cnb-code-review

Reviews pull request diffs for security vulnerabilities and bugs, then posts line-level comments via the CNB API.

3|1|Updated Feb 26, 2026
One-click install
npx skills add https://github.com/wopal-cn/wopal-space-ontology --skill cnb-code-review-wopal-cn
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: cnb-code-review
Source: https://github.com/wopal-cn/wopal-space-ontology/tree/main/skills/cnb-code-review
Command: npx skills add https://github.com/wopal-cn/wopal-space-ontology --skill cnb-code-review-wopal-cn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manual pull request review is time-consuming and inconsistent, often missing security vulnerabilities, bugs, and quality issues. This Skill standardizes PR review by analyzing diffs against prioritized checks and posting structured line-level feedback directly to the pull request. ## Core Features & Use Cases - Prioritized Issue Detection: Checks for security vulnerabilities (SQL injection, XSS, hardcoded credentials), potential bugs (null pointers, concurrency issues), code quality, and performance problems in priority order. - Structured JSON Output: Produces a strict JSON result with status (passed/needs_modification/critical) and issues containing severity, file, line ranges, problem, and suggestion. - Automated Review Comments: Posts up to 10 line-level review comments via the CNB PostPullReview API, or a summary comment when no issues are found. - Use Case: A CI pipeline triggers on a new pull request; the Skill fetches the diff, filters out lock files and build artifacts, reviews up to 30 changed files, and posts inline comments flagging a hardcoded API key and an N+1 query. ## Quick Start Review the current pull request for security vulnerabilities and bugs, then post line-level comments with your findings.

Frequently Asked Questions about cnb-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate pull request code review?

Fetch the PR diff, filter out non-code files like lock files and build artifacts, then analyze only added lines for security vulnerabilities, bugs, and quality issues. Post findings as line-level comments through the platform's review API.

What does an automated code review check for?

It checks security vulnerabilities such as SQL injection, XSS, and hardcoded credentials first, then potential bugs like null pointers and resource leaks, followed by code quality and performance issues such as N+1 queries.

Which files are excluded from PR diff review?

Dependency lock files, images, fonts, binaries, archives, minified code, and build output directories like dist/, node_modules/, and vendor/ are excluded. Reviews are limited to 30 files and 100000 diff characters.

What environment variables does the CNB review API need?

It requires CNB_API_ENDPOINT for the API base URL, CNB_REPO_SLUG for the repository, CNB_PULL_REQUEST_IID for the PR number, and CNB_TOKEN for Bearer authentication when posting review comments.

Why are review comments limited in automated PR review?

Comments are capped at 10 per review to avoid overwhelming authors, prioritizing critical issues over warnings and info-level suggestions. Line numbers must match the new file's right-side diff positions.