pr-review

Name: pr-review
Author: Significant-Gravitas

Security Community

Repo stars 184,730
Author updated Live
Author repo AutoGPT

Fluxly profile Facts only: domain, agents, trust score, runtime, permissions and network

Domain: Security
Compatible agents: Claude Code
Cursor
Cline
Codex
Windsurf
Gemini CLI

+20
Trust score: 88 / 100 · community maintained
Author / version / license: @Significant-Gravitas · no license declared
Token usage: Lean
Setup complexity: Plug-and-play
External API key: Not required
Operating systems: Unspecified (assume cross-platform)
Runtime requirements: No special requirements
Permissions: Read-only
Write / modify
Network behavior: External requests
Install commands: 26 variants

Profile is derived at build time from SKILL.md and install vectors. Subject to drift from author intent.

Heads up: 未限定 allowed-tools，默认拥有全部工具权限。

Output preview pr-review.preview

---
name: pr-review
description: Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks…
category: security
runtime: no special runtime
---

# pr-review output preview

## PART A: Task fit
- Use case: Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks to review a PR, check PR quality, or give feedback on a PR. gh pr list --head $(git branch --show-current) --repo Significant-Gravitas/AutoGPT makes outbound network calls. Works with Claude Code, Cursor, Cline and 23 more..
- Inputs: target material, constraints, expected output, and acceptance criteria.
- Evidence boundary: follow “Find the PR / Read the PR description / Read the diff” and do not present inference as author intent.

## PART B: Execution result
- **01** The card summarizes the use case; runtime output centers on “Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks to review a PR, check PR quality, or give feedback on a PR. gh pr list --head $(git branch --show-current) --repo Significant-Gravitas/AutoGPT makes outbound network calls. Works with Claude Code, Cursor, Cline and 23 more.”.
- **02** When the source has headings, the agent prioritizes “Find the PR / Read the PR description / Read the diff” so the result follows the author’s structure.
- **03** Typical output includes task judgment, concrete steps, required commands or file edits, validation, and follow-up options.
- **04** Risk context follows the fingerprint: read files, write/modify files; may access external network resources; usually needs no extra API key.

## Running Rules
- read files, write/modify files; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding scope.
- Return the result, validation criteria, and next iteration options.

SKILL.md SKILL.md

---
name: pr-review
description: Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks…
category: security
source: Significant-Gravitas/AutoGPT
---

# pr-review

## When to use
- Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks to review a PR, check…
- Use it when the task has clear inputs, repeatable steps, and validation criteria.

## What to provide
- Target material, scope, expected result, and forbidden changes.
- Whether network, commands, file writes, or external services are allowed.

## Execution rules
- Organize steps around “Find the PR / Read the PR description / Read the diff” and keep inference separate from source facts.
- read files, write/modify files; may access external network resources; usually needs no extra API key.
- Validate with a small sample before expanding the task.

## Output requirements
- Return the deliverable, key evidence, validation method, and next action.
- Mark missing information as unknown; do not invent commands, platforms, or dependencies.

Evidence boundary and execution chain

The author source anchors workflow facts; repository files anchor sources and commands; Fluxly only adds fit, limitations, and quality judgment.

skill "pr-review" {
  input      -> user goal + target files + boundaries + acceptance criteria
  context    -> Find the PR / Read the PR description / Read the diff
  rules      -> SKILL.md triggers / order / output contract
  runtime    -> no special runtime | read files, write/modify files | may access external network resources
  guardrails -> usually needs no extra API key + small-sample validation + diff/log review
  output     -> copyable result + checklist + next iteration
}

Interpretation is structured for decision-making; original keeps the upstream SKILL.md unchanged.

Decide Fit First

Core job: Review a PR for correctness, security, code quality, and testing issues. TRIGGER when user asks to review a PR, check PR quality…
Best fit: Use it when the task has reusable inputs, steps, and validation criteria rather than a one-off answer.
Avoid forcing it: If the source lacks commands, platform support, or external-service evidence, keep those fields unknown instead of guessing.

Design Intent

Structure: The skill is organized around “Find the PR”, “Read the PR description”, “Read the diff”, “Fetch existing review comments”, showing how the author expects the agent to judge fit, collect context, and produce verifiable output.
Trigger evidence: Prioritize the author’s wording around when to use it, what context to collect, and what output shape to produce.
Evidence boundary: Author text states facts, repository files prove commands and paths, and Fluxly only adds fit, limits, and usage judgment.

How To Use It

Inputs: Provide target material, scope, expected result, forbidden changes, and validation method.
Invocation: Name pr-review directly; if the source includes slash commands, start with the command and then add task context.
Validation: Start small and check whether the result follows “Find the PR / Read the PR description / Read the diff” before expanding.

Boundaries And Review

Dependencies: It usually needs no extra API key, so start with a small validation task.
Permissions: Declared permissions include read / write; ask the agent to state file, command, and rollback boundaries before acting.
Quality bar: A useful result names the deliverable, evidence, and next action. Generic prose means the task needs tighter context.

PR Review

Find the PR

gh pr list --head $(git branch --show-current) --repo Significant-Gravitas/AutoGPT
gh pr view {N}

Read the PR description

Before reading code, understand the why, what, and how from the PR description:

gh pr view {N} --json body --jq '.body'

Every PR should have a Why / What / How structure. If any of these are missing, note it as feedback.

Read the diff

gh pr diff {N}

Fetch existing review comments

Before posting anything, fetch existing inline comments to avoid duplicates:

gh api repos/Significant-Gravitas/AutoGPT/pulls/{N}/comments --paginate
gh api repos/Significant-Gravitas/AutoGPT/pulls/{N}/reviews

What to check

Description quality: Does the PR description cover Why (motivation/problem), What (summary of changes), and How (approach/implementation details)? If any are missing, request them — you can't judge the approach without understanding the problem and intent.

Correctness: logic errors, off-by-one, missing edge cases, race conditions (TOCTOU in file access, credit charging), error handling gaps, async correctness (missing await, unclosed resources).

Security: input validation at boundaries, no injection (command, XSS, SQL), secrets not logged, file paths sanitized (os.path.basename() in error messages).

Code quality: apply rules from backend/frontend CLAUDE.md files.

Architecture: DRY, single responsibility, modular functions. Security() vs Depends() for FastAPI auth. data: for SSE events, : comment for heartbeats. transaction=True for Redis pipelines.

Testing: edge cases covered, colocated *_test.py (backend) / __tests__/ (frontend), mocks target where symbol is used not defined, AsyncMock for async.

Output format

Every comment must be prefixed with 🤖 and a criticality badge:

Tier	Badge	Meaning
Blocker	`🔴 Blocker`	Must fix before merge
Should Fix	`🟠 Should Fix`	Important improvement
Nice to Have	`🟡 Nice to Have`	Minor suggestion
Nit	`🔵 Nit`	Style / wording

Example: 🤖 🔴 **Blocker**: Missing error handling for X — suggest wrapping in try/except.

Post inline comments

For each finding, post an inline comment on the PR (do not just write a local report):

# Get the latest commit SHA for the PR
COMMIT_SHA=$(gh api repos/Significant-Gravitas/AutoGPT/pulls/{N} --jq '.head.sha')

# Post an inline comment on a specific file/line
gh api repos/Significant-Gravitas/AutoGPT/pulls/{N}/comments \
  -f body="🤖 🔴 **Blocker**: <description>" \
  -f commit_id="$COMMIT_SHA" \
  -f path="<file path>" \
  -F line=<line number>

Install command

One-click installPick a runner, click Copy, paste into your terminal, press enter

npx skills add Significant-Gravitas/AutoGPT/.claude/skills/pr-review -y

Open general install guide

View skill source

Works with

Claude Code
Cursor
Cline
Codex
Windsurf
Gemini
OpenCode
Roo Code
AAide
+Augment
GitHub Copilot
OpenClaw
KKiro
Junie
WWarp
Goose
Trae
Kilo Code
OpenHands
Amp
Zencoder
CContinue
AIAider
CodeBuddy
CodeGeeX
Replit Agent

Security audit

88 / 100

Community

未声明 license/许可。
未声明 version。
未限定 allowed-tools，默认拥有全部工具权限。

Metadata

Source: github
Significant-Gravitas/AutoGPT
中文

More by @Significant-Gravitas

Category & tags

Category Security