cnb-code-review

Reviews pull request diffs for security vulnerabilities and bugs, then posts line-level comments via the CNB API.

3|1|Updated Feb 26, 2026
One-click install
npx skills add https://github.com/wopal-cn/wopal-space-ontology --skill cnb-code-review-wopal-cn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cnb-code-review
Source: https://github.com/wopal-cn/wopal-space-ontology/tree/main/skills/cnb-code-review
Command: npx skills add https://github.com/wopal-cn/wopal-space-ontology --skill cnb-code-review-wopal-cn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manual pull request review is time-consuming and inconsistent, often missing security vulnerabilities, bugs, and quality issues. This Skill standardizes PR review by analyzing diffs against prioritized checks and posting structured line-level feedback directly to the pull request. ## Core Features & Use Cases - Prioritized Issue Detection: Checks for security vulnerabilities (SQL injection, XSS, hardcoded credentials), potential bugs (null pointers, concurrency issues), code quality, and performance problems in priority order. - Structured JSON Output: Produces a strict JSON result with status (passed/needs_modification/critical) and issues containing severity, file, line ranges, problem, and suggestion. - Automated Review Comments: Posts up to 10 line-level review comments via the CNB PostPullReview API, or a summary comment when no issues are found. - Use Case: A CI pipeline triggers on a new pull request; the Skill fetches the diff, filters out lock files and build artifacts, reviews up to 30 changed files, and posts inline comments flagging a hardcoded API key and an N+1 query. ## Quick Start Review the current pull request for security vulnerabilities and bugs, then post line-level comments with your findings.

Frequently Asked Questions about cnb-code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate pull request code review?▼

Fetch the PR diff, filter out non-code files like lock files and build artifacts, then analyze only added lines for security vulnerabilities, bugs, and quality issues. Post findings as line-level comments through the platform's review API.

What does an automated code review check for?▼

It checks security vulnerabilities such as SQL injection, XSS, and hardcoded credentials first, then potential bugs like null pointers and resource leaks, followed by code quality and performance issues such as N+1 queries.

Which files are excluded from PR diff review?▼

Dependency lock files, images, fonts, binaries, archives, minified code, and build output directories like dist/, node_modules/, and vendor/ are excluded. Reviews are limited to 30 files and 100000 diff characters.

What environment variables does the CNB review API need?▼

It requires CNB_API_ENDPOINT for the API base URL, CNB_REPO_SLUG for the repository, CNB_PULL_REQUEST_IID for the PR number, and CNB_TOKEN for Bearer authentication when posting review comments.

Why are review comments limited in automated PR review?▼

Comments are capped at 10 per review to avoid overwhelming authors, prioritizing critical issues over warnings and info-level suggestions. Line numbers must match the new file's right-side diff positions.