Your review standards, inside your coding agent.

Your agent can write the code. Does it know what your team checks?

The same authorization gap, missing failure test or unsupported performance claim comes back in review. The checklist is in a document, an old PR or someone’s head. The agent needs the method before handing you another change to fix.

The team’s review criteria become part of doing the work.

• A consistent review method

  Developers and agents work from the same checks. Review the findings and evidence instead of restating the checklist.

• Performance work with a baseline

  Give the agent a method to reproduce, measure, locate the bottleneck and remeasure. A plausible optimization is not the finish line.

• Your standards travel with the team

  Share private methods with authorized teammates and contractors. New contributors can apply the team’s criteria on their first change.

Actual internal run · Invoice API review

Claude Code + Skillstore

Review this endpoint. Users must only read invoices belonging to their organization. Return 404 for another organization’s invoice.

Addy Osmani · Security and hardening

• Read the method and its authorization checks.
• Check ownership of the requested resource, not just whether the user is logged in.
• Test a signed-in user requesting another organization’s invoice.

A missing authorization check, with a regression test

The endpoint returned 200 for another organization’s invoice. The review identified the missing orgId check. After the patch, the same request returned 404.

Before

Cross-organization test failed: expected 404, received 200.

After

All four endpoint checks passed: own organization, other organization, no session and missing invoice.

Actual Claude Code + Skillstore run on a deliberately vulnerable example. Tests were run independently. This demonstrates the workflow, not an improvement over an unassisted agent.

How Skillstore works

1. Connect the public library

   Add Skillstore to Claude Code or Codex using the setup guide. Start a fresh agent session. No Skillstore signup needed.

2. Ask for the method on a real change

   Give the agent a small review or performance task. Ask it to find a fitting Skillstore method, read it and apply the relevant checks.

3. Inspect the result

   Ask which checks were applied and what they found. Run the tests, review the patch and keep the findings that hold up.

Common questions

Why not keep everything in AGENTS.md?

Keep repository-wide rules in AGENTS.md. Skillstore adds discovery and delivery of reusable methods when a task needs them, plus controlled sharing of private methods. The two can work together; Skillstore does not replace your project rules.

Can we use our existing GitHub skills?

Yes. Import a skill from GitHub or a file into your private library, review it and choose who gets access. Imports are snapshots today; upstream changes need to be imported again. A Skillstore account is required for private creation, import and sharing.

Will connecting make the agent use a skill on every task?

Connection makes the tools available. For the first task, explicitly ask the agent to find, read and apply a fitting method. Review the tool calls and result. Installing a connector does not prove a method was used or made the work better.

Can Skillstore help with performance as well as code quality?

Yes. Start with a reproducible workload and a baseline. Ask the agent to select a fitting method, identify the bottleneck, propose a change and measure again. Keep the measurements with the review; faster is an observed result, not a claim from the generated patch.

Does Skillstore receive our repository?

Skillstore receives the arguments the agent sends in its tool calls. Connecting does not automatically provide your repository or full conversation. Keep secrets out of task descriptions. Private methods require authorized access; revocation stops future reads, not instructions already copied.