Review Pr
Review a pull request against project standards. Checks code quality, security, tests, and patterns. Use when reviewing PRs or when someone says "review this PR".
Install
$ agentstack add skill-jmlero-claude-toolkit-review-pr ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Links to your public security report.[](https://agentstack.voostack.com/security/report/skill-jmlero-claude-toolkit-review-pr) Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Review pull request: $ARGUMENTS
Steps
1. Gather PR Context
# Get PR details
gh pr view $ARGUMENTS
# Get the diff
gh pr diff $ARGUMENTS
# Get PR comments
gh api repos/{owner}/{repo}/pulls/$ARGUMENTS/comments2. Review Checklist
Code Quality
- [ ] Follows existing patterns in the codebase
- [ ] No code duplication
- [ ] Functions do one thing
- [ ] Meaningful variable/function names
- [ ] No magic numbers or strings
- [ ] No commented-out code
Security (Critical)
- [ ] No secrets or credentials in code
- [ ] Auth required on mutating endpoints
- [ ] Input validated at API boundary
- [ ] No SQL injection risk
- [ ] Error messages don't leak internals
- [ ] No wildcard CORS with credentials
Testing
- [ ] Tests exist for new/changed code
- [ ] Tests cover happy path AND error cases
- [ ] Mocks used for external dependencies
- [ ] Tests are independent and isolated
Framework & Infrastructure
Apply checks relevant to the project's stack (skip what doesn't apply):
- [ ] Follows framework conventions and idioms
- [ ] Proper status codes and error responses
- [ ] Types are explicit (no
any, no untyped returns) - [ ] Infrastructure config not broken by the change
- [ ] Environment variables documented
Git
- [ ] Commits follow conventional format (feat:, fix:, etc.)
- [ ] PR is focused (not mixing unrelated changes)
- [ ] PR description explains the "why"
3. Output Format
## PR Review: #
### Summary
Brief description of what the PR does.
### Verdict: APPROVE / REQUEST_CHANGES / COMMENT
### Findings
#### Must Fix (blocking)
1. [Category] Description - file:line
#### Should Fix (non-blocking)
1. [Category] Description - file:line
#### Nits (optional)
1. Description - file:line
### What's Good
- Positive observations about the PRBe constructive. Explain WHY something should change, not just what.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: jmlero
- Source: jmlero/claude-toolkit
- License: Apache-2.0
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.