Web developers · 5 free picks · premium superpower

Code review and security: review code before you ship it

Code written by AI can contain bugs and security problems that are hard to spot. API keys end up in front-end code and packages get old. Reviewer agents and security skills give each change a second look before it goes live.

Free picks (tested by us)

Most useful first. Each one was installed on a clean test system; start with the first, try it, then add the next.

  1. RecommendedskillInstalls cleanly

    Good habits for building websites

    Addy Osmani Agent Skills

    Good working habits for building websites: clear plans, tests and reviews.

    Test: installs cleanly and works without an account. Not yet used on real work.

    EveryoneWatch outThe skills are text instructions, so the direct risk is low. The agent still runs commands that you approve.

    For any assistant
    Paste this in the terminal
    npx skills add addyosmani/agent-skills
    Other ways to install, and how we tested it
  2. agentInstalls cleanly

    Plan and review code changes

    Feature Dev plugin (Anthropic)

    Three helpers that look at your code, plan a change and check it before you accept it.

    Test: installs cleanly and works without an account. Not yet used on real work.

    Good forWeb developers, Build an appWatch outThe agents read your code and can edit files in the project. Use a project under version control.

    For Claude Code
    Type this inside Claude Code
    /plugin install feature-dev@claude-plugins-official
    What it does and how we tested it
  3. agentInstalls cleanly

    Reviewers for code changes

    PR Review Toolkit (Anthropic)

    Six reviewers that check a change for missing tests, hidden errors and unclear code.

    Test: installs cleanly and works without an account. Not yet used on real work.

    Good forWeb developers, Security testing, Build an appWatch outThe agents read your code and git changes. Some can suggest or make edits. Review changes before you accept them.

    For Claude Code
    Type this inside Claude Code
    /plugin install pr-review-toolkit@claude-plugins-official
    What it does and how we tested it
  4. agentInstalls cleanly

    A shop of focused helpers

    wshobson agents

    A large shop of focused helpers. You install only the few you need.

    Test: installs cleanly and works without an account. Not yet used on real work.

    EveryoneWatch outThe marketplace is very large. Install only the plugins you need, or you will load many agents and skills that you do not use.

    For Claude Code Also works with Codex CLI — see all steps
    Step 1 of 2 · Type this inside Claude Code
    /plugin marketplace add wshobson/agents
    See all 2 steps
  5. skillPartly tested (needs an account)

    Security check for Gemini

    Gemini CLI Security extension

    Lets Gemini check your own code for security problems.

    Test: installs cleanly; its main features need an account we did not use. Not yet used on real work.

    Good forSecurity testing, Web developersWatch outYour code is sent to Google's Gemini model for analysis. Do not use it on code that you may not share.

    For Gemini CLI
    Paste this in the terminal
    gemini extensions install https://github.com/gemini-cli-extensions/security
    What it does and how we tested it

Superpowers Pack · early access

Premium superpowers in the Superpowers Pack

  • Premium superpower

    Pre-launch check of your own site

    Checks keys, packages, headers and the code of a site you own, then gives one plain report with the fix order.

Superpowers written and tested by us, set up with one command. Early access: join the list and we email you the day it opens.

Get early access