audit-review

Verify PR review findings, sweep defect classes, and resolve review threads before merge.

5|3|Updated Sep 9, 2026
One-click install
npx skills add https://github.com/SalesforceLabs/revenue-cloud-foundations --skill audit-review-salesforcelabs
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: audit-review
Source: https://github.com/SalesforceLabs/revenue-cloud-foundations/tree/main/.cursor/skills/audit-review
Command: npx skills add https://github.com/SalesforceLabs/revenue-cloud-foundations --skill audit-review-salesforcelabs

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Automated PR reviewers (Codex, Copilot) generate findings that are sometimes wrong, duplicated, or only partially fixed, and release branches mirrored to internal Salesforce audit agents must close every thread. This Skill provides a disciplined playbook for verifying each finding against the actual code, sweeping the entire defect class across the feature, and closing every review thread with evidence. ## Core Features & Use Cases - Finding triage and verification: Classify each bot comment as real, partial, or false-positive by reading the cited code, then sweep the whole class (e.g., all missing WITH USER_MODE queries) rather than patching one line. - Thread resolution protocol: Reply in-thread with the resolution and commit SHA, react to valid comments, resolve threads via GraphQL, and confirm zero unresolved threads across all pages. - Pre-merge main comparison audit: Detect branch-scope contamination (FOREIGN/STACKED commits), branch-side reverts of main content, and overlapping file changes before merging long-running branches. - Use Case: Before promoting release branch 264 to main, run the deep audit: verify a Copilot finding about missing user-mode SOQL, sweep all 20 queries in the feature instead of the flagged 5, commit one cohesive fix, and close every review thread so the internal Salesforce audit finds nothing. ## Quick Start Ask the agent to process the automated review comments on your pull request using the audit-review skill, verifying each finding, sweeping its defect class, and resolving every thread.

Frequently Asked Questions about audit-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I handle automated PR review comments from Copilot or Codex?

Verify each comment against the actual code first, classifying it as real, partial, or false-positive. Fix valid findings as a whole class across the feature, reply in-thread with the commit SHA, react to valid comments, and resolve the thread via GraphQL.

How do I resolve GitHub PR review threads with the API?

Thread resolution requires GraphQL, not REST. Query reviewThreads under repository(owner,name){ pullRequest(number) } with pagination, then call the resolveReviewThread mutation for each unresolved thread ID until zero remain.

What is a completeness sweep in code review?

A completeness sweep fixes every instance of a defect pattern across the whole feature, not just the line a bot flagged. For example, a finding about 5 missing WITH USER_MODE clauses was swept to all 20 queries in the affected controllers.

How do I check if a branch contains commits it does not own?

Run python scripts/ai/check_branch_scope.py --pr <n> before merging. It reports FOREIGN findings for content already upstream via git cherry patch-id matching, and STACKED findings for branches built on another open PR's head.

Why can a clean merge-base diff still hide a regression?

When a branch is rebased onto main's tip, the merge-base equals main's tip, so the overlap check finds nothing even if the branch reverted main content. Diff the branch against main directly and rank files by deletions to catch reverts.

When should I not trust an automated review finding?

Never take a bot finding at face value; bots are sometimes wrong, such as false claims about getMap() key casing. Verify against the source, and refute false positives with evidence in the thread reply instead of changing correct code.