# Code Review Web

Review web application code for bugs, security issues, performance problems, and...

- Repository: https://github.com/rampstackco/claude-skills (1014 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-27
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add rampstackco/claude-skills --skill code-review-web -g -a claude-code -y`
Codex: `npx skills add rampstackco/claude-skills --skill code-review-web -g -a codex -y`
Cursor: `npx skills add rampstackco/claude-skills --skill code-review-web -g -a cursor -y`
Gemini CLI: `npx skills add rampstackco/claude-skills --skill code-review-web -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add rampstackco/claude-skills`

## Description

Review web application code for bugs, security issues, performance problems, and stack-specific anti-patterns. Use this skill whenever the user wants to review code, debug a production issue, investigate a build failure, audit security, or check a PR before merging. Triggers on code review, review my code, debug, build error, broken, not working, why is X failing, check this code, security check, PR review, audit code, refactor. Also triggers when investigating 4xx or 5xx errors, deploy failures, environment variable issues, and CMS integration problems.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Code Review for Web

Review and debug web application code with a focus on the patterns that actually break production. Stack-agnostic principles in SKILL.md. Stack-specific patterns in references.

---

## When to use

- Reviewing a pull request before merging
- Debugging a production issue
- Investigating a build failure
- Auditing security or performance of existing code
- Investigating environment variable or configuration issues
- Triaging a "the site is broken" report

## When NOT to use

- Writing a new feature spec (use `pm-spec-writing`)
- Pre-launch QA against the running site (use `qa-testing`)
- Performance deep-dive on Core Web Vitals (use `performance-optimization`)
- Deep accessibility compliance review (use `accessibility-audit`)

---

## Required inputs

- The code, PR, error message, or symptom under review
- Access to logs (build logs, function logs, server logs) if debugging
- The stack (framework, hosting, database) - even at high level

If just a symptom is provided ("the site is broken"), the workflow's first step is gathering enough context to investigate.

---

## The framework: 5 review dimensions

Every code review covers five dimensions. Pick the depth based on the situation.

### 1. Correctness

Does the code do what it claims to do?

- Logic matches the intent stated in the spec or PR description
- Edge cases handled (empty states, error states, network failures)
- Off-by-one errors, null/undefined handling, async race conditions
- Tests exist for the change, or there's a reason they don't
- The change does not break existing functionality (regression risk)

### 2. Security

Does the code expose anything sensitive or open an attack surface?

The rest: https://github.com/rampstackco/claude-skills/blob/HEAD/dist/codex/.agents/skills/code-review-web/SKILL.md