Code review in passes, on every PR.
The cr-* skills review a pull request’s diff and the files it directly affects, one pass at a time, and report only what they are confident is a real problem. React and Next.js, Node.js, Python, fullstack, and any other language.
Comment /cr-react on a PR. Reply /fix to apply a finding.
/enpitech:cr-react- 1PASS 1 · BUGS
- 2PASS 2 · SECURITY
- 3PASS 3 · COMPONENT ARCHITECTURE
- 4PASS 4 · HOOKS & STATE MANAGEMENT
- 5PASS 5 · PERFORMANCE
- 6PASS 6 · CODE QUALITY (React)
- 7PASS 7 · INTENT CHECK
- REPORT ONLYCRITICALWARNINGat 8/10 confidence or higher
The React and Next.js review, pass by pass, then the filter every finding has to clear.
Agents write more code than people can read.
In How the Claude Code team does code review, Anthropic describes the answer it reached: layered review, where machines do most of the reading and people keep the risky calls. It reports that from June to September, merged pull requests to the Claude Code codebase more than doubled while the share that had to be reverted fell by more than 40 percent.
AI-Tools is not affiliated with or endorsed by Anthropic. The mapping is ours.
- ONLY REAL ISSUES GET POSTED
Every review reports only CRITICAL and WARNING findings at 8/10 confidence or higher. Style preferences, naming opinions and minor suggestions are dropped.
- FINDINGS CARRY A SEVERITY
Each finding is tagged [CRITICAL] or [WARNING] and says why the reviewer is confident it is real.
- EVERY FINDING GETS AN ANSWER
Each finding is its own comment with a suggested change, so it can be answered on its own: a
/fixreply applies it. - PEOPLE KEEP THE RISKY CALLS
The workflow comments, and changes code only on an explicit reply. Nothing in it approves or merges a pull request.
Seven passes, or five, in order.
Each review skill reads its criteria file and runs every pass over the diff, then expands one level to the files that import what changed, to catch breakage from interface changes.
/enpitech:cr-react7 PASSES- 1BUGSNull access, race conditions, wrong conditionals
- 2SECURITYXSS, exposed secrets, unauthenticated Server Actions
- 3COMPONENT ARCHITECTUREGod components, prop drilling, cross-feature imports
- 4HOOKS & STATE MANAGEMENTDerived state in useEffect, stale closures, missing cleanup
- 5PERFORMANCESequential awaits, missing dynamic imports, barrel imports
- 6CODE QUALITY (React)Array mutation, missing error boundaries, duplicated logic
- 7INTENT CHECKUnrelated changes that snuck into the diff
Adjusts to React Compiler (no memoization findings), Next.js (Server Action and RSC rules) and design systems such as Radix or shadcn.
The right passes per layer, then the seams
It detects each layer of the stack, React on the front and Python on the back for example, and runs that layer’s passes. Then seven checks cover what no single-language review can see.
- API contract validation
- Shared type drift
- Environment variable hygiene
- Authentication flow
- Error contract
- Data flow security
- API versioning and deprecation
Strict about what it reports.
A review is only useful if people read it. These rules come from the criteria files and apply to every review skill.
Two severities
CRITICAL means it will break in production. WARNING means a likely bug or security risk. Nothing below that is reported.
8/10 confidence or higher
Every finding has to clear the threshold, and each one says why the reviewer is confident it is real.
No style, no praise
Style preferences, naming opinions and minor suggestions are left out, and so is anything clearly intentional in its context.
Aware of your setup
With React Compiler installed it skips memoization findings. Next.js turns on the Server Action and RSC rules.
Review in the thread, fix with a reply.
The repository ships a GitHub Actions workflow. By default a review starts from a comment, so nothing runs on a pull request until someone asks. Running it on every new pull request is one commented-out trigger away.
- 1
Comment a trigger
A collaborator comments
/cr-react,/cr-node,/cr-python,/cr-general,/cr-fullstackor/cr-depson the pull request. - 2
A summary comment
Findings counted by severity and listed with file and line references.
- 3
One reply per finding
The issue, why it is real, and the suggested change as a code block.
- 4
Reply to fix
/fixon a finding applies that one fix./fix-allon the summary applies all of them, CRITICAL first. A separate job commits and pushes to the PR branch.
- Runs only for the repository’s owners, members and collaborators.
- Review jobs refuse pull requests from forks and check out the exact commit that passed the gate.
- Treats PR text, commits and code as data, never as instructions.
- Autofix applies only the fixes the review suggested, and only on an explicit reply.
/cr-reactTo fix all issues below, reply with /fix-all
To fix this issue, reply with /fix
/fixA simplified recreation of a cr-react review on a pull request, drawn from the comment formats in the toolkit. Placeholder bars stand in for counts, paths and finding text.
Before you push, your choice.
Run /enpitech:cr-node or any other review in your terminal. After the findings, it asks what to do next.
- 1
Create findings file
Saves every finding to a Markdown file in the project root, such as cr-react-findings.md.
- 2
Fix step by step
Shows each finding with its proposed change and asks before applying it.
- 3
Fix all
Applies every suggested fix, CRITICAL first, then lists what changed.
The same criteria, on every file.
Each review has an audit twin: cra-react, cra-node, cra-python, cra-general and cra-fullstack. Useful before a refactor, when the question is the system rather than a diff.
| PREFIX | SCOPE | WHERE | DEPENDENCY AUDIT |
|---|---|---|---|
cr- | The PR diff and the files it directly affects | CI and local | No |
cra- | The whole codebase, plus system-level checks | Local only | Yes, all six passes |
The React audit adds checks a diff cannot catch:
- Dead exports
- Circular dependencies
- Duplicated patterns
- Architecture drift
- Inconsistent state patterns
- Missing error boundaries
- Bundle size hotspots
The dependency audit also runs on its own as cr-deps: vulnerabilities, outdated packages, deprecations, licenses, unused dependencies and lockfile integrity, for npm, yarn, pnpm, pip, poetry, uv and pipenv.
Three commands in Claude Code.
The toolkit ships as a Claude Code plugin. The same skills install into other agents with the skills CLI.
Claude Code plugin
- 01 · ADD THE MARKETPLACE
/plugin marketplace add enpitech/ai-tools - 02 · INSTALL THE PLUGIN
/plugin install enpitech@enpitech - 03 · ACTIVATE THE SKILLS
/reload-plugins
Skills then run as /enpitech:<skill-name>, for example /enpitech:cr-react.
Cursor, Copilot and other agents
Install the skills with the skills CLI. The review criteria are plain Markdown, so any agent that reads files can follow them.
npx skills add enpitech/ai-tools -g -yGitHub Actions
- Copy claude-code-review.yml into
.github/workflows/. Plugins do not install workflow files. - Add
ANTHROPIC_API_KEYto the repository’s Actions secrets. - Comment
/cr-reactor/cr-briefon a pull request.
One toolkit, one install.
Every skill below comes with the same plugin.
Your next review is one comment away.
Free and open source under the MIT license. Read the criteria, change a threshold, send a pull request.
/plugin marketplace add enpitech/ai-toolsReady to shift?
We accelerate Frontend delivery. The Frontend Delivery Factory installs the system that lets everyone in your org ship production Frontend.
Senior engineers, AI-native by default, shipping production code in your repo. Fast onboarding. Honest work.
- 01
You send the form.
A few lines on your product and timeline.
- 02
We reply within a day.
Usually faster. No forms after that.
- 03
We meet and plan.
Scope, team fit, start date. Then engineers.