review-pr

Reviews pull requests with parallel review agents and a security pass, applying fixes or posting inline comments.

5|1|Updated Mar 7, 2026
One-click install
npx skills add https://github.com/ai-hero/hero-skills --skill review-pr-ai-hero
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: review-pr
Source: https://github.com/ai-hero/hero-skills/tree/main/skills/review-pr
Command: npx skills add https://github.com/ai-hero/hero-skills --skill review-pr-ai-hero

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing pull requests thoroughly is time-consuming and inconsistent: small diffs get over-reviewed, large diffs get skimmed, and security issues slip through. This Skill automates context-aware PR review on GitHub, detecting whether you are reviewing your own draft PR or someone else's code and running the right workflow for each. ## Core Features & Use Cases - Dual review modes: Self-review mode runs review agents, posts findings, applies approved fixes, pushes commits, and optionally marks the PR ready; review mode posts inline comments and submits an approve/comment/request-changes decision without editing code. - Diff-scaled agent fan-out: Measures changed lines and files to pick a review tier, from inline review for tiny diffs up to six parallel agents (code-reviewer, silent-failure-hunter, pr-test-analyzer, comment-analyzer, type-design-analyzer, plus a security pass) for large ones. - Security-first review: Every tier includes a security-focused pass checking for injection, XSS, auth flaws, secrets, SSRF, and other exploitable vulnerabilities, with content-based overrides for auth, crypto, migrations, and shared workflows. - Use Case: After pushing a draft PR, run the skill with no arguments to self-review your branch, apply critical and important fixes automatically, and mark the PR ready for human review. ## Quick Start Ask the AI to review the pull request for the current branch, or pass a PR number such as #42 to review a specific pull request.

Frequently Asked Questions about review-pr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request automatically with Claude Code?

Run the review-pr skill with no arguments to auto-detect the PR on your current branch, or pass a PR number or URL. It detects whether the PR is yours or someone else's and runs self-review or review mode accordingly.

What review agents does the pr-review-toolkit provide?

The pr-review-toolkit plugin provides five agents: code-reviewer, silent-failure-hunter, pr-test-analyzer, comment-analyzer, and type-design-analyzer. The skill adds a sixth security-focused pass that checks for injection, XSS, auth flaws, secrets, and SSRF.

Does review-pr require the GitHub CLI?

Yes, the gh CLI must be installed and authenticated with the repo scope for all PR, comment, and workflow operations. Without it, every step of the skill fails immediately.

Can I run a self-review without marking the PR ready?

Yes, pass the --no-mark-ready flag to run all review and fix steps but skip the mark-ready prompt and gh pr ready call. This is used by the one-shot pipeline to keep mark-ready as a separate step.

Why does review-pr skip agents on small diffs?

Diffs under roughly 50 lines are reviewed inline without launching agents, since a full six-agent fan-out would bury real findings in empty reports. Security is still checked manually, and sensitive content like auth or workflows always triggers the full review.

What happens when review-pr finds a rebase conflict?

If rebasing the PR branch onto the base branch hits a conflict, the rebase is aborted, the branch is left unchanged, and the skill stops with the conflicting files listed. It never resolves conflicts on the user's behalf.