# Claude Code for Code Review: Best Plugins & Skills (2026) > The best Claude Code plugins and skills for code review: the official code-review plugin, security-guidance, and how to set up an in-editor review workflow. Source: https://designrevision.com/blog/claude-code-code-review --- Using Claude Code for code review means catching bugs, security holes, and style drift before they reach a pull request — and the best code review Claude Code plugins make that a one-command setup. Anthropic ships first-party plugins that run parallel review agents and scan diffs for vulnerabilities, and you can layer your own review skills on top. This guide covers the plugins and skills worth using and how to wire them into a review workflow. *Last updated: July 2026.* ## Key Takeaways > If you remember nothing else: > > * The official **`code-review`** plugin runs parallel agents to catch bugs and edge cases — `/plugin install code-review@claude-plugins-official` > * **`security-guidance`** scans diffs for vulnerabilities and **ships enabled by default** > * **`pr-review-toolkit`** adds pull-request review workflows > * A custom **skill** encodes your team's checklist and house style on top of the plugins > * Together they cover **correctness, security, and PR review** inside the editor ## Table of Contents 1. [Why Code Review in Claude Code](#why-code-review-in-claude-code) 2. [The code-review Plugin](#the-code-review-plugin) 3. [security-guidance & pr-review-toolkit](#security-guidance--pr-review-toolkit) 4. [Skills for Code Review](#skills-for-code-review) 5. [Setting Up a Review Workflow](#setting-up-a-review-workflow) 6. [Conclusion](#conclusion) ## Why Code Review in Claude Code Reviewing inside the editor closes the loop between writing code and checking it. Instead of waiting for CI or a human reviewer to flag a problem, Claude reviews the change while the context is fresh — and because it can run several review passes in parallel, it surfaces issues a single read might miss. The result is fewer bugs and security holes reaching your pull request. The building blocks are a few first-party [Claude Code plugins](/blog/claude-code-plugins), plus optional review skills. There is a second, subtler benefit: reviewing Claude's *own* output. AI-generated code is fast but not infallible — it can introduce subtle logic errors, insecure patterns, or inconsistencies with the rest of your codebase. Running a dedicated review pass over what Claude just wrote catches those before they land, turning "the AI wrote it" into "the AI wrote it and a second pass checked it." That self-review loop is where in-editor review earns its keep, and it is exactly what the plugins below automate. ## The code-review Plugin Anthropic's official `code-review` plugin is the centerpiece. It runs **parallel agents** over a change set, each looking for a different class of problem — logic bugs, missed edge cases, unclear naming, style inconsistencies — then reports back before you commit. Install it with: ```text /plugin install code-review@claude-plugins-official ``` Then ask Claude to review your staged diff or a specific file. It is the fastest way to add a rigorous second read without leaving the editor. ## security-guidance & pr-review-toolkit Two more first-party plugins round out review: - **`security-guidance`** — reviews diffs for injection, XSS, SSRF, exposed secrets, IDOR, and auth-bypass patterns. It **ships enabled by default**, so you may already have it; the right move is to leave it on. `/plugin install security-guidance@claude-plugins-official` - **`pr-review-toolkit`** — adds pull-request-oriented review, from change summaries to line-level feedback, for teams that review at the PR level. Both live in Anthropic's official marketplace, [`anthropics/claude-plugins-official`](https://github.com/anthropics/claude-plugins-official); see the [official Claude Code plugins](/blog/official-claude-code-plugins) list for the full first-party set. ## Skills for Code Review Plugins do the heavy lifting; a **skill** makes review yours. Encode your team's review checklist, naming conventions, or house style in a `SKILL.md`, and Claude applies it every time it reviews — so the feedback matches how *your* team reviews, not a generic standard. This is where the skills and plugins hubs meet: the plugins provide the engine, a custom skill provides the standards. Browse the tested [best Claude Code skills](/blog/best-claude-code-skills) for review-adjacent options, and see [Claude Code skills](/blog/claude-code-skills) for how to write your own. ## Setting Up a Review Workflow A sensible default review stack takes two minutes: 1. Install `code-review@claude-plugins-official`. 2. Confirm `security-guidance` is enabled (it usually is by default). 3. Optionally add a review skill with your team's checklist. 4. Run `/reload-plugins`, then ask Claude to review staged changes before each commit. For the full install-and-manage walkthrough, see [how to install Claude Code plugins](/blog/how-to-install-claude-code-plugins), and for the whole shortlist, the tested [best Claude Code plugins](/blog/best-claude-code-plugins). ## Conclusion Claude Code makes in-editor code review a one-command setup: the official `code-review` plugin for correctness, `security-guidance` for vulnerabilities, `pr-review-toolkit` for PRs, and a custom skill for your team's standards. Install the two official plugins, add your checklist as a skill, and review every change before it ships. --- ## Related Resources - [Claude Code Plugins: The Complete Guide](/blog/claude-code-plugins) - [Best Claude Code Plugins (2026): Tested & Ranked](/blog/best-claude-code-plugins) - [Official Claude Code Plugins: The Complete List](/blog/official-claude-code-plugins) - [Claude Code Skills: The Complete Guide](/blog/claude-code-skills) - [Best Claude Code Skills (2026): Tested & Ranked](/blog/best-claude-code-skills)