# Review Pr

> Review a pull request against project standards. Checks code quality, security, tests, and patterns. Use when reviewing PRs or when someone says "review this PR".

- **Type:** Skill
- **Install:** `agentstack add skill-jmlero-claude-toolkit-review-pr`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [jmlero](https://agentstack.voostack.com/s/jmlero)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [jmlero](https://github.com/jmlero)
- **Source:** https://github.com/jmlero/claude-toolkit/tree/main/plugins/review-pr/skills/review-pr

## Install

```sh
agentstack add skill-jmlero-claude-toolkit-review-pr
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

Review pull request: $ARGUMENTS

## Steps

### 1. Gather PR Context
```bash
# Get PR details
gh pr view $ARGUMENTS

# Get the diff
gh pr diff $ARGUMENTS

# Get PR comments
gh api repos/{owner}/{repo}/pulls/$ARGUMENTS/comments
```

### 2. Review Checklist

#### Code Quality
- [ ] Follows existing patterns in the codebase
- [ ] No code duplication
- [ ] Functions do one thing
- [ ] Meaningful variable/function names
- [ ] No magic numbers or strings
- [ ] No commented-out code

#### Security (Critical)
- [ ] No secrets or credentials in code
- [ ] Auth required on mutating endpoints
- [ ] Input validated at API boundary
- [ ] No SQL injection risk
- [ ] Error messages don't leak internals
- [ ] No wildcard CORS with credentials

#### Testing
- [ ] Tests exist for new/changed code
- [ ] Tests cover happy path AND error cases
- [ ] Mocks used for external dependencies
- [ ] Tests are independent and isolated

#### Framework & Infrastructure
Apply checks relevant to the project's stack (skip what doesn't apply):
- [ ] Follows framework conventions and idioms
- [ ] Proper status codes and error responses
- [ ] Types are explicit (no `any`, no untyped returns)
- [ ] Infrastructure config not broken by the change
- [ ] Environment variables documented

#### Git
- [ ] Commits follow conventional format (feat:, fix:, etc.)
- [ ] PR is focused (not mixing unrelated changes)
- [ ] PR description explains the "why"

### 3. Output Format

```markdown
## PR Review: #

### Summary
Brief description of what the PR does.

### Verdict: APPROVE / REQUEST_CHANGES / COMMENT

### Findings

#### Must Fix (blocking)
1. [Category] Description - file:line

#### Should Fix (non-blocking)
1. [Category] Description - file:line

#### Nits (optional)
1. Description - file:line

### What's Good
- Positive observations about the PR
```

Be constructive. Explain WHY something should change, not just what.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [jmlero](https://github.com/jmlero)
- **Source:** [jmlero/claude-toolkit](https://github.com/jmlero/claude-toolkit)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-jmlero-claude-toolkit-review-pr
- Seller: https://agentstack.voostack.com/s/jmlero
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.