Github Code Review Pr

When to Use This Skill

ZERO-SPECULATION RULE (read this FIRST)

If the user's message contains a URL with /pull/ and any review intent, invoke this skill IMMEDIATELY. Do NOT spend ANY tokens analyzing the hostname, guessing the platform, or debating whether gh will work. The correct behavior is:

1. See /pull/ URL + review intent → trigger skill
2. Run review_runner.py prepare → let gh succeed or fail
3. If gh fails → report the error and suggest gh auth login --hostname

WRONG behavior (NEVER do this):

• "This appears to be a self-hosted GitLab instance" — WRONG, you don't know that
• "git.company.com looks like GitLab" — WRONG, it's GitHub Enterprise
• "gh CLI won't work with this host" — WRONG, you haven't tried yet
• Any reasoning about whether the host is GitHub, GitLab, Bitbucket, etc. — WRONG

WHY: Users who paste a /pull/ URL and say "review" are trusting you to act. The domain git.*.com, git.*.com.au, code.*.com — these are overwhelmingly GitHub Enterprise. Even if they aren't, trying gh first and failing fast is better than wasting 500 tokens on speculation. Trust the user's input first, fix errors later.

Trigger conditions

ALWAYS invoke this skill when user wants to review a Pull Request:

• "review this PR" / "review PR" / "PR review" / "PR code review"
• "审查这个PR" / "帮我看这个PR" / "PR审查" / "review pull request"
• "review https://github.com/owner/repo/pull/123"
• "帮我看一下这个 PR https://git.company.com/org/repo/pull/456"
• User provides ANY URL containing /pull/ and asks for review/feedback
• User provides a PR number and asks for review/feedback
• "help me review this pull request"
• "use github-code-review-pr skill"
• User shared a PR URL in previous turn, then says "使用技能" / "use this skill"

Trigger on any URL containing /pull/, regardless of the host domain. Do not make any judgment about the platform from domain text — trigger this skill and let gh handle it.

This skill reviews remote PRs via gh CLI (not local staged changes). For local staged changes, use code-review-staged instead.

Requirements

• GitHub CLI (gh) must be installed and authenticated
• curl must be available for downloading PR screenshots/assets
• Optional for enterprise SSO: curl --negotiate -u : support for SPNEGO/Kerberos-protected asset URLs
• Run skills-check github-code-review-pr to verify dependencies

Security — MANDATORY rules for AI agents

1. NEVER echo, print, or log the values of any environment variable containing credentials (GH_TOKEN, GITHUB_TOKEN, etc.). Do NOT run commands like echo $GH_TOKEN or printenv GITHUB_TOKEN — even for debugging.
2. NEVER pass token/credential values as inline CLI arguments or env-var overrides. gh reads credentials from its own config — just run gh commands directly.
3. When debugging auth errors, rely solely on gh auth status output and gh error messages. Do NOT attempt to verify tokens by reading or printing them.
4. NEVER extract credentials from OS credential stores or config files. Strictly forbidden commands include:

• security find-internet-password, security find-generic-password (macOS Keychain)
• git credential fill, cat ~/.git-credentials, cat ~/.netrc
• Reading ~/.config/gh/hosts.yml or any gh auth config file
• Any command that outputs a password, token, or secret value from any credential store

1. NEVER use extracted credential values in commands. Do NOT manually construct authenticated requests (e.g. curl -H "Authorization: token "). The gh CLI handles all authentication internally — use gh api for API calls instead of curl with raw tokens.

Requirements for Outputs

Code Review Quality

Review Standards

• Code review MUST be comprehensive, identifying all potential issues
• Review MUST be thorough and rigorous, highlighting suspicious code
• Review MUST provide actionable, concrete suggestions with file paths and line references
• Review MUST consider the project's existing conventions, patterns, and style
• Review language MUST match the user's input language (Chinese or English)

Language Detection

• Detect user's input language automatically
• If user input contains Chinese characters (Unicode U+4E00-U+9FFF), output review in Chinese
• If user input contains only English, output review in English

Implementation

The skill executes these steps:

Step 1: Parse PR Reference

Accept PR input in any of these formats:

• Full URL: https://github.com/owner/repo/pull/123
• Full URL with any host: https://git.mycompany.com/owner/repo/pull/123
• PR number (when inside a repo): 123
• PR number with repo: owner/repo#123

Extract owner, repo, PR number, and hostname, then proceed immediately to Step 2. Do not make any judgment about what platform the host belongs to — gh will succeed or fail on its own, and its error output is sufficient to diagnose any issue.

MANDATORY execution rule:

• For any input containing /pull/, the next command must be review_runner.py prepare .
• Do not run host-based branching logic first.
• Do not run gh auth status as a pre-check gate before the first gh pr view/gh pr diff call.

Step 2: Fetch PR Metadata and Diff

MANDATORY: Use the bundled runner script

Do NOT manually run gh pr view or gh pr diff. Always use the bundled runner script — it performs Step 2, Step 3 (path selection + checkout), and cleanup wiring in a single deterministic call:

python3 scripts/review_runner.py prepare 

STOP — How to locate the script (FORBIDDEN: Glob, find, rg, or any recursive search):

Check these fixed paths in order. Use the first one that exists. This works on macOS, Linux, and Windows:

import pathlib, subprocess, sys

candidates = [
    pathlib.Path.home() / ".config/opencode/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".claude/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".copilot/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".cursor/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".gemini/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".codex/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".qwen/skills/github-code-review-pr/scripts/review_runner.py",
    pathlib.Path.home() / ".grok/skills/github-code-review-pr/scripts/review_runner.py",
]
script = next((p for p in candidates if p.exists()), None)
if not script:
    print("ERROR: review_runner.py not found at any known install path", file=sys.stderr)
    sys.exit(1)
subprocess.run([sys.executable, str(script), "prepare", ""])

If you are running shell commands instead of Python, convert the above to the equivalent ls/test -f checks — but NEVER use recursive search.

This command:

1. Fetches PR metadata (gh pr view) and diff (gh pr diff) exactly once
2. Runs path_select.py (A → B → C → D selection with [PATH-CHECK]/[PATH-SELECTED] trace)
3. When neither A nor B matches, queries repo size via gh api to decide C vs D:

• Repo ≤ 100 MB → Path C: clone into shared cache via repo_manager.py sync (reusable)
• Repo > 100 MB → pauses with exit code 10 — asks the AI agent to present options to the user (see below)
• If size query fails → defaults to Path C (with fallback to D if clone fails)

1. Handles checkout with fallback (pull//head)
2. Saves all outputs to a session manifest

Machine-readable output lines (normal exit code 0):

• RUN_MANIFEST= — session manifest JSON (needed for cleanup and gate scripts)
• PR_VIEW_JSON_PATH= — saved PR metadata JSON file
• PR_DIFF_PATH= — saved PR diff file
• CLEANUP_LOG_PATH= — where to tee cleanup output in Step 7a
• REVIEW_TEXT_PATH= — where to write the review text in Step 7b
• SELECTED_PATH=A|B|C|D|DIFF_ONLY — which path was selected
• REPO_WORKDIR= — local repo directory (empty if diff-only)
• PR_STATE=OPEN|CLOSED|MERGED — PR state
• CONTEXT_MODE=full_repo|diff_only — whether full repo context is available
• CONTEXT_LIMITATION= — explanation when context is limited
• CHECKOUT_DONE=true|false — whether the PR branch is already checked out at REPO_WORKDIR
• NOTE: PR branch is already checked out... — human-readable confirmation (when CHECKOUT_DONE=true)

Handling exit code 10 (large repo — user decision required)

When the repo exceeds the size threshold (default 100 MB) and neither Path A nor B matched, review_runner.py prepare exits with code 10 instead of auto-deciding. It emits these lines:

• NEEDS_USER_DECISION=true
• REPO_SIZE_MB= — actual repo size in MB
• THRESHOLD_MB= — the threshold that was exceeded
• RECOMMENDED_DEFAULT=D|diff-only — which option to pre-select (D for ≤ 1 GB, diff-only for > 1 GB)
• PENDING_RUN_DIR= — session directory with saved metadata/diff
• PR_VIEW_JSON_PATH= — already fetched, reusable
• PR_DIFF_PATH= — already fetched, reusable

When you receive exit code 10, you MUST present the user with three options.

Use the repo size to determine the recommended default, then display the options. Do NOT invent your own recommendation — follow the table below exactly.

Default selection rule:

| Repo size | Default option | Rationale | |---|---|---| | ≤ 1 GB | 2. Sparse clone (Path D) | Blobless sparse clone only downloads tree metadata (usually 1 GB | 3. Diff-only | Monorepo-scale repos have deep commit history and massive tree objects. Tree metadata alone can take minutes to transfer. Diff-only is the pragmatic choice. |

Display the repo size and present the options. The default option (from the table above) MUST be pre-selected (cursor/arrow points to it). Do NOT add "(Recommended)" text to any option — the pre-selection is the recommendation.

> This repository is {REPOSIZEMB} MB (exceeds the {THRESHOLD_MB} MB threshold). > > How would you like to proceed? > 1. Clone to shared cache (Path C) — larger download, but cached for future reviews > 2. Sparse clone to temp dir (Path D) — smaller download, only PR-related files, deleted after review > 3. Diff-only — no clone, review based on PR diff and metadata only (limited context)

After the user chooses, resume the session:

python3 scripts/review_runner.py prepare  \
    --force-path C|D|diff-only --run-dir 

This resumes the pending session: it reuses the previously fetched metadata and diff (no repeated gh pr view/gh pr diff), executes the user's chosen path, and emits the standard machine-readable output lines with exit code 0.

After review_runner.py prepare succeeds (exit code 0) — MANDATORY next actions:

When you see CHECKOUT_DONE=true in the output, the runner has ALREADY fetched and checked out the PR branch. You MUST NOT run any git commands to prepare the repo.

1. Read PR metadata from PR_VIEW_JSON_PATH (do NOT re-run gh pr view)
2. Read PR diff from PR_DIFF_PATH (do NOT re-run gh pr diff)
3. SKIP Step 3 entirely — go directly to Step 4 (read files). The runner output says CHECKOUT_DONE=true — the PR branch is ALREADY checked out at REPO_WORKDIR. To gather context, just read files there:

``bash cd # read files directly — CHECKOUT_DONE=true means the PR branch is already here ``

1. Save all emitted paths (RUN_MANIFEST, CLEANUP_LOG_PATH, REVIEW_TEXT_PATH) — you will need them in Step 7

WRONG (do NOT do this when CHECKOUT_DONE=true):

• git fetch origin — WRONG, runner already fetched
• git checkout — WRONG, runner already checked out
• gh pr checkout — WRONG, runner already handled this
• Running ANY git command to "prepare" the repo — WRONG, it's already prepared

Fallback: Manual commands (ONLY if review_runner.py is not found)

If and only if review_runner.py cannot be located at any install path, fall back to manual commands. You MUST still run path_select.py before any clone/fetch (see Step 3).

2a. PR metadata

GH_PAGER=cat gh pr view  --json number,title,body,state,author,baseRefName,headRefName,labels,reviewDecision,additions,deletions,changedFiles,commits,files,comments,reviews,url

Key fields:

• title, body — PR description and intent
• baseRefName, headRefName — branches involved
• files — list of changed files with path, additions, deletions
• commits — commit history in the PR
• comments, reviews — existing discussion context
• url — used to extract owner/repo

2b. PR diff

GH_PAGER=cat gh pr diff 

2b.1 Single-fetch rule (avoid repeated network calls)

• Fetch metadata and diff once, then reuse the captured output throughout the review.
• Do NOT re-run gh pr diff/gh pr view unless output is missing/corrupted or PR head changed during review.
• If a re-fetch is required, state the reason explicitly.

Enforcement rule:

• Persist first successful outputs to variables/files (for example PR_VIEW_JSON_PATH, PR_DIFF_PATH) and reuse them for all later analysis.
• Any second gh pr view/gh pr diff call MUST include a log line in advance: [REFETCH-REASON] .
• "Need to read another section" is NOT a valid reason; read from the previously captured output instead.

2c. Collect and analyze PR images (default when relevant)

After metadata is fetched, inspect body, comments, and reviews for image links:

• Markdown image syntax: ``
• Plain asset URLs (especially /assets/ links)

Automatically do this (without extra user back-and-forth) when:

• user asks to read screenshot/image content, or
• screenshots are part of PR verification evidence (offline check steps, UI proof, tracking proof), or
• image information is required to validate correctness/risk.

Download relevant images under a random run directory in the unified cache.

Bash (macOS / Linux):

if [[ "$(uname -s)" == "Darwin" ]]; then
  CACHE_ROOT="$HOME/Library/Caches/mythril-skills-cache"
else
  CACHE_ROOT="${XDG_CACHE_HOME:-$HOME/.cache}/mythril-skills-cache"
fi
CACHE_DIR="$CACHE_ROOT/github-code-review-pr"
mkdir -p "$CACHE_DIR"
RUN_DIR=$(mktemp -d "$CACHE_DIR/XXXXXXXX")
IMAGE_CACHE="$RUN_DIR/images"
mkdir -p "$IMAGE_CACHE"

PowerShell (Windows):

$CACHE_ROOT = Join-Path ([Environment]::GetFolderPath("LocalApplicationData")) "mythril-skills-cache"
$CACHE_DIR = Join-Path $CACHE_ROOT "github-code-review-pr"
New-Item -ItemType Directory -Force -Path $CACHE_DIR | Out-Null
$RUN_DIR = Join-Path $CACHE_DIR ([System.IO.Path]::GetRandomFileName())
New-Item -ItemType Directory -Force -Path $RUN_DIR | Out-Null
$IMAGE_CACHE = Join-Path $RUN_DIR "images"
New-Item -ItemType Directory -Force -Path $IMAGE_CACHE | Out-Null

Never use ad-hoc temp locations like /tmp//... for image artifacts.

Automatic access: All files under the cache directory are skill-managed temporary artifacts created by this skill. Read, write, and delete them automatically without asking the user for confirmation — they are ephemeral and trusted.

Use authenticated retrieval in this order:

1. curl -fsSL "" -o ""
2. If enterprise auth fails, retry:

curl -fsSL --negotiate -u : "" -o ""

Post-download validation (MANDATORY): After each download, verify the file is actually an image — enterprise auth redirects often return HTTP 200 with an HTML login page instead of the real image. Run:

file --mime-type -b ""

• If output starts with image/ → valid image, proceed to read it.
• If output is text/html, text/plain, or anything other than image/* → the download captured an auth redirect page, not the real image. Treat this as a retrieval failure: delete the file (rm -f ""), do NOT attempt to read it, and do NOT retry reading it. Log a one-line note (e.g., "Image download returned HTML instead of image data — likely auth redirect, skipp

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: jie-meng
• Source: jie-meng/mythril-agent-skills
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.