How do I install the Pull Remote skill?

Run npx skillmds@latest add krzysztofdudek/pull-remote in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pull Remote safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pull Remote?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pull Remote free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pull Remote?

krzysztofdudek (@krzysztofdudek) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pull Remote by krzysztofdudek — Agent Skill

Name: Pull Remote
Author: krzysztofdudek

Pull Remote

Use when the user wants to fetch or refresh remote rules — "pull rules from upstream", "update remote rules", "fetch latest rule version", "sync remote rules" — or right after editing `remote_rules` in `.autoreview/config.yaml`. Also use when a review fails because a referenced remote rule isn't yet on disk. Skip when no `remote_rules` are declared in config (the tool will warn and exit cleanly anyway).

File contents

AutoReview Pull-Remote

Cross-platform. Snippets below use bash-style env-var syntax (${CLAUDE_PLUGIN_ROOT}). Claude Code's Bash tool runs Git Bash on Windows so these work as-is; on native PowerShell substitute $env:CLAUDE_PLUGIN_ROOT, on cmd use %CLAUDE_PLUGIN_ROOT%. Plugin requires Node ≥22 and git on PATH — those are the assumed binaries.

Fetch every remote_rules source declared in .autoreview/config.yaml. Each source is cloned into .autoreview/remote_rules/<name>/<ref>/ and gets a .autoreview-managed sentinel file.

Default — pull everything

node ${CLAUDE_PLUGIN_ROOT}/scripts/bin/pull-remote.mjs

Pull one source by name

node ${CLAUDE_PLUGIN_ROOT}/scripts/bin/pull-remote.mjs <source-name>

Use this when the user wants to refresh just one (--name shared in config → invoke with shared).

Refresh semantics

Re-running pull-remote is idempotent and the right way to update:

With ref: "v1.2.0" (a tag) — nothing changes unless the tag has been moved upstream. Bump ref in config and re-pull to switch versions.
With ref: "main" (a branch) — re-running picks up new commits from that branch.

After fetching — overlay validation

After a successful pull, warn if any remote_rules[<name>].overrides entry references a rule id that is not present in the freshly fetched ref:

[warn] override for 'corp-standards/legacy-rule' but rule absent in fetched ref v1.3.0

This means the upstream maintainer removed or renamed a rule you had overridden. The override config is kept (you may re-add the rule upstream or clean up the stale override), but the warning surfaces the drift. Use autoreview:override-rule to inspect and clean up stale overrides.

Safety mechanisms

Sentinel-protected wipe. The tool refuses to wipe a target dir containing non-markdown files unless a .autoreview-managed sentinel is present — protects against accidentally nuking a hand-edited local copy.
Hardened git invocation. git clone runs with GIT_CONFIG_NOSYSTEM=1 and core.hooksPath=/dev/null to prevent a hostile rule repo from running hooks on the user's machine.
URL/ref validation. URLs must use https://, http://, git://, ssh://, file://, a POSIX absolute path, or a Windows drive-letter absolute path. URLs starting with - are rejected (prevents --upload-pack=evil). Refs cannot contain .., leading /, or leading -.

Reporting

Report pulled <name>@<ref> -> .autoreview/remote_rules/<name>/<ref>/ per source, or the warning if no sources are declared. If a pull fails, surface the git error verbatim — usually it's an auth issue (wrong ref, private repo without credentials) that the user has to resolve outside the tool.

---name: pull-remotedescription: Use when the user wants to fetch or refresh remote rules — "pull rules from upstream", "update remote rules", "fetch latest rule version", "sync remote rules" — or right after editing `remote_rules` in `.autoreview/config.yaml`. Also use when a review fails because a referenced remote rule isn't yet on disk. Skip when no `remote_rules` are declared in config (the tool will warn and exit cleanly anyway).---# AutoReview Pull-Remote> **Cross-platform.** Snippets below use bash-style env-var syntax (`${CLAUDE_PLUGIN_ROOT}`). Claude Code's Bash tool runs Git Bash on Windows so these work as-is; on native PowerShell substitute `$env:CLAUDE_PLUGIN_ROOT`, on cmd use `%CLAUDE_PLUGIN_ROOT%`. Plugin requires Node ≥22 and `git` on PATH — those are the assumed binaries.Fetch every `remote_rules` source declared in `.autoreview/config.yaml`. Each source is cloned into `.autoreview/remote_rules/<name>/<ref>/` and gets a `.autoreview-managed` sentinel file.## Default — pull everything```node ${CLAUDE_PLUGIN_ROOT}/scripts/bin/pull-remote.mjs```## Pull one source by name```node ${CLAUDE_PLUGIN_ROOT}/scripts/bin/pull-remote.mjs <source-name>```Use this when the user wants to refresh just one (`--name shared` in config → invoke with `shared`).## Refresh semanticsRe-running pull-remote is idempotent and the right way to update:- With `ref: "v1.2.0"` (a tag) — nothing changes unless the tag has been moved upstream. Bump `ref` in config and re-pull to switch versions.- With `ref: "main"` (a branch) — re-running picks up new commits from that branch.## After fetching — overlay validationAfter a successful pull, warn if any `remote_rules[<name>].overrides` entry references a rule id that is not present in the freshly fetched ref:```[warn] override for 'corp-standards/legacy-rule' but rule absent in fetched ref v1.3.0```This means the upstream maintainer removed or renamed a rule you had overridden. The override config is kept (you may re-add the rule upstream or clean up the stale override), but the warning surfaces the drift. Use `autoreview:override-rule` to inspect and clean up stale overrides.## Safety mechanisms- **Sentinel-protected wipe.** The tool refuses to wipe a target dir containing non-markdown files unless a `.autoreview-managed` sentinel is present — protects against accidentally nuking a hand-edited local copy.- **Hardened git invocation.** `git clone` runs with `GIT_CONFIG_NOSYSTEM=1` and `core.hooksPath=/dev/null` to prevent a hostile rule repo from running hooks on the user's machine.- **URL/ref validation.** URLs must use `https://`, `http://`, `git://`, `ssh://`, `file://`, a POSIX absolute path, or a Windows drive-letter absolute path. URLs starting with `-` are rejected (prevents `--upload-pack=evil`). Refs cannot contain `..`, leading `/`, or leading `-`.## ReportingReport `pulled <name>@<ref> -> .autoreview/remote_rules/<name>/<ref>/` per source, or the warning if no sources are declared. If a pull fails, surface the git error verbatim — usually it's an auth issue (wrong ref, private repo without credentials) that the user has to resolve outside the tool.

Frequently asked questions