Install
$ agentstack add skill-rojim666-sztucode-gh-address-comments ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
GitHub PR Comment Handler
Use this skill when the user wants to work through requested changes on a GitHub pull request. Use the GitHub app from this plugin for PR metadata and patch context, but treat thread-aware review data as a gh api graphql problem because the connector comment surface is flat and does not preserve full review-thread state.
Run all gh commands with elevated network access. If CLI auth is required, confirm gh auth status first and ask the user to authenticate with gh auth login if it fails.
Workflow
- Resolve the PR.
- If the user provides a repository and PR number or URL, use that directly.
- If the request is about the current branch PR, use local git context plus
gh auth statusandgh pr view --json number,urlto resolve it.
- Inspect review context with thread-aware reads.
- Use the GitHub app from this plugin to fetch PR metadata and patch context when the repo and PR are known.
- Use the bundled
scripts/fetch_comments.pyworkflow whenever the task depends on unresolved review threads, inline review locations, or resolution state. That script fetchesreviewThreads,isResolved,isOutdated, and file and line anchors that the connector comment surface does not preserve. - Use connector-only comment reads only for lightweight top-level PR comment summaries.
- Cluster actionable review threads.
- Group comments by file or behavior area.
- Separate actionable change requests from informational comments, approvals, already-resolved threads, and duplicates.
- Confirm scope before editing.
- Present numbered actionable threads with a one-line summary of the required change.
- If the user did not ask to fix everything, ask which threads to address.
- If the user asks to fix everything, interpret that as all unresolved actionable threads and call out anything ambiguous.
- Implement the selected fixes locally.
- Keep each code change traceable back to the thread or feedback cluster it addresses.
- If a comment calls for explanation rather than code, draft the response rather than forcing a code change.
- Summarize the result.
- List which threads were addressed, which were intentionally left open, and what tests or checks support the change.
Write Safety
- Do not reply on GitHub, resolve review threads, or submit a review unless the user explicitly asks for that write action.
- If review comments conflict with each other or would cause a behavioral regression, surface the tradeoff before making changes.
- If a comment is ambiguous, ask for clarification or draft a proposed response instead of guessing.
- Do not treat flat PR comments from the connector as a complete representation of review-thread state.
- If
ghhits auth or rate-limit issues mid-run, ask the user to re-authenticate and retry.
Fallback
If neither the connector nor gh can resolve the PR cleanly, tell the user whether the blocker is missing repository scope, missing PR context, or CLI authentication, then ask for the missing repo or PR identifier or for a refreshed gh login.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: rojim666
- Source: rojim666/SztuCode
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.