2025 and Sep 23, 2026, about one every 168 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260923.537406a latest | 2026-09-23 | 537406a | 4,705 B | A | view · diff |
| git:20260608.d82d20f | 2026-06-08 | d82d20f | 5,142 B | A | view · diff |
| git:20251022.14b7f5b | 2025-10-22 | 14b7f5b | 5,188 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (4705 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
onewave-ai/claude-skills · 421 stars · license MIT · pushed 2026-10-20 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_dt3zmpktx26unllp GET https://markdownregistry.com/api/v1/resolve?ref=onewave-ai/claude-skills/code-review-pro GET https://markdownregistry.com/api/v1/blob/3fc021fd2c4ae9e143f34c0ff4d9cced16cfa386663b30a7b287f4ade2991f8f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.