Use This SkillFor a security review of a change, install differential-review (trailofbits/skills). For answering a review someone left on your pull request, install receiving-code-review (obra/superpowers). For bugs, systematic-debugging (obra/superpowers) makes Claude show its investigation in order. Each was run three times without and three times with the skill on one brief, and each changed the result in a way you can count.
Which code review and debugging skills have been run side by side?
Three skills with published proofs review code or debug it. In each proof, Claude Opus 5.5 did one fixed brief three times without the skill and three times with it. All six pages of every proof are on the skill's page.
| Skill | Source | Brief | Proof date | Scan (Nov 2) |
|---|---|---|---|---|
| differential-review | trailofbits/skills | Security review of a six-line "impersonate users" route in Express | Nov 1, 2026 | Clear |
| receiving-code-review | obra/superpowers | Decide what to do with six review comments on a caching pull request | Nov 1, 2026 | Clear |
| systematic-debugging | obra/superpowers | Diagnose a 1-in-200 TypeError that began after a session cache was added | Oct 19, 2026 | Review (see below) |
None of the three proofs was commissioned by a skill author, and none of these skills is sold on this site.
What did differential-review change?
All six runs found the same main flaw (the route trusts a role cookie the browser controls), rated it critical and said not to merge. The skill changed what came around that finding.
| What was measured (3 runs each) | Without | With |
|---|---|---|
| Findings listed | 7, 8 and 7 | 5, 7 and 6 |
| CWE numbers on the findings | 3 of 3 | 0 of 3 |
| A test coverage section ("no tests ship with the commit") | 0 of 3 | 3 of 3 |
| A blast radius section | 0 of 3 | 3 of 3 |
| Says no git history was supplied, so regressions could not be checked | 0 of 3 | 3 of 3 |
| States a confidence level | 0 of 3 | 3 of 3 |
| Median input tokens | 352 | 14,053 |
| Median output tokens | 19,158 | 21,928 |
| Median time per run | 156.6 s | 182.7 s |
Counts from a script run on the six published pages on November 3, 2026 (visible text, styles and scripts removed). Tokens and time from data/proofs.json.
The skill's SKILL.md lists "Honest: Explicitly state coverage limits and confidence level" among its core principles and says missing tests mean an elevated risk rating. That is what showed up: every run with the skill said what it could not check from a diff alone, and one put it as "Confidence: HIGH for the analyzed diff ... MEDIUM overall, because surrounding context and history were not available." The runs without it listed slightly more findings and tagged them with CWE numbers, which is useful if your team tracks them. The skill's own description says it writes a markdown report; the brief asked for HTML, and all three runs followed the brief.
What did receiving-code-review change?
The brief gave six comments: a 24-hour cache that is too long, a request to switch to Redis, a rename, a request to rewrite the module in TypeScript, a cache key that ignores currency, and "Add a test." All six runs treated the currency key as the blocking bug.
| What was measured (3 runs each) | Without | With |
|---|---|---|
| Comments held for an answer before any change | 0, 0 and 0 | 3, 2 and 3 |
| Switches to Redis in this pull request | 3 of 3 | 0 of 3 |
| Commits to a TypeScript follow-up ticket | 3 of 3 | 0 of 3 |
| A "thanks" or "good catch" line to the reviewer | 3 of 3 | 0 of 3 |
| Median input tokens | 380 | 2,813 |
| Median output tokens | 13,088 | 15,494 |
| Median time per run | 108 s | 134.3 s |
Read from the six published pages on November 3, 2026. Tokens and time from data/proofs.json.
Without the skill, Claude accepted every comment except the TypeScript rewrite, built Redis into the plan and opened a follow-up for the migration. With it, Claude asked first whether Redis already runs in each environment and how stale a price may be, and declined the rewrite for this pull request. That follows the SKILL.md, which says to "ASK for clarification on unclear items" before implementing anything and lists "Great point!" under "Forbidden Responses" as performative agreement. If you want a reply that agrees and moves fast, the runs without the skill did that well; if you want Claude to check a reviewer's premise before building on it, use the skill.
What did systematic-debugging change?
The brief described the bug (a 500 on POST /orders, req.user undefined, a new 30-second session cache) but gave no code or logs. So every page in both columns made up its own evidence, such as log lines and failure counts, and the six runs did not settle on one root cause: they included an expiry race across an await, a cache with two writers that stored different object shapes, and a shared session object changed in place. Read these pages for method, not for the answer.
| What was measured (3 runs each) | Without | With |
|---|---|---|
| Steps labeled by investigation phase (read the error, reproduce, recent changes, trace back, compare, hypothesis) | 0 of 3 | 3 of 3 |
| Median words on the page | 1,733 | 1,767 |
| Token and time data | not recorded | not recorded |
Read from the six published pages on November 3, 2026. Token and time data is recorded only for proofs run from October 23, so this October 19 proof has none.
The skill's rule is "NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST", followed by four phases. With it, each page walked through those phases in order before naming a cause. Without it, the pages were also careful (all three described reproducing the failure before changing code) but did not follow a fixed sequence. The visible difference is structure, not a better answer.
Which one should I install?
- You review changes for security, or review other people's pull requests: differential-review. Expect more input tokens because its reference files load with it.
- You get reviews and want Claude to check them before acting: receiving-code-review. It is small (2,813 input tokens with the skill in this proof), and its description limits it to handling review feedback.
- You want Claude to investigate before it patches: systematic-debugging.
Other code review and debugging skills in the directory have no proof yet, so they are not ranked here. All were Clear in the November 2 scan: requesting-code-review (obra/superpowers), mattpocock-code-review and diagnosing-bugs (mattpocock/skills), debugging-with-evidence (Grit-77/done-is-a-claim) and parallel-debugging (wshobson/agents). The Testing category list has all 236 skills in that category, proven ones first, and every proof on the site is on proven skills.
How were the proofs run and measured?
Each run sent the brief to Claude Opus 5.5 once, with the skill's SKILL.md and reference files loaded on the "with" side and nothing on the "without" side, and asked for a single HTML page. The runs had no tools, so no code was executed, no repository was read and no git command was run; the review and debugging pages describe what they would check. Every proof records the skill's exact commit, and the SKILL.md quotes on this page were read at those commits on November 3, 2026. The rules are on how a proof works.
Are these skills safe to install?
The November 2, 2026 scan looks in every file of a skill's folder for patterns such as downloading and running code in one step, sending data out, reading credential files, or text that tries to override your instructions. differential-review (6 files) and receiving-code-review (1 file) were Clear. systematic-debugging (11 files) is marked Review for two lines in its SKILL.md: a worked example for debugging a macOS code-signing step runs security list-keychains to show which keychains are present. The scan found nothing else in the folder. Across the Testing category, 230 of 236 skills were clear, 5 need a manual look and 1 was flagged.
The scan is a static check, not a guarantee; are agent skills safe? explains what it can and cannot catch. Before installing, paste a skill's GitHub link into the live skill check for a report on its current commit.
How do I install one in Claude Code?
Each skill page has a one-line install. For differential-review:
npx degit trailofbits/skills/plugins/differential-review/skills/differential-review .claude/skills/differential-review
That copies the whole skill folder, reference files included, to .claude/skills/differential-review/, which Claude Code loads for that repository; ~/.claude/skills/ makes it available in all your projects. Installing a skill from GitHub covers the other ways. For test-writing skills compared the same way, read best skills for writing tests.