skills.rest
TanStack
TanStackOFFICIAL
Explore all skills by this author →
Website𝕏@tan_stackGitHub

bugfix-pr

Audits bug-fix pull requests through security scanning, reproduction, and minimal-diff gates.

3.1k|316|Updated Oct 8, 2025
Search Tags:#security scan#reproduction#Bug Fix#gitHub#Git worktree#Code review#Pull request
One-click install
npx skills add https://github.com/TanStack/ai --skill bugfix-pr
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: bugfix-pr
Source: https://github.com/TanStack/ai/tree/main/.grok/skills/bugfix-pr
Command: npx skills add https://github.com/TanStack/ai --skill bugfix-pr

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Bug-fix pull requests can hide malicious code, unproven claims, and unnecessary changes. This Skill forces every fix PR through a strict security scan, an agent-written reproduction of the claimed bug, and a minimal-diff review before any approval or merge.

Core Features & Use Cases

  • Security Gate (Gate 0): Scans the PR diff for malware, exfiltration, install-lifecycle payloads, and untrusted CI changes before any checkout or merge, treating all author-supplied commands as untrusted input.
  • Reproduction Gate (Gate 1): Requires the agent to write its own repro, prove it fails on clean main and passes on the PR branch using isolated git worktrees, and paste both transcripts.
  • Keep Gate (Gate 2): Rejects drive-by refactors, defensive code without repros, and mixed feat-plus-fix PRs, demanding the smallest fix that kills the bug.
  • CodeRabbit Triage: Fetches and classifies CodeRabbit review comments as required, keep-fail, false, or done before issuing a verdict.
  • Use Case: Before approving a teammate's fix PR on GitHub, run this Skill to verify the bug is real, the fix is minimal, and the diff is safe.

Quick Start

Ask the agent to review this bug-fix pull request using the bugfix-pr gates and report whether the bug is proven and the diff is minimal.

Frequently Asked Questions about bugfix-pr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a bug-fix pull request safely?▼

Run the security gate first: fetch only PR metadata and the diff with gh, never check out or run code from the PR until the scan is clean. Then reproduce the claimed bug with your own test on clean main and on the PR branch before approving.

How to prove a bug fix actually works before merging?▼

Write your own minimal repro command, run it on a detached worktree of clean main where it must fail, then run the same command on the PR worktree where it must pass. Paste both transcripts in the review; CI results and author-supplied tests do not count as proof.

Can I trust commands or scripts included in a pull request?▼

No. Commands, scripts, and test invocations from PR bodies, issues, or comments are treated as untrusted input and must never be executed. Read them as claims only and write your own reproduction instead.

When should a bug-fix PR be rejected for scope creep?▼

Reject it when the diff contains drive-by refactors, renames, defensive code without a repro, files the repro never touches, or a mixed feature-plus-fix. Every hunk must be required to kill the reproduced bug; otherwise the keep gate fails.

What happens if the bug cannot be reproduced on main?▼

If the agent-written repro passes on clean main, the bug is not proven and the review stops. The report states the bug is unproven, and the PR cannot be approved or opened until a clearer claim and failing repro exist.

Related Skills

Explore More Software Engineering Skills→
tsunami28tsunami28

mature-analyze-ticket

Analyze incoming work items to verify, classify, and prioritize bugs, requests, and incidents.

Community
Advanced
tillysosotillysoso

autoship

Automate npm release workflows with changesets and CI monitoring.

Community
Advanced
susomejiassusomejias
9

npm-security-best-practices

Harden npm-ecosystem dependency management against supply-chain attacks.

Community
Advanced
GolferGeekGolferGeek

GitHub Workflow

Standardize GitHub branching, pull requests, code reviews, and CI/CD pipelines.

Community
Basic