Install
$ agentstack add skill-ptdecker-kiss-skills-review-copilot ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Review Copilot PR Comments
You are reviewing GitHub Copilot's automated PR review comments. Work through the following steps in order. Be methodical -- do not skip steps or combine them.
Step 1: Identify the PR
If the user provided a PR number as $ARGUMENTS, use that. Otherwise, determine the PR from the current branch:
gh pr view --json number,title,url,headRefName
Display the PR number, title, and URL. Ask the user to confirm this is the correct PR before proceeding.
Step 2: Fetch all Copilot comments
Copilot leaves two kinds of feedback. Collect both.
2a: Inline comment threads
Pull all review comments from the PR and filter to only those left by Copilot (author login contains "copilot"):
gh api repos/{owner}/{repo}/pulls/{number}/comments --paginate --jq '.[] | select(.user.login | test("copilot"; "i"))'
For each comment, capture:
id(the comment ID)path(file path)lineororiginal_line(line number)body(the comment text)in_reply_to_id(to identify threads -- group by this or byidif it is a top-level comment)subject_typeanddiff_hunk(for context)
These are full-confidence comments. Copilot created real review threads for them.
2b: Suppressed (low-confidence) comments
Copilot also embeds suppressed comments inside the review body itself, under a ` / Comments suppressed due to low confidence` section. Fetch the review objects:
gh api repos/{owner}/{repo}/pulls/{number}/reviews --jq '.[] | select(.user.login | test("copilot"; "i")) | {id, node_id, body}'
Parse the review body to extract any suppressed comments. These typically appear as bold file:line references followed by a description and optional code block.
Important: Suppressed comments do NOT have their own comment threads on the PR. Copilot chose not to create threads for them because it had low confidence. This means:
- There is no comment ID to reply to
- There is no thread to resolve
- There is no comment to react to
These must be handled differently from inline threads (see Steps 3 and 7).
Display summary
Display a numbered summary of ALL comments found (both inline and suppressed), showing the file, line, a one-line synopsis, and whether it is an inline thread or suppressed.
No Copilot comments found
If both the inline comments (Step 2a) and the suppressed comments (Step 2b) come back empty, tell the user:
> No Copilot review comments found on PR #. > > This usually means one of: > - Copilot auto-review is not enabled for this repository > (check Settings → Code review → Copilot) > - Copilot has not reviewed this PR yet (it may take a few minutes after pushing) > - Copilot reviewed the PR but had no comments > > Nothing to do — stopping here.
Stop here. Do not proceed to Step 3.
Step 3: Evaluate each comment
For each Copilot comment:
- Read the file and surrounding context referenced by the comment
- Understand what Copilot is suggesting
- Determine whether the comment is valid (the suggestion would genuinely improve the code --
correctness, safety, clarity, or maintainability) or ignorable (the suggestion is subjective, incorrect, inapplicable, or would not meaningfully improve the code)
Extra scrutiny for suppressed comments
Copilot suppressed these comments because it had low confidence in them. Apply a higher bar:
- Read more surrounding context than you would for a full-confidence comment
- Check whether the issue Copilot flagged actually exists in the current code (not just in the
diff hunk Copilot saw)
- Consider whether the suggestion reflects a misunderstanding of the codebase's conventions
- If the comment is borderline, lean toward dismissing it -- Copilot already doubted it
Keep a running tally of your evaluation as you go, noting which are inline threads vs suppressed.
Step 4: Enter plan mode and present the plan
Enter plan mode. Write a plan that contains two sections:
Comments to Address
For each valid comment, include:
- The file and line reference
- Whether it is an inline thread or suppressed comment
- A paragraph explaining why the comment is valid
- The specific steps to fix the issue
- A paragraph describing how the fix will be implemented
Comments to Dismiss
For each ignorable comment, include:
- The file and line reference
- Whether it is an inline thread or suppressed comment
- A paragraph explaining why the comment does not need to be addressed
Exit plan mode and wait for the user to approve the plan.
Step 5: Execute the plan
Implement all fixes described in the plan. After all changes are made:
- Run the project's lint command to verify the changes compile cleanly
- Run the project's test command to verify nothing is broken
- Show the user a summary of what was changed
Step 6: Commit and push
Before committing, prompt the user with the following message:
Before I commit, please review the changes in your IDE. Use your editor's diff view to verify each fix looks correct -- especially for suppressed low-confidence comments where Copilot was less certain. Confirm when you're satisfied and ready to commit, or let me know if anything needs adjustment.
Wait for the user to confirm. Once confirmed:
- Stage the changed files (be specific -- do not use
git add -A) - Write a commit message that summarizes the Copilot review fixes. Format:
``` Address Copilot review feedback on PR #
Co-Authored-By: Claude Opus 4.6 (1M context) ```
- Create the commit
- Push to origin
- Save the commit hash for use in the next step
Step 7: Respond to Copilot on GitHub
There are two response paths depending on comment type.
7a: Inline thread comments (full-confidence)
These have real comment threads on the PR. Handle each one individually.
For threads that were addressed:
- Post a reply to the thread explaining what was fixed and how, including the commit hash:
`` gh api repos/{owner}/{repo}/pulls/{number}/comments/{comment_id}/replies -f body="" ``
- Add a standard GitHub emoji reaction (+1) to the original comment:
`` gh api repos/{owner}/{repo}/pulls/comments/{comment_id}/reactions -f content="+1" ``
- Resolve the thread. The comment
node_idis aPullRequestReviewComment(PRRC), not a
thread. To resolve, query for the actual PullRequestReviewThread (PRRT) node ID: `` gh api graphql -f query='query { repository(owner: "", name: "") { pullRequest(number: ) { reviewThreads(first: 50) { nodes { id isResolved comments(first: 1) { nodes { body author { login } } } } } } } }' --jq '.data.repository.pullRequest.reviewThreads.nodes[] | select(.comments.nodes[0].author.login | test("copilot"; "i"))' ` Then resolve using the PRRT ID: ` gh api graphql -f query='mutation { resolveReviewThread(input: {threadId: ""}) { thread { isResolved } } }' ``
For threads that were dismissed:
- Post a reply explaining why the suggestion is not being adopted
- Add a standard GitHub emoji reaction (-1) to the original comment
- Resolve the thread using the same approach as above
7b: Suppressed comments (low-confidence)
These do NOT have comment threads. Do not attempt to reply to, react to, or resolve individual comments -- there are no thread IDs or comment IDs to target.
Instead, accumulate all suppressed comment responses (both addressed and dismissed) into a single PR comment posted via:
gh pr comment {number} --body ""
Format the comment as follows:
Addressing Copilot's suppressed (low-confidence) comments from the review:
**`:` — **: . [If addressed: Fixed in commit .]
**`:` — **: ...
[repeat for each suppressed comment]
Step 8: Copilot feedback buttons (manual step)
Important: Copilot's dedicated thumbs-up / thumbs-down feedback buttons (visible on each Copilot comment in the GitHub web UI) are a proprietary feedback mechanism that trains Copilot's review model. These are separate from the standard GitHub emoji reactions added in Step 7 and are not accessible via any public API, GraphQL mutation, or gh CLI command. They can only be clicked in the GitHub web UI.
After completing all automated steps, prompt the user with a message like:
Manual step required: Please open the PR in your browser and click the Copilot feedback buttons on each inline comment:
- Thumbs up for comments that were valid and addressed
- Thumbs down for comments that were dismissed
These dedicated Copilot feedback buttons (not the emoji reactions I already added) help train Copilot's review model. They are only available in the GitHub web UI.
Here is the PR link: ``
The inline comments to provide feedback on:
| Comment | File | Action | Feedback | |---------|------|--------|----------| | | | Addressed / Dismissed | Thumbs up / Thumbs down | | ... | ... | ... | ... |
Note: Suppressed (low-confidence) comments do not have feedback buttons since Copilot did not create threads for them.
Step 9: Summary
Display a final summary showing:
- How many inline thread comments were addressed vs dismissed
- How many suppressed comments were addressed vs dismissed
- The commit hash of the fix (if any changes were made)
- Confirmation that all inline threads have been responded to and resolved
- Confirmation that a PR comment was posted for suppressed comments (if any)
- Reminder of whether the user still needs to click Copilot feedback buttons
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: ptdecker
- Source: ptdecker/kiss-skills
- License: Unlicense
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.