Install command
Not provided
rulesSource-backedReview first Safety · Privacy ✓
Code Review Expert for Claude
Comprehensive code review rules for thorough analysis and constructive feedback
HarnessClaude Code
Review first — review before installing
Open the source and read safety notes before installing.
Citation facts
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
- Canonical URL
- https://heyclau.de/entry/rules/code-review-expert
- Source URLs
- https://google.github.io/eng-practices/review/reviewer/looking-for.html, https://github.com/JSONbored/awesome-claude/blob/main/content/rules/code-review-expert.mdx
- Privacy notes
- Code review reads source diffs that may contain secrets or proprietary code; keep credentials and sensitive snippets out of review comments and shared logs.
- Author
- JSONbored
- Claim status
- unclaimed
- Last verified
- 2025-09-16
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Required checks are still incomplete. Finish source and safety verification before adopting this resource.
Compare context
Selected
0
Current score
68
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
CompleteConfirm ownership and provenance before trusting install instructions.
- Done
Source link availableRequired
Open the canonical repository and verify ownership.
- Done
Source provenance statusRequired
Marked as source-backed.
- Done
Metadata reviewed
Registry metadata indicates a reviewed listing.
Safety and privacy checks
Required checks missingValidate risk disclosures before installation or API wiring.
- Pending
Safety notes presentRequired
No safety notes listed.
- Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
- Done
Trust level risk gateRequired
Trust level does not block evaluation.
Package and install checks
Needs reviewCheck package metadata and artifact integrity signals.
- Done
Install payload available
Install or copy payload is available for review.
- Pending
Package verification flag
No package verification flag provided.
- Pending
Checksum metadata
No checksum provided for downloaded artifact.
Compare-driven decision checks
Needs reviewUse compare context to validate trade-offs before adoption.
- Pending
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
- Pending
Baseline comparison available
No baseline peer selected yet.
- Pending
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy & paste
Copy-ready — paste the snippet to get started.
Config snippet
Not provided
Copy snippet
Provided
Prerequisites
None
Platforms
1 listed
Difficulty
3/100
Adoption plan
Balanced adoption plan
Current risk score 30/100. Use staged verification before broader rollout.
Adoption blockers
- Safety notes are missing.
Pre-adoption checks
Validate source and review signals before any execution.
- Done
Confirm source provenanceRequired
Source URL/provenance metadata is present.
- Done
Confirm metadata review state
Listing has review metadata.
- Done
Verify install payload
Install/config payload exists and can be inspected.
Security checks
Confirm safety, privacy, and package integrity signals.
- Pending
Review safety notesRequired
Safety notes missing; review source code paths before execution.
- Done
Review privacy notesRequired
Privacy notes are present.
- Pending
Verify package integrity metadata
No package verification/checksum metadata.
Rollout
Adopt in controlled steps based on the selected plan.
- Pending
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
- Pending
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
- Pending
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Evidence readiness matrix · balanced
Missing required evidence: Safety notes. Risk score 31.
Source provenance
PresentSource repository/provenance is listed.
Required in this preset
Metadata review
PresentReview metadata is present.
Required in this preset
Safety notes
MissingSafety notes are missing.
Required in this preset
Privacy notes
PresentPrivacy notes are present.
Optional in this preset
Package integrity
MissingPackage integrity metadata is missing.
Optional in this preset
Install payload
PresentInstall payload is available.
Required in this preset
Required gaps: Safety notes
Decision timeline
Decision timeline · balanced
Blocking gaps: Review safety notes. Risk 28.
triage
Confirm source provenanceRequired
Source/provenance metadata is available.
triage
Check metadata review statusRequired
Review metadata is available.
verify
Review safety notesRequired
Safety notes are missing.
verify
Review privacy notes
Privacy notes are available.
verify
Validate package integrity metadata
Package integrity metadata is missing.
rollout
Verify install payload and commandsRequired
Install payload is available.
Blockers: Review safety notes
Safety & privacy surface
Safety & privacy surface
1 privacy note across 1 risk area. Review closely: credentials & tokens.
- PrivacyCredentials & tokensCode review reads source diffs that may contain secrets or proprietary code; keep credentials and sensitive snippets out of review comments and shared logs.
Privacy notes
- Code review reads source diffs that may contain secrets or proprietary code; keep credentials and sensitive snippets out of review comments and shared logs.
Schema details
- Install type
- copy
- Reading time
- 1 min
- Difficulty score
- 3
- Troubleshooting
- Yes
- Breaking changes
- No
Skill and platform metadata
Retrieval sources
https://google.github.io/eng-practices/review/reviewer/looking-for.htmlhttps://google.github.io/eng-practices/review/reviewer/https://google.github.io/eng-practices/review/reviewer/standard.html
Full copyable content
You are a code review expert focused on providing comprehensive, constructive feedback. Your approach includes:
## Review Priorities
### 1. Security & Safety
- Identify potential security vulnerabilities
- Check for exposed credentials or sensitive data
- Review authentication and authorization logic
- Validate input sanitization and SQL injection prevention
### 2. Code Quality
- Check for adherence to coding standards
- Identify code smells and anti-patterns
- Review naming conventions and clarity
- Ensure proper error handling
### 3. Performance
- Identify performance bottlenecks
- Review algorithm complexity
- Check for memory leaks
- Optimize database queries
### 4. Maintainability
- Ensure code is well-documented
- Check for proper abstraction levels
- Review test coverage
- Validate modularity and reusability
## Review Process
1. **Initial Assessment**: Quick scan for critical issues
2. **Detailed Analysis**: Line-by-line review with context
3. **Constructive Feedback**: Provide specific, actionable suggestions
4. **Educational Moments**: Explain the 'why' behind recommendationsAbout this resource
You are a code review expert focused on providing comprehensive, constructive feedback. Your approach includes:
Review Priorities
1. Security & Safety
- Identify potential security vulnerabilities
- Check for exposed credentials or sensitive data
- Review authentication and authorization logic
- Validate input sanitization and SQL injection prevention
2. Code Quality
- Check for adherence to coding standards
- Identify code smells and anti-patterns
- Review naming conventions and clarity
- Ensure proper error handling
3. Performance
- Identify performance bottlenecks
- Review algorithm complexity
- Check for memory leaks
- Optimize database queries
4. Maintainability
- Ensure code is well-documented
- Check for proper abstraction levels
- Review test coverage
- Validate modularity and reusability
Review Process
- Initial Assessment: Quick scan for critical issues
- Detailed Analysis: Line-by-line review with context
- Constructive Feedback: Provide specific, actionable suggestions
- Educational Moments: Explain the 'why' behind recommendations
What a Reviewer Checks
The aspects below follow Google's Engineering Practices "What to look for in a code review" guide. Use them as a checklist when reviewing a change.
| Aspect | What to verify |
|---|---|
| Design | The change belongs in this codebase, and its pieces interact sensibly with the rest of the system. |
| Functionality | The code does what the author intended, and that intent is good for users (including future developers). |
| Complexity | Nothing is more complex than it needs to be at the line, function, or class level; no speculative over-engineering. |
| Tests | Correct, sensible, useful automated tests accompany the change and will actually fail when the code breaks. |
| Naming | Names are long enough to communicate intent, short enough to stay readable. |
| Comments | Comments explain why the code exists, not what it does; they are clear and necessary. |
| Style & Consistency | The code follows the language style guide and matches existing conventions in the codebase. |
| Documentation | Build, test, and behavior changes are reflected in READMEs, references, and other docs. |
| Every Line | Read the human-written code line by line rather than skimming; flag what you do not understand. |
| Context | Evaluate the change against the whole file and system, confirming it improves overall code health. |
| Good Things | Call out genuinely good practices, not just defects, so feedback stays balanced. |
Reviewer mindset: approve once the change definitely improves overall code health, even if it is not perfect. Reserve blocking only for issues that would degrade the codebase, and distinguish those from optional
Nit:suggestions.
Source citations
Add this badge to your README
Show that Code Review Expert for Claude is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/code-review-expert)How it compares
Code Review Expert for Claude side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
1 trust signal differ across this comparison (Submitter).
| Field | Comprehensive code review rules for thorough analysis and constructive feedback Open dossier | Source-backed rules for deciding when an AI-assisted code review must escalate high-risk changes to security, infrastructure, data, release, or domain owners before merge. Open dossier | Source-backed rules for reviewing AI-generated request handlers and forms before merge for cross-site request forgery risk, covering state-changing method discipline, anti-CSRF token correctness, SameSite cookie posture, origin and referer checks, and safe handling of cookie-based sessions. Open dossier | Source-backed rules for reviewing AI-generated database access code for SQL injection before merge, covering parameterized queries, identifier handling, ORM safety, dynamic query construction, least-privilege access, and privacy-safe test evidence. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed | ReviewedMaintainer reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| SubmitterDiffers | — | MkDev11 | jaso0n0818 | jaso0n0818 |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety · Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | rules | rules | rules | rules |
| Source | source-backed | source-backed | source-backed | source-backed |
| Author | JSONbored | MkDev11 | jaso0n0818 | jaso0n0818 |
| Added | 2025-09-16 | 2026-06-04 | 2026-06-22 | 2026-06-19 |
| Platforms | Claude Code | Claude Code | Claude Code | Claude Code |
| Source repo | — | — | — | — |
| Safety notes | — missing | ✓High-risk changes can alter auth, authorization, secrets, production data, network exposure, infrastructure, release automation, or dependency trust; escalate before merge instead of relying on a single reviewer. Treat AI-generated patches, summaries, migrations, policy edits, generated clients, and workflow changes as untrusted until the source diff and checks are reviewed. Require a rollback or disablement path for production-facing changes, especially when the blast radius includes customer data, credentials, deployments, billing, or public APIs. | ✓A missing CSRF defense lets a malicious page perform state-changing actions as a logged-in user — transferring funds, changing email or password, or deleting data — using the victim's ambient cookies. AI assistants often generate handlers that work in tests yet omit token validation or perform state changes on GET, because the happy path succeeds without any forged cross-site request. Relying on SameSite cookies alone is not sufficient: defaults vary, Lax still allows top-level GET navigations, and some clients or legacy browsers do not enforce it. | ✓SQL injection lets an attacker read, modify, or destroy data and sometimes execute commands, so a single concatenated query on user input can compromise the whole database. AI assistants often produce plausible queries that concatenate input or use a raw escape hatch on an otherwise safe ORM, which passes simple tests but is injectable. Running injection-style test inputs against a production database can corrupt or expose real data, so exercise them only in a sandbox with least-privilege credentials. |
| Privacy notes | ✓Code review reads source diffs that may contain secrets or proprietary code; keep credentials and sensitive snippets out of review comments and shared logs. | ✓Escalation notes can expose private incident context, customer identifiers, secrets, account IDs, internal topology, or vulnerability details if copied into public PR comments. Use private security channels for embargoed vulnerabilities, secrets, regulated data, and exploit details; keep public PR notes synthetic and minimally revealing. Do not paste raw logs, traces, prompts, database rows, screenshots, or security scan output into review notes unless they have been redacted. | ✓CSRF tokens are security credentials; do not paste real tokens, session cookies, or production request captures into public PR comments or issues. Use synthetic accounts and redacted requests when demonstrating a CSRF proof of concept, and avoid attaching real user identifiers. Be careful that anti-CSRF tokens are not written into URLs, analytics, or logs, where they can leak through referer headers or shared dashboards. | ✓Database code and its test cases can reference real schemas, credentials, connection strings, and personal data when copied from production examples. Do not paste real connection strings, credentials, or production query results into public PR comments; use synthetic schemas and data. Be careful with error messages that echo SQL or row data, since verbose database errors can leak schema and personal information. |
| Prerequisites | — none listed |
|
|
|
| Install | — | — | — | — |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Related guides
Source-backed guides for putting this to work.
Claude Code GitHub Actions Review Workflow
Automate PR review with Claude Code GitHub Actions using official setup steps.
Review firstSource-backedReview firstAdded 28d ago
Safety ✓ Privacy ✓by kiannidevSignals
Loading live community signals…
More like this, weekly
A short, calm digest of reviewed Claude resources. Unsubscribe any time.