skills.rest
yamadashy
yamadashyCOMMUNITY
Explore all skills by this author →
𝕏@yamadashyGitHub

pr-vet

Analyze pull requests for security vulnerabilities using author reputation and code diff scanning.

7|1|Updated May 30, 2026
Search Tags:#code review#pull request#security#vetting#supply-chain risk
One-click install
npx skills add https://github.com/yamadashy/skills --skill pr-vet
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pr-vet
Source: https://github.com/yamadashy/skills/tree/main/skills/pr-vet
Command: npx skills add https://github.com/yamadashy/skills --skill pr-vet

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires gh, jq, grep, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill ensures the safety of pull requests by rigorously analyzing them for potential security risks, preventing vulnerabilities from being introduced into the codebase.

Core Features & Use Cases

  • Author Reputation Analysis: Checks the author's account age, consistency of identity and email, previous contributions, and other signals.
  • Technical Diff Scanning: Inspects the pull request for sensitive file changes, install-time execution, obfuscation, credential harvest, hidden characters, homoglyphs, network egress, removed guards, lockfile substitution, packed blobs, and other indicators of malicious intent.
  • Current Supply-Chain Attack Techniques: Maps the pull request against the latest known attack patterns.
  • Evidence-Based Verdict: Provides a calibrated conclusion on the trustworthiness of the pull request, including residual risks.

Quick Start

Run 'pr-vet on <OWNER/REPO>#<PR>' to check the pull request for supply-chain risks.

Frequently Asked Questions about pr-vet

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I vet a pull request for supply-chain risk?▼

Vetting a pull request for supply-chain risk involves analyzing author reputation and technical code changes. This Skill evaluates account age, scans diffs for hidden characters or obfuscation, and maps against current attack patterns to provide a calibrated verdict.

What does supply-chain code review look for in a pull request?▼

Supply-chain code review looks for sensitive file changes, install-time execution, obfuscation, credential harvest, hidden characters, homoglyphs, network egress, lockfile substitution, and packed blobs indicating malicious intent.

Can I use GitHub API data to check author reputation during code review?▼

Yes, you can check author reputation during code review using GitHub API data. The analysis evaluates the author's account age, identity and email consistency, and previous contributions to determine trustworthiness.

Do I need GitHub CLI and Python to scan pull requests for security vulnerabilities?▼

Yes, you need GitHub CLI (gh), Python3, jq, and grep installed to scan pull requests for security vulnerabilities. These dependencies are required to retrieve untrusted data and execute predefined security checks.

How does a pull request security check map against known attack techniques?▼

A pull request security check maps against known attack techniques by comparing technical diff scans with current supply-chain attack patterns. This evidence-based process yields a calibrated conclusion on trustworthiness and residual risks.

Related Skills

Explore More Software Engineering Skills→
tile-aitile-ai
346

tilelang-github-operations

Install GitHub CLI and create pull requests via authenticated workflows.

Official
Advanced
RuifengFuRuifengFu

skill-vetter

Review AI agent skills for malicious patterns and permission risks.

Community
Advanced
salmanabdurrahmansalmanabdurrahman

supply-chain-dependencies

Analyze dependency manifests and lockfiles for known vulnerabilities and maintenance risks.

Community
Advanced
hackefellerhackefeller
1

asset-integration-security

Assess and mitigate security risks in third-party asset integrations.

Official
Basic