How do I install the Pr Reviewer skill?

Run npx skillmds@latest add whyzsm/pr-reviewer in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Pr Reviewer safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Pr Reviewer?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Pr Reviewer free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Pr Reviewer?

whyzsm (@whyzsm) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Pr Reviewer by whyzsm — Agent Skill

Name: Pr Reviewer
Author: whyzsm

Pr Reviewer

Automated GitHub pull request review workflow with diff analysis, optional lint checks, changed-file risk assessment, security/error-handling/test-coverage findings, and structured review reports. Use when the user asks to review a GitHub PR, inspect a pull request diff, check PR risk, run local lint as part of review, or prepare PR feedback. Requires the gh CLI when fetching GitHub PRs directly.

whyzsm 739e96b 6 files · 24.7 KB Updated Sep 17, 2026

File contents

PR Reviewer

Automated code review for GitHub pull requests and local PR-style diffs. Analyzes diffs for security issues, error handling gaps, style problems, and test coverage.

Prerequisites

gh CLI installed and authenticated (gh auth status)
Repository access (read at minimum, write for posting comments)
Optional: golangci-lint for Go linting, ruff for Python linting

Quick Start

# Review all open PRs in current repo
scripts/pr-review.sh check

# Review a specific PR
scripts/pr-review.sh review 42

# Post review as GitHub comment
scripts/pr-review.sh post 42

# Check status of all open PRs
scripts/pr-review.sh status

# List unreviewed PRs (useful for heartbeat/cron integration)
scripts/pr-review.sh list-unreviewed

Configuration

Set these environment variables or the script auto-detects from the current git repo:

PR_REVIEW_REPO — GitHub repo in owner/repo format (default: detected from gh repo view)
PR_REVIEW_DIR — Local checkout path for lint (default: git root of cwd)
PR_REVIEW_STATE — State file path (default: ./data/pr-reviews.json)
PR_REVIEW_OUTDIR — Report output directory (default: ./data/pr-reviews/)

Directories Written

PR_REVIEW_STATE (default: ./data/pr-reviews.json) — Tracks reviewed PRs and their HEAD SHAs
PR_REVIEW_OUTDIR (default: ./data/pr-reviews/) — Markdown review reports

What It Checks

Category	Icon	Examples
Security	🔴	Hardcoded credentials, AWS keys, secrets in code
Error Handling	🟡	Discarded errors (Go `_ :=`), bare `except:` (Python), unchecked `Close()`
Risk	🟠	`panic()` calls, `process.exit()`
Style	🔵	`fmt.Print`/`print()`/`console.log` in prod, very long lines
TODOs	📝	TODO, FIXME, HACK, XXX markers
Test Coverage	📊	Source files changed without corresponding test changes

Smart Re-Review

Tracks HEAD SHA per PR. Only re-reviews when new commits are pushed. Use review <PR#> to force re-review.

Report Format

Reports are saved as markdown files in the output directory. Each report includes:

PR metadata (author, branch, changes)
Commit list
Changed file categorization by language/type
Automated diff findings with file, line, category, and context
Test coverage analysis
Local lint results (when repo is checked out locally)
Summary verdict: 🔴 SECURITY / 🟡 NEEDS ATTENTION / 🔵 MINOR NOTES / ✅ LOOKS GOOD

Heartbeat/Cron Integration

Add to a periodic check (heartbeat, cron job, or CI):

UNREVIEWED=$(scripts/pr-review.sh list-unreviewed)
if [ -n "$UNREVIEWED" ]; then
  scripts/pr-review.sh check
fi

Extending

The analysis patterns in the script are organized by language. Add new patterns by appending to the relevant pattern list in the analyze_diff() function:

# Add a new Go pattern
go_patterns.append((r'^\+.*os\.Exit\(', 'RISK', 'Direct os.Exit() — consider returning error'))

---name: pr-reviewerdescription: Automated GitHub pull request review workflow with diff analysis, optional lint checks, changed-file risk assessment, security/error-handling/test-coverage findings, and structured review reports. Use when the user asks to review a GitHub PR, inspect a pull request diff, check PR risk, run local lint as part of review, or prepare PR feedback. Requires the gh CLI when fetching GitHub PRs directly.---# PR ReviewerAutomated code review for GitHub pull requests and local PR-style diffs. Analyzes diffs for security issues, error handling gaps, style problems, and test coverage.## Prerequisites- `gh` CLI installed and authenticated (`gh auth status`)- Repository access (read at minimum, write for posting comments)- Optional: `golangci-lint` for Go linting, `ruff` for Python linting## Quick Start```bash# Review all open PRs in current reposcripts/pr-review.sh check# Review a specific PRscripts/pr-review.sh review 42# Post review as GitHub commentscripts/pr-review.sh post 42# Check status of all open PRsscripts/pr-review.sh status# List unreviewed PRs (useful for heartbeat/cron integration)scripts/pr-review.sh list-unreviewed```## ConfigurationSet these environment variables or the script auto-detects from the current git repo:- `PR_REVIEW_REPO` — GitHub repo in `owner/repo` format (default: detected from `gh repo view`)- `PR_REVIEW_DIR` — Local checkout path for lint (default: git root of cwd)- `PR_REVIEW_STATE` — State file path (default: `./data/pr-reviews.json`)- `PR_REVIEW_OUTDIR` — Report output directory (default: `./data/pr-reviews/`)## Directories Written- **`PR_REVIEW_STATE`** (default: `./data/pr-reviews.json`) — Tracks reviewed PRs and their HEAD SHAs- **`PR_REVIEW_OUTDIR`** (default: `./data/pr-reviews/`) — Markdown review reports## What It Checks| Category | Icon | Examples ||----------|------|----------|| Security | 🔴 | Hardcoded credentials, AWS keys, secrets in code || Error Handling | 🟡 | Discarded errors (Go `_ :=`), bare `except:` (Python), unchecked `Close()` || Risk | 🟠 | `panic()` calls, `process.exit()` || Style | 🔵 | `fmt.Print`/`print()`/`console.log` in prod, very long lines || TODOs | 📝 | TODO, FIXME, HACK, XXX markers || Test Coverage | 📊 | Source files changed without corresponding test changes |## Smart Re-ReviewTracks HEAD SHA per PR. Only re-reviews when new commits are pushed. Use `review <PR#>` to force re-review.## Report FormatReports are saved as markdown files in the output directory. Each report includes:- PR metadata (author, branch, changes)- Commit list- Changed file categorization by language/type- Automated diff findings with file, line, category, and context- Test coverage analysis- Local lint results (when repo is checked out locally)- Summary verdict: 🔴 SECURITY / 🟡 NEEDS ATTENTION / 🔵 MINOR NOTES / ✅ LOOKS GOOD## Heartbeat/Cron IntegrationAdd to a periodic check (heartbeat, cron job, or CI):```bashUNREVIEWED=$(scripts/pr-review.sh list-unreviewed)if [ -n "$UNREVIEWED" ]; then scripts/pr-review.sh checkfi```## ExtendingThe analysis patterns in the script are organized by language. Add new patterns by appending to the relevant pattern list in the `analyze_diff()` function:```python# Add a new Go patterngo_patterns.append((r'^\+.*os\.Exit\(', 'RISK', 'Direct os.Exit() — consider returning error'))```

Frequently asked questions