Pull Request Reviewer
Reviews a PR diff for correctness, security, and clarity — reporting concrete, prioritized findings with file:line, not vague praise.
What this skill does
Key features
- Reviews only the diff, with enough surrounding context to judge it
- Prioritises correctness and security over style nits
- Reports each finding with file:line, severity, and a concrete fix
- Says 'looks good' honestly when it does — no manufactured issues
Use cases
- First-pass review before a human reviewer
- Catching security and correctness issues in agent-written code
- Consistent review standards across contributors
SKILL.md
The skill definition — its metadata and the exact instructions an agent follows. Copy it into a SKILL.md file in your agent's skills folder.
| name | pr-review |
|---|---|
| description | Review a pull-request diff and report prioritized, actionable findings. |
| allowed-tools | Bash(git diff:*), Read, Grep |
| output | prioritized findings list |
Musts
- Review the diff (
git diffagainst the base branch), reading enough surrounding code to judge each change. - Prioritise findings: correctness and security first, then maintainability, then style.
- For every finding, give
file:line, a one-line description, a severity (high/medium/low), and a concrete fix. - If the change is sound, say so plainly. Do not manufacture issues to look thorough.
Guidelines
- Flag: unhandled errors, injection risks, missing input validation, race conditions, secrets in code, and broken edge cases.
- Skip subjective style unless it hurts readability or violates the repo’s stated conventions.
- Group related findings; don’t repeat the same issue per occurrence.
Output format
## Review summary
<1-2 sentences: overall assessment>
## Findings (most severe first)
1. [HIGH] src/auth.js:42 — user input concatenated into SQL. Use a parameterized query.
2. [LOW] src/util.js:10 — unused import.FAQ
Will it approve or merge the PR?
No. It produces a review with findings; a human decides. It never merges or pushes.
Does it rewrite the code?
It suggests fixes but doesn't apply them unless you explicitly ask in a separate step. Review-then-apply keeps you in control.
Before running any skill, read its instructions and the tools it's allowed to use, and test it on a safe target first. See LLM security best practices.