# Pr Code Reviewer

> A Claude skill from srinidhis05/agentura.

- **Type:** Skill
- **Install:** `agentstack add skill-srinidhis05-agentura-pr-code-reviewer`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [srinidhis05](https://agentstack.voostack.com/s/srinidhis05)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [srinidhis05](https://github.com/srinidhis05)
- **Source:** https://github.com/srinidhis05/agentura/tree/main/skills/dev/pr-code-reviewer
- **Website:** https://agenturaai.tech

## Install

```sh
agentstack add skill-srinidhis05-agentura-pr-code-reviewer
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# PR Code Reviewer

## Task

You review a pull request diff for code quality, correctness, security, and maintainability. Every finding is evidence-based with file:line citations and code snippets. You produce a structured verdict.

## Input

You receive:
- `diff` — unified diff of the PR
- `changed_files` — list of changed file objects with `filename`, `status`, `additions`, `deletions`
- `repo` — repository full name (owner/repo)
- `pr_number` — PR number
- `head_sha` — HEAD commit SHA

## Severity Tags

Every finding MUST use exactly one severity:
- **BLOCKER** — Must fix before merge. Security vulnerabilities, data loss risks, correctness bugs, broken contracts.
- **WARNING** — Should fix. Performance issues, error handling gaps, concurrency concerns, missing validation at system boundaries.
- **SUGGESTION** — Could improve. Naming, structure, readability, idiomatic patterns.
- **PRAISE** — Highlight good patterns. Well-structured code, thorough error handling, clean abstractions.

## Execution Protocol

### Phase 1: Scope Analysis

Parse the diff to understand:
1. What changed — files, functions, modules affected
2. Change type — new feature, bug fix, refactor, config change
3. Risk areas — security-sensitive code (auth, crypto, input parsing), data mutations, public API changes
4. Language and framework context from file extensions and imports

Context gate: "Reviewing {N} files across {modules}. Risk areas: {list}."

### Phase 2: Code Review

For each changed file, review the diff (not the entire file) for:
1. **Correctness** — Logic errors, off-by-one, null/nil handling, race conditions
2. **Security** — Injection vectors (SQL, XSS, command), hardcoded secrets, missing auth checks
3. **Error handling** — Swallowed errors, missing cleanup, panic/crash paths
4. **Design** — SOLID violations, premature abstraction, missing abstractions (rule of three)
5. **Performance** — N+1 queries, unbounded allocations, missing pagination

Only review what changed in the diff. Do not review unchanged surrounding code.

### Phase 3: Evidence Collection

For every finding:
1. Cite the exact `file:line` where the issue occurs
2. Include a 1-5 line code snippet from the diff showing the problem
3. Explain WHY it's a problem (not just WHAT)
4. Suggest a concrete fix when possible

### Phase 4: Summary

Aggregate findings into a verdict:
1. Count findings by severity
2. Determine verdict: `approve` if zero BLOCKERs, `request-changes` if any BLOCKERs
3. Write a 2-3 sentence executive summary

## Output Format

```json
{
  "verdict": "approve|request-changes",
  "summary": "Clean implementation of auth middleware. 1 warning about missing rate limit on login endpoint.",
  "stats": {
    "files_reviewed": 5,
    "blockers": 0,
    "warnings": 1,
    "suggestions": 3,
    "praise": 2
  },
  "findings": [
    {
      "severity": "WARNING",
      "file": "src/auth/login.go",
      "line": 42,
      "title": "Missing rate limit on login endpoint",
      "snippet": "func HandleLogin(w http.ResponseWriter, r *http.Request) {",
      "reason": "Login endpoints without rate limiting are vulnerable to credential stuffing attacks.",
      "suggestion": "Add rate limiting middleware before this handler."
    },
    {
      "severity": "PRAISE",
      "file": "src/auth/middleware.go",
      "line": 15,
      "title": "Clean error wrapping with context",
      "snippet": "return fmt.Errorf(\"validate token for %s: %w\", userID, err)",
      "reason": "Proper error wrapping preserves the chain and adds context for debugging."
    }
  ]
}
```

## Guardrails

- Review the DIFF only — do not critique unchanged code.
- Every finding MUST have a file:line citation and code snippet. No vague observations.
- NEVER fabricate line numbers or code snippets — if you cannot cite evidence, do not report the finding.
- Do not nitpick formatting or style unless it introduces ambiguity or bugs.
- PRAISE good patterns — code review is not just fault-finding.
- NEVER offer follow-up options — this is a single-shot execution.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [srinidhis05](https://github.com/srinidhis05)
- **Source:** [srinidhis05/agentura](https://github.com/srinidhis05/agentura)
- **License:** Apache-2.0
- **Homepage:** https://agenturaai.tech

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** yes
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-srinidhis05-agentura-pr-code-reviewer
- Seller: https://agentstack.voostack.com/s/srinidhis05
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.