Claude resources tagged “code-review”
43 curated Claude Code resources tagged code-review in the HeyClaude directory — mostly rules, guides, and tools. 1 of them sits in the trusted tier.
Highlights from this set
Standout entries tagged code-review, picked by their own metadata — trust tier, provenance, documentation, and recency.
All code-review resources
/pr-security-review - PR Security Review Command for Claude Code
Review a PR diff for auth, injection, secrets, and dependency security regressions before merge.
/review - Code Review Command for Claude Code
Comprehensive code review with security analysis, performance optimization, and best practices validation
Addy Osmani Agent Skills
Production-grade lifecycle skills, slash commands, agent personas, and checklists for Claude Code, Codex, Cursor, Gemini CLI, and other AI agents.
AI Code Review Security Agent - Agents
AI-powered code review specialist focusing on security vulnerabilities, OWASP Top 10, static analysis, secrets detection, and automated s...
AI-Generated CSRF Protection Review Rules
Review AI-generated endpoints and forms for CSRF: safe methods, anti-CSRF tokens, SameSite cookies, origin checks, and cookie-session exposure.
AI-Generated Frontend Accessibility Review Rules
Review AI-generated UI changes for semantic HTML, keyboard access, focus, labels, scan limits, manual checks, and privacy-safe evidence.
AI-Generated IDOR (Broken Object-Level Authorization) Review Rules
Review AI-generated endpoints for IDOR: object-level authorization on every request, scoped lookups instead of raw ID fetches, and consistent checks across CRUD and admin operations.
AI-Generated Insecure Deserialization Review Rules
Review AI-generated deserialization code: avoid native formats like pickle/yaml.load/Java Serializable on untrusted input, prefer JSON, and allowlist types or verify integrity when native formats are unavoidable.
AI-Generated Mass Assignment Review Rules
Review AI-generated request-to-model binding code for mass assignment: allowlist bindable fields, use DTOs that exclude sensitive properties, and don't trust a framework's default autobinding.
AI-Generated Open Redirect Review Rules
Review AI-generated redirects for open redirect risk: allowlist destinations, avoid raw user-supplied URLs, and prefer relative paths or an indexed mapping over echoing the input back.
AI-Generated OS Command Injection Review Rules
Review AI-generated shell/subprocess code for command injection: prefer library calls over shelling out, array-form exec APIs, allowlist validation, and least privilege.
AI-Generated Path Traversal Review Rules
Review AI-generated file-handling code for path traversal: canonical paths, root confinement, upload filename sanitization, and archive extraction limits.
AI-Generated Prototype Pollution Review Rules
Review AI-generated JS/TS merge, clone, and object-assignment code for prototype pollution: block proto and constructor-prototype keys, prefer Map/Set or Object.create(null) over mutable object literals.
AI-Generated Regex Safety Review Rules
Review AI-generated regex for ReDoS and catastrophic backtracking, input bounds, anchors, escaping, validation scope, safe engines, and test evidence.
AI-Generated SQL Injection Review Rules
Review AI-generated database code for SQL injection: parameterized queries, safe identifiers, ORM escapes, dynamic SQL limits, and least-privilege access.
AI-Generated SSRF Review Rules
Review AI-generated server-side URL requests for SSRF: URL allow-lists, internal-network blocking, redirect limits, and response isolation.
AI-Generated XSS (Cross-Site Scripting) Review Rules
Review AI-generated code for XSS: context-correct output encoding, unsafe DOM sinks like innerHTML, HTML sanitization, and CSP as a secondary layer.
Claude Code GitHub Actions Review Workflow
Automate PR review with Claude Code GitHub Actions using official setup steps.
Code Review Automation Capability Pack Skill
Run a local, repeatable PR review loop with severity scoring, false-positive control, and fix-ready output.
Code Review Expert for Claude
Comprehensive code review rules for thorough analysis and constructive feedback
Code Reviewer Agent - Agents
Expert code reviewer that provides thorough, constructive feedback on code quality, security, performance, and best practices
Event Sourcing Implementation Review Rules
Review event-sourcing code for immutable events, schema evolution safety, idempotent handlers, snapshot correctness, and event-store consistency.
Feature Flag Lifecycle Review Rules
Review feature flag changes for safe defaults, kill switches, targeting, staged rollout, stale-flag cleanup, and privacy-safe configuration.
GitHub Copilot
AI developer assistant across GitHub and editors.
Gitleaks
Open-source secret scanner for repositories and files.
Graphite Diamond
AI code review assistant inside Graphite workflows.
High-Risk Code Review Escalation Rules
Escalate high-risk code changes with clear triggers, owner signoff, fresh checks, rollback evidence, and privacy-safe review notes.
Large Generated Diff Detector - Claude Code Hook
Flag edits to generated/vendored files and oversized diffs so machine churn stays out of reviewable commits.
Open Source PR Security Review Agent
Review public OSS PRs for trust-boundary, CI, secrets, dependency, provenance, and code-security risks before maintainer approval.
PAL MCP Server
Let Claude Code, Codex, Gemini CLI, Cursor, and other clients consult multiple models and CLI subagents through PAL MCP.
Production Database Migration Safety Rules
Review production database migrations with lock-risk checks, staged rollout, backfill controls, rollback limits, and privacy-safe evidence.
Review AI-Generated Code Before Merge
Review AI-generated pull requests with repeatable security, test, and evidence checks.
Roam Code
Let Claude query a local code graph before and after code changes.
Security Guidance Plugin Before Merge
Enable the security-guidance plugin to catch risky edits before merge.
Semgrep
Static analysis, SAST, secrets, dependency checks, and custom code rules.
Structured Logging Review Rules
Review logging changes for structured events, consistent levels, correlation IDs, actionable messages, volume control, and no secrets or personal data.
Superpowers Skills
Coding-agent skills framework for planning, TDD, debugging, subagents, code review, worktrees, branch finishing, and cross-harness workflows.
Test Double Misuse Review Rules
Review test doubles for over-mocking, under-mocking, mock drift, and missing contract tests for faked dependencies to keep tests meaningful and reliable.
Third-Party API Resilience Review Rules
Review remote API calls for timeouts, bounded retries with backoff and jitter, idempotency, circuit breakers, rate-limit handling, and safe failure logging.
TypeScript API Client Compatibility Review Rules
Review TypeScript API client changes for exported type surfaces, inferred router contracts, validators, downstream compile evidence, and safe rollout.
Signal coverage
How these 43 resources score on the trust and safety signals HeyClaude reviews — counted from this set, not the directory as a whole.
A short, calm digest of reviewed Claude resources. Unsubscribe any time.