PR Review Expert
Structured, systematic code review for GitHub PRs and GitLab MRs. Goes beyond style nits to perform blast-radius analysis, security vulnerability scanning, breaking-change detection, test-coverage delta calculation, and performance impact assessment. Produces reviewer-ready reports with prioritized findings categorized as must-fix, should-fix, and suggestions.
Keywords: PR review, code review, pull request, merge request, blast radius, security scan, breaking changes, test coverage, review checklist, code quality
Core Capabilities
- Blast radius analysis — trace which files, services, and downstream consumers a diff could break; quantify severity CRITICAL/HIGH/MEDIUM/LOW.
- Security scanning — detect SQL injection, XSS vectors, hardcoded secrets, auth bypass, insecure crypto, path traversal, and prototype pollution in the diff.
- Breaking-change detection — flag API removals/renames, response-schema and required-field changes, DB column removals, env-var changes, and TS interface edits.
- Test coverage analysis — new-code vs new-test ratio, missing tests for new public functions, deleted tests without deleted code, coverage delta.
- Performance assessment — N+1 query patterns, bundle-size regressions, unbounded queries, missing indexes.
- Reviewer-ready output — prioritized must-fix / should-fix / suggestion report, a 35-item checklist, and consistent comment labels.
When to Use
- Before merging any PR that touches shared libraries, APIs, or database schemas.
- When a PR is large (>200 lines changed) and needs structured review.
- For PRs in security-sensitive code paths (auth, payments, PII handling).
- After an incident, to proactively review similar code changes.
- For onboarding new contributors whose PRs need thorough feedback.
Tools
| Tool |
Purpose |
Command |
blast_radius_calculator.py |
Calculate PR blast radius from import chains / dependency trees of changed files |
git diff --name-only main...HEAD | python scripts/blast_radius_calculator.py --root src |
diff_analyzer.py |
Analyze a diff for risk indicators (large files, sensitive paths, config/breaking/security patterns) |
gh pr diff $PR | python scripts/diff_analyzer.py --json |
review_checklist_generator.py |
Generate a tailored review checklist from changed file types/patterns |
git diff --name-only main...HEAD | python scripts/review_checklist_generator.py |
References
Load the reference that matches the task — keep this file lean and pull detail on demand:
- references/review-workflow-commands.md — the 6-step review workflow with the exact
gh/grep command catalog for context gathering, blast radius, security scan, breaking-change detection, coverage delta, and performance impact (plus the blast-radius severity table and coverage rules). Read when actually performing a review.
- references/writeup-format-and-checklist.md — the review report template with worked examples, the complete 35-item review checklist, and the comment-label taxonomy. Read when writing up findings.
- references/best-practices-and-troubleshooting.md — common reviewer pitfalls, best-practice habits, the troubleshooting table, and the success-criteria bar. Read before and after a review for quality control.
Scope & Limitations
This skill covers:
- Structured review of GitHub PRs and GitLab MRs using a 35+ item checklist
- Blast radius analysis for monorepo and multi-service architectures
- Static security scanning of diffs for common vulnerability patterns (SQLi, XSS, secrets, auth bypass)
- Breaking change detection for APIs, database schemas, TypeScript interfaces, and environment variables
This skill does NOT cover:
- Automated code fixes or refactoring — use
engineering/saas-scaffolder or engineering/migration-architect for code generation
- Runtime security analysis, SAST/DAST tool orchestration, or CVE database lookups — use
engineering/dependency-auditor for dependency-level vulnerability scanning
- CI/CD pipeline configuration or build failure triage — use
engineering/ci-cd-pipeline-builder for pipeline design
- Performance benchmarking or load testing — use
engineering/performance-profiler for profiling and optimization guidance
Integration Points
| Skill |
Integration |
Data Flow |
engineering/dependency-auditor |
Run dependency audit before reviewing PRs that add or upgrade packages |
Audit report feeds into the Security section of the review report |
engineering/ci-cd-pipeline-builder |
Embed review checklist gates into CI pipelines as automated PR checks |
Checklist items become pass/fail signals in the pipeline |
engineering/performance-profiler |
Escalate N+1 and unbounded query findings for detailed profiling |
Flagged code paths from review become profiling targets |
engineering/migration-architect |
Validate database migration safety for PRs that include schema changes |
Migration risk assessment supplements the Breaking Changes section |
engineering/release-manager |
Feed breaking change detection results into release notes and changelogs |
Detected breaking changes auto-populate release documentation |
engineering/api-design-reviewer |
Cross-reference API endpoint changes with API design standards |
API review findings merge into the Blast Radius and Breaking Changes sections |
1---
2name: pr-review-expert
3description: >
4 Systematic PR review with blast-radius analysis, security scanning, and breaking-change and
5 test-coverage deltas. Use when reviewing PRs that touch shared libraries, APIs, database
6 schemas, auth, or security-sensitive code.
7license: MIT + Commons Clause
8metadata:
9 version: 1.1.0
10 author: borghei
11 category: engineering
12 domain: code-review
13 tier: POWERFUL
14 updated: 2026-06-17
15 frameworks: github, gitlab, review-checklist
16---
17
18# PR Review Expert
19
20Structured, systematic code review for GitHub PRs and GitLab MRs. Goes beyond style nits to perform blast-radius analysis, security vulnerability scanning, breaking-change detection, test-coverage delta calculation, and performance impact assessment. Produces reviewer-ready reports with prioritized findings categorized as must-fix, should-fix, and suggestions.
21
22**Keywords:** PR review, code review, pull request, merge request, blast radius, security scan, breaking changes, test coverage, review checklist, code quality
23
24## Core Capabilities
25
26- **Blast radius analysis** — trace which files, services, and downstream consumers a diff could break; quantify severity CRITICAL/HIGH/MEDIUM/LOW.
27- **Security scanning** — detect SQL injection, XSS vectors, hardcoded secrets, auth bypass, insecure crypto, path traversal, and prototype pollution in the diff.
28- **Breaking-change detection** — flag API removals/renames, response-schema and required-field changes, DB column removals, env-var changes, and TS interface edits.
29- **Test coverage analysis** — new-code vs new-test ratio, missing tests for new public functions, deleted tests without deleted code, coverage delta.
30- **Performance assessment** — N+1 query patterns, bundle-size regressions, unbounded queries, missing indexes.
31- **Reviewer-ready output** — prioritized must-fix / should-fix / suggestion report, a 35-item checklist, and consistent comment labels.
32
33## When to Use
34
35- Before merging any PR that touches shared libraries, APIs, or database schemas.
36- When a PR is large (>200 lines changed) and needs structured review.
37- For PRs in security-sensitive code paths (auth, payments, PII handling).
38- After an incident, to proactively review similar code changes.
39- For onboarding new contributors whose PRs need thorough feedback.
40
41## Tools
42
43| Tool | Purpose | Command |
44|------|---------|---------|
45| `blast_radius_calculator.py` | Calculate PR blast radius from import chains / dependency trees of changed files | `git diff --name-only main...HEAD \| python scripts/blast_radius_calculator.py --root src` |
46| `diff_analyzer.py` | Analyze a diff for risk indicators (large files, sensitive paths, config/breaking/security patterns) | `gh pr diff $PR \| python scripts/diff_analyzer.py --json` |
47| `review_checklist_generator.py` | Generate a tailored review checklist from changed file types/patterns | `git diff --name-only main...HEAD \| python scripts/review_checklist_generator.py` |
48
49## References
50
51Load the reference that matches the task — keep this file lean and pull detail on demand:
52
53- **[references/review-workflow-commands.md](references/review-workflow-commands.md)** — the 6-step review workflow with the exact `gh`/`grep` command catalog for context gathering, blast radius, security scan, breaking-change detection, coverage delta, and performance impact (plus the blast-radius severity table and coverage rules). Read when actually performing a review.
54- **[references/writeup-format-and-checklist.md](references/writeup-format-and-checklist.md)** — the review report template with worked examples, the complete 35-item review checklist, and the comment-label taxonomy. Read when writing up findings.
55- **[references/best-practices-and-troubleshooting.md](references/best-practices-and-troubleshooting.md)** — common reviewer pitfalls, best-practice habits, the troubleshooting table, and the success-criteria bar. Read before and after a review for quality control.
56
57## Scope & Limitations
58
59**This skill covers:**
60- Structured review of GitHub PRs and GitLab MRs using a 35+ item checklist
61- Blast radius analysis for monorepo and multi-service architectures
62- Static security scanning of diffs for common vulnerability patterns (SQLi, XSS, secrets, auth bypass)
63- Breaking change detection for APIs, database schemas, TypeScript interfaces, and environment variables
64
65**This skill does NOT cover:**
66- Automated code fixes or refactoring — use `engineering/saas-scaffolder` or `engineering/migration-architect` for code generation
67- Runtime security analysis, SAST/DAST tool orchestration, or CVE database lookups — use `engineering/dependency-auditor` for dependency-level vulnerability scanning
68- CI/CD pipeline configuration or build failure triage — use `engineering/ci-cd-pipeline-builder` for pipeline design
69- Performance benchmarking or load testing — use `engineering/performance-profiler` for profiling and optimization guidance
70
71## Integration Points
72
73| Skill | Integration | Data Flow |
74|-------|-------------|-----------|
75| `engineering/dependency-auditor` | Run dependency audit before reviewing PRs that add or upgrade packages | Audit report feeds into the Security section of the review report |
76| `engineering/ci-cd-pipeline-builder` | Embed review checklist gates into CI pipelines as automated PR checks | Checklist items become pass/fail signals in the pipeline |
77| `engineering/performance-profiler` | Escalate N+1 and unbounded query findings for detailed profiling | Flagged code paths from review become profiling targets |
78| `engineering/migration-architect` | Validate database migration safety for PRs that include schema changes | Migration risk assessment supplements the Breaking Changes section |
79| `engineering/release-manager` | Feed breaking change detection results into release notes and changelogs | Detected breaking changes auto-populate release documentation |
80| `engineering/api-design-reviewer` | Cross-reference API endpoint changes with API design standards | API review findings merge into the Blast Radius and Breaking Changes sections |
borghei