Install
$ agentstack add skill-doctormozg-claude-pipelines-github-review-pr ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ● Network access Used
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Review PR
Overview
Dispatch the github-pr-reviewer agent to perform a thorough review of a GitHub pull request in an isolated worktree. Produces a report under .mz/reviews/ with severity-labeled findings and a verdict.
When to Use
Triggers: "review PR", "review pull request", "check this PR", "PR review".
When NOT to use
- The changes live on a local branch, not a GitHub PR — use
review-branch. - The user wants to triage many PRs at once — use
github-scan-prs. - The PR reference is ambiguous or missing — ask for a URL or
owner/repo#number.
Arguments
$ARGUMENTS should be a GitHub PR reference:
- Full URL:
https://github.com/owner/repo/pull/123 - Short form:
owner/repo#123
If no argument is provided, ask the user for a PR URL.
Core Process
| Phase | Goal | Details | | ----- | --------------------------------- | ------------ | | 0 | Setup | Inline below | | 1 | Dispatch github-pr-reviewer agent | Inline below |
Phase 0: Setup
- Parse
$ARGUMENTS. If the PR reference is empty or malformed, escalate via AskUserQuestion — never guess, never fabricate a PR URL. - Normalize the reference to
__form. task_name=_github_review_pr_where `is today's date (underscores) andis__truncated to 20 chars, snake_case; on same-day collision appendv2,v3`.- Create
.mz/task//. - Write
state.mdwithschema_version: 2,Status: running,Phase: 0,Started:,PR:,Owner:,Repo:,Number:. - Emit a visible setup block:
task_name, PR reference, report dir (.mz/reviews/).
1. Dispatch
- Validate via
gh pr viewthat the normalized PR reference is accessible. On failure, escalate via AskUserQuestion. - Launch the
github-pr-revieweragent with the PR reference as the prompt. - After the agent completes, parse its final message for the
STATUS:line:
STATUS: DONEorSTATUS: DONE_WITH_CONCERNS→ updatestate.mdtoStatus: complete,Phase: 1. OnDONE_WITH_CONCERNS, also log the concerns block intostate.md.STATUS: NEEDS_CONTEXT→ re-dispatch once with the requested context; on a secondNEEDS_CONTEXT, escalate via AskUserQuestion.STATUS: BLOCKED→ escalate via AskUserQuestion with the blocker reason. Never auto-retry onBLOCKED.
- On any terminal success, display the absolute report path.
Techniques
Delegated to phase files — see Phase Overview table above. Detailed technique (worktree isolation, diff-plus-context reading, multi-lens fan-out, two-signal Critical gate, CI-result cross-referencing, severity labeling) lives in plugins/mz-dev-git/agents/github-pr-reviewer.md and the code-lens-\* agent files.
Common Rationalizations
N/A — this is a reference/collaboration skill that dispatches a specialist agent. It does not enforce discipline decisions itself. Discipline pressure is enforced inside github-pr-reviewer and the code-lens-\* agents.
Red Flags
- The PR argument is missing or malformed and you are guessing a URL instead of asking.
- You dispatched
github-pr-reviewerwithout first validating PR accessibility viagh pr view. - The agent returned
STATUS: BLOCKEDorNEEDS_CONTEXTand you retried more than once instead of escalating. - The agent's final message had no
STATUS:line and you proceeded anyway.
Verification
Output the report path (.mz/reviews/_github_review_pr___.md), confirm the file exists, and print the VERDICT: line plus the count of Critical: findings.
Error Handling
- Empty / malformed PR argument → escalate via AskUserQuestion; never guess, never fabricate a PR URL.
ghunavailable for Phase 0 validation → before escalating, trymcp__*github*MCP tools if exposed, then direct GitHub REST API (curl -fsSL -H "Authorization: Bearer $GITHUB_TOKEN" -H "Accept: application/vnd.github+json" "https://api.github.com/repos/{owner}/{repo}/pulls/{number}"). Only escalate via AskUserQuestion after all three tiers fail.- Missing tooling (
git worktreeunavailable,Agenttool absent) → escalate via AskUserQuestion with the exact missing command. - Empty agent result (report file missing, empty, or no
VERDICT:line) → retry the dispatch once with the same prompt; if still empty, escalate via AskUserQuestion with the failure mode. - Never guess — on any ambiguity (inaccessible PR, 404, merge conflict in worktree, missing base ref) escalate via AskUserQuestion rather than proceed silently.
State Management
State persists to .mz/task//state.md with schema_version: 2 as its first line. This is a single-dispatch skill (setup → dispatch → report in one turn), so the phase_complete / what_remains progress-ledger fields are not required. On reading a schema_version: 1 or unversioned file, add schema_version: 2 and log the upgrade.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: DoctorMozg
- Source: DoctorMozg/claude-pipelines
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.