review-pr

Reviews pull requests with parallel review agents and a security pass, applying fixes or posting inline comments.

5|1|Updated Mar 7, 2026
One-click install
npx skills add https://github.com/ai-hero/hero-skills --skill review-pr-ai-hero
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: review-pr
Source: https://github.com/ai-hero/hero-skills/tree/main/skills/review-pr
Command: npx skills add https://github.com/ai-hero/hero-skills --skill review-pr-ai-hero

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Reviewing pull requests thoroughly is time-consuming and inconsistent: small diffs get over-reviewed, large diffs get skimmed, and security issues slip through. This Skill automates context-aware PR review on GitHub, detecting whether you are reviewing your own draft PR or someone else's code and running the right workflow for each. ## Core Features & Use Cases - Dual review modes: Self-review mode runs review agents, posts findings, applies approved fixes, pushes commits, and optionally marks the PR ready; review mode posts inline comments and submits an approve/comment/request-changes decision without editing code. - Diff-scaled agent fan-out: Measures changed lines and files to pick a review tier, from inline review for tiny diffs up to six parallel agents (code-reviewer, silent-failure-hunter, pr-test-analyzer, comment-analyzer, type-design-analyzer, plus a security pass) for large ones. - Security-first review: Every tier includes a security-focused pass checking for injection, XSS, auth flaws, secrets, SSRF, and other exploitable vulnerabilities, with content-based overrides for auth, crypto, migrations, and shared workflows. - Use Case: After pushing a draft PR, run the skill with no arguments to self-review your branch, apply critical and important fixes automatically, and mark the PR ready for human review. ## Quick Start Ask the AI to review the pull request for the current branch, or pass a PR number such as #42 to review a specific pull request.

Frequently Asked Questions about review-pr

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I review a pull request automatically with Claude Code?▼

Run the review-pr skill with no arguments to auto-detect the PR on your current branch, or pass a PR number or URL. It detects whether the PR is yours or someone else's and runs self-review or review mode accordingly.

What review agents does the pr-review-toolkit provide?▼

The pr-review-toolkit plugin provides five agents: code-reviewer, silent-failure-hunter, pr-test-analyzer, comment-analyzer, and type-design-analyzer. The skill adds a sixth security-focused pass that checks for injection, XSS, auth flaws, secrets, and SSRF.

Does review-pr require the GitHub CLI?▼

Yes, the gh CLI must be installed and authenticated with the repo scope for all PR, comment, and workflow operations. Without it, every step of the skill fails immediately.

Can I run a self-review without marking the PR ready?▼

Yes, pass the --no-mark-ready flag to run all review and fix steps but skip the mark-ready prompt and gh pr ready call. This is used by the one-shot pipeline to keep mark-ready as a separate step.

Why does review-pr skip agents on small diffs?▼

Diffs under roughly 50 lines are reviewed inline without launching agents, since a full six-agent fan-out would bury real findings in empty reports. Security is still checked manually, and sensitive content like auth or workflows always triggers the full review.

What happens when review-pr finds a rebase conflict?▼

If rebasing the PR branch onto the base branch hits a conflict, the rebase is aborted, the branch is left unchanged, and the skill stops with the conflicting files listed. It never resolves conflicts on the user's behalf.