Kipt

Code quality skill: Addy Osmani's five-axis code review for agents

Addy Osmani's code-review-and-quality is a code quality skill that reviews each change on five axes with severity labels. What it does and how to install it.

By the Kipt team · Updated 24 October 2026

Source: addyosmani/agent-skills · Maintainer: community: Addy Osmani · License: MIT · Checked: 24 October 2026

What is the code-review-and-quality skill?

code-review-and-quality is a code quality skill that makes a coding agent review every change on five axes (correctness, readability, architecture, security and performance) and label each finding by severity before the change merges. It works on code written by the agent itself, another agent or a person.

It belongs to addyosmani/agent-skills, Addy Osmani's pack of 25 skills that map to a development lifecycle of spec, plan, build, test, review and ship. The README says the skills draw on Google's engineering culture, including Google's engineering practices guide, and lists "change sizing and review speed norms in code review" among them.

The skill's description reads: "Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch. Use when asked to review a diff or a pull request, even when the diff is pasted inline."

As of 24 October 2026, its skills.sh page listed 71.7K installs (snapshot, 24 October 2026).

What does it do?

The skill is model-invoked, so the agent can load it when you ask for a review, paste a diff, or finish a feature. Its approval standard is direct: "Approve a change when it definitely improves overall code health, even if it isn't perfect."

The SKILL.md is one file with these parts:

  • The five axes. Each has a list of questions. Correctness asks about edge cases, error paths and whether tests test the right thing. Readability asks "Could this be done in fewer lines?" Architecture asks whether a refactor reduces complexity or just relocates it. Security and performance hand off to the repo's security-and-hardening and performance-optimization skills for depth.
  • Structural remedies. When it flags a problem, it proposes a named move, such as replacing a chain of conditionals with a typed model or deleting a pass-through wrapper.
  • Change sizing. About 100 changed lines is good, about 300 is acceptable for one logical change, and about 1,000 is too large and should be split. It lists four ways to split (stack, by file group, horizontal, vertical) and says refactoring and feature work belong in separate changes.
  • A five-step process. Understand the intent, review the tests first, walk the implementation axis by axis, label findings, then check the author's verification story.
  • Severity labels, shown below.
  • Extras. A multi-model review pattern, dead code hygiene (list it and ask before deleting), review speed norms, a rule set for disagreements, dependency discipline for both new packages and upgrades, a fill-in review checklist, and tables of common rationalizations and red flags.
Label Meaning Author action
(no prefix) Required change Must address before merge
Critical: Blocks merge Security vulnerability, data loss, broken functionality
Nit: Minor, optional Author may ignore
Optional: / Consider: Suggestion Worth considering, not required
FYI Informational No action needed

One step goes beyond reading. To test whether tests would catch a regression, the skill tells the agent to "Answer the last question by experiment, not by reading": invert one condition the change adds, run the suite, then restore the file. A mutation that stays green means a missing test case.

What's in the folder: only SKILL.md. Its "See also" section points to ../../references/security-checklist.md and ../../references/performance-checklist.md, two of seven checklists in the repo's shared references/ folder.

How do you install it?

Just this skill. The command on skills.sh, using the skills CLI:

npx skills add https://github.com/addyosmani/agent-skills --skill code-review-and-quality

Add -g for all projects. The folder lands in .claude/skills/code-review-and-quality/, or ~/.claude/skills/code-review-and-quality/ with -g, the standard Claude Code skill locations. The README warns that a per-skill install "copies only skills/<name>/, not the repo-level references/ directory," so the two checklist links break. Copy those files into a references/ folder inside the installed skill, or use the plugin.

The whole pack as a Claude Code plugin. From the README:

/plugin marketplace add addyosmani/agent-skills
/plugin install agent-skills@addy-agent-skills

This adds all 25 skills, the shared checklists, the repo's agent personas (including code-reviewer) and nine slash commands. The /review command invokes this skill and asks for findings with file and line references. Because Claude Code has a built-in /review, the README says to use the namespaced form, /agent-skills:review. If the marketplace add fails over SSH, the README gives an HTTPS fallback: /plugin marketplace add https://github.com/addyosmani/agent-skills.git.

Codex. The README gives codex plugin marketplace add addyosmani/agent-skills, then codex plugin add agent-skills@agent-skills (Codex CLI v0.122 or later), and @code-review-and-quality in chat. Codex and Cursor read the same SKILL.md format; see Codex skills and Cursor skills.

claude.ai. Zip the folder and upload it under Customize, then Skills, per the Claude Help Center.

How do you use it?

Hand it a diff, a branch or a PR plus the spec or task it should implement. The skill starts by asking what the change is meant to do, so context up front saves a round.

Example prompts (suggestions, not quotes from the repo):

  • Review my staged changes against the task in docs/tasks/042.md. Label every finding.
  • Another agent wrote this PR. Review it on all five axes and lead with anything Critical.
  • This diff is about 900 lines. Suggest how to split it before you review it.
  • Review this dependency bump: read the changelog for each package and check the lockfile diff.
  • Here's a diff pasted inline. Do a code quality review and check whether the tests would catch a regression.

Requirements: no packages or keys. The mutation check needs your project's test command, and the dependency checks use npm audit or your stack's equivalent.

How does it compare with other review options?

code-review-and-quality Claude Code /code-review Matt Pocock's code-review
What it is Written review standard (SKILL.md) Bundled Claude Code skill Agent Skill
Focus Five axes, sizing, severity, dependencies Correctness bugs, plus cleanups depending on model and effort Two axes: repo standards and the spec
Target Whatever you hand it Current diff, or a PR, branch or path Diff since a fixed point you name
Extras Mutation check, dead code, review speed norms Effort levels, --fix, --comment, cloud ultra Runs both axes in parallel sub-agents

The Claude Code commands reference documents /code-review and notes /review is now its alias. See Claude Code review for the built-in options.

Tips and limits

  • Fit the sizes to your team. The 100, 300 and 1,000 line marks are targets from the skill, not rules your repo has to adopt.
  • It's long. The SKILL.md is about 21 KB, so it uses more context than a short review prompt.
  • Labels need a reader. Severity labels help most when the agent or person fixing the code follows them; pair it with the receiving code review skill on the fixing side.
  • Security audit. On 24 October 2026 its skills.sh page showed Gen Agent Trust Hub: Pass, Socket: Pass, Snyk: Warn. The skill ships no scripts; the mutation check and npm audit run through your agent's shell under your permission settings.

The repo is MIT licensed, so you can copy and edit the skill if you keep the copyright notice.

Save it in your Kipt library

In Kipt, open Skills and paste the skill's GitHub folder link into the import box; for a repo with many skills, it shows a list to pick from. To fix the checklist links, download the folder, add security-checklist.md and performance-checklist.md in a references/ folder, and drop the folder or a .zip into the import box instead. Your skills live in your own private GitHub repo and install into Claude Code or Codex with one command:

npx skills add https://github.com/<you>/<repo>.git --all -g

Kipt is not affiliated with Addy Osmani or addyosmani/agent-skills.

Similar skills

Questions

What is the code-review-and-quality skill?

It is an Agent Skill in Addy Osmani's addyosmani/agent-skills repo that has a coding agent review a change on five axes: correctness, readability, architecture, security and performance. It labels each finding by severity, checks change size, and asks for a verification story before approval.

How do I install the code quality skill in Claude Code?

Run npx skills add https://github.com/addyosmani/agent-skills --skill code-review-and-quality, the command on its skills.sh page. To get the whole pack with its /review command and code-reviewer agent, run /plugin marketplace add addyosmani/agent-skills and then /plugin install agent-skills@addy-agent-skills.

How is it different from Claude Code's built-in /code-review?

Claude Code's /code-review is a bundled skill that checks the current diff, a PR, branch or path for correctness bugs, with effort levels and flags such as --fix and --comment. code-review-and-quality is a written review standard covering five axes, change sizing, severity labels, dependency upgrades and dead code. They can be used together.

What severity labels does the skill use?

No prefix means a required change. Critical blocks the merge, Nit is minor and optional, Optional or Consider is a suggestion, and FYI is informational. The skill says this stops authors from treating every comment as mandatory.

Does installing just this skill lose anything?

Yes, a little. The README says a per-skill install copies only skills/<name>/, not the repo-level references/ folder, so the skill's links to security-checklist.md and performance-checklist.md won't resolve. Use the plugin, clone the repo, or copy those checklists into a references/ folder inside the installed skill.

More in Skill directory

All guides

Keep your prompts and skills in one place, in your own GitHub. Install every skill with one command.

Get started

Kipt is an independent product, not affiliated with or endorsed by Anthropic, OpenAI, Cursor or GitHub. Claude, ChatGPT, Codex, Cursor and GitHub are trademarks of their owners.