pr-vet

Analyze pull requests for security vulnerabilities using author reputation and code diff scanning.

7|1|Updated May 30, 2026

Search Tags:#code review #pull request #security #vetting #supply-chain risk

Ready to run

npx skills add https://github.com/yamadashy/skills --skill pr-vet

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: pr-vet
Source: https://github.com/yamadashy/skills/tree/main/skills/pr-vet
Command: npx skills add https://github.com/yamadashy/skills --skill pr-vet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, jq, grep, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill ensures the safety of pull requests by rigorously analyzing them for potential security risks, preventing vulnerabilities from being introduced into the codebase.

Core Features & Use Cases

Author Reputation Analysis: Checks the author's account age, consistency of identity and email, previous contributions, and other signals.
Technical Diff Scanning: Inspects the pull request for sensitive file changes, install-time execution, obfuscation, credential harvest, hidden characters, homoglyphs, network egress, removed guards, lockfile substitution, packed blobs, and other indicators of malicious intent.
Current Supply-Chain Attack Techniques: Maps the pull request against the latest known attack patterns.
Evidence-Based Verdict: Provides a calibrated conclusion on the trustworthiness of the pull request, including residual risks.

Quick Start

Run 'pr-vet on <OWNER/REPO>#<PR>' to check the pull request for supply-chain risks.

Frequently Asked Questions about pr-vet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I vet a pull request for supply-chain risk?▼

Vetting a pull request for supply-chain risk involves analyzing author reputation and technical code changes. This Skill evaluates account age, scans diffs for hidden characters or obfuscation, and maps against current attack patterns to provide a calibrated verdict.

What does supply-chain code review look for in a pull request?▼

Supply-chain code review looks for sensitive file changes, install-time execution, obfuscation, credential harvest, hidden characters, homoglyphs, network egress, lockfile substitution, and packed blobs indicating malicious intent.

Can I use GitHub API data to check author reputation during code review?▼

Yes, you can check author reputation during code review using GitHub API data. The analysis evaluates the author's account age, identity and email consistency, and previous contributions to determine trustworthiness.

Do I need GitHub CLI and Python to scan pull requests for security vulnerabilities?▼

Yes, you need GitHub CLI (gh), Python3, jq, and grep installed to scan pull requests for security vulnerabilities. These dependencies are required to retrieve untrusted data and execute predefined security checks.

How does a pull request security check map against known attack techniques?▼

A pull request security check maps against known attack techniques by comparing technical diff scans with current supply-chain attack patterns. This evidence-based process yields a calibrated conclusion on trustworthiness and residual risks.