review-pr
Diff-aware PR security review with verified findings and PR comment payload.
Best use case
review-pr is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Diff-aware PR security review with verified findings and PR comment payload.
Teams using review-pr should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/review-pr/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How review-pr Compares
| Feature / Agent | review-pr | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
Diff-aware PR security review with verified findings and PR comment payload.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Review PR Use this task skill when the user asks to review this PR, scan a PR, run a diff scan, or check a pull request for vulnerabilities. ## Workflow 1. Identify the base ref, defaulting to `origin/main` when the user does not specify one. 2. Run `/vuln-scout:diff <base>` to produce changed-code findings. 3. Call `code-reviewer` on new or changed findings only. 4. Run `/vuln-scout:verify --from .claude/diff-findings.json` for findings that affect the PR. 5. Call `false-positive-verifier` for high-impact or ambiguous results. 6. Trigger `poc-safety-check` before any dynamic validation or PoC work. 7. Render `/vuln-scout:report --format md` for the PR comment payload. 8. Optionally render `/vuln-scout:report --format bundle --output evidence-bundle` for evidence handoff. ## Produces - `.claude/diff-findings.json` - `pr-comment.md` - optional `evidence-bundle/` ## When NOT To Trigger Do not trigger for general git diff questions, style-only code review, STRIDE threat modeling, or framework-specific vulnerability education without a PR review request.
Related Skills
Workspace Discovery
This skill should be used when the user asks to "detect workspaces", "find packages", "list monorepo packages", "workspace structure", "monorepo analysis", or needs to identify workspace/package boundaries in a codebase for focused security analysis.
vulnerability-chains
This skill should be used when the user asks about "vulnerability chains", "chained exploits", "multi-step attacks", "SSRF to RCE", "pivot attacks", or needs to identify how vulnerabilities in different components can be combined during whitebox security review.
Vulnerability Patterns
This skill should be used when the user asks about "vulnerability patterns", "how to find SQL injection", "XSS patterns", "command injection techniques", "OWASP vulnerabilities", "common web vulnerabilities", "exploitation patterns", or needs to understand how specific vulnerability classes work during whitebox security review.
Threat Modeling
This skill should be used when the user asks about "threat model", "STRIDE", "data flow diagram", "attack surface", "threat analysis", "security architecture", "component threats", "trust boundaries", "technology decomposition", or needs systematic threat identification during whitebox security review.
verify-finding
Drive a single finding through CPG verification and false-positive triage.
start-audit
Guided first-run security audit: doctor, scope, threats, scan, verify, report.
scope-repo
Decide audit boundaries for large or monorepo targets and write audit-plan.md.
package-evidence
Bundle findings, reports, audit plan, and ledger into one evidence zip.
Sensitive Data Leakage
Detect ANY credential/secret flowing to ANY output sink. Use when asked about "credential leakage", "secret logging", "sensitive data exposure", "CWE-532", "password in logs", "token exposure", or security logging issues.
Security Misconfiguration
This skill should be used when the user asks about "security misconfiguration", "default credentials", "debug mode", "security headers", "exposed endpoints", "TLS configuration", or needs to find configuration-related vulnerabilities during whitebox security review.
Secret Scanning
This skill should be used when the user asks about "secret scanning", "find secrets", "hardcoded credentials", "leaked API keys", "git history secrets", "credential scanning", "detect passwords in code", or needs to identify secrets and credentials in source code or git history during whitebox security review.
Sandbox Escapes
This skill should be used when the user asks about "sandbox escape", "vm escape", "template injection to RCE", "SSTI exploitation", "vm2 bypass", "restricted execution bypass", "sandbox breakout", or needs to identify sandbox escape and template engine exploitation techniques during whitebox security review.