Menu
PR 代码评审，检查安全漏洞、Bug 和代码质量，输出结构化结果并通过 API 发送行级评论。
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | cnb-code-review |
| description | PR 代码评审，检查安全漏洞、Bug 和代码质量，输出结构化结果并通过 API 发送行级评论。 |
对 PR 的代码变更进行专业评审，发现安全漏洞、Bug、代码质量和性能问题，并通过 PR Review API 发送行级评论。
使用 cnb-pr-diff Skill 获取 PR 的代码变更。
需过滤的非代码文件（不评审）：
package-lock.json, yarn.lock, pnpm-lock.yaml, go.sum, Cargo.lock 等*.png, *.jpg, *.gif, *.svg, *.ico 等*.woff, *.ttf, *.eot 等*.exe, *.dll, *.so, *.jar, *.pyc 等*.zip, *.tar.gz, *.rar 等*.min.js, *.min.css, *.mapdist/, build/, out/, target/, .next/node_modules/, vendor/, .venv/文件限制：
评审重点（按优先级）：
评审原则：
+ 开头的行，不含 +++ 文件头）- 开头）、上下文代码、未修改的代码理解上下文： 当 diff 上下文不足以理解代码时（如需要看函数定义、类型、依赖关系），使用 Read 工具读取相关源文件理解上下文，并确认准确行号。
必须严格输出以下 JSON 格式：
{
"status": "passed | needs_modification | critical",
"issues": [
{
"severity": "critical | warning | info",
"file": "文件路径",
"start_line": 起始行号,
"end_line": 结束行号,
"problem": "问题：描述问题",
"suggestion": "建议：修复建议"
}
]
}
字段说明：
status: 评审状态
passed: 通过，无问题needs_modification: 需要修改critical: 存在严重问题severity: 问题严重程度
critical: 严重（安全漏洞、崩溃 Bug）warning: 警告（潜在问题）info: 建议（代码质量改进）start_line / end_line: 问题代码的行号范围（对应新文件行号）problem / suggestion: 使用 Markdown 格式，提高可读性
无问题时：issues 为空数组 []
重要：API 基础地址从环境变量 CNB_API_ENDPOINT 获取（默认 https://api.cnb.cool），仓库名从环境变量 CNB_REPO_SLUG 获取，PR 编号从环境变量 CNB_PULL_REQUEST_IID 获取。
有问题时：调用 PostPullReview 接口发送行级评审评论：
curl -X POST \
"${CNB_API_ENDPOINT:-https://api.cnb.cool}/${CNB_REPO_SLUG}/-/pulls/${CNB_PULL_REQUEST_IID}/reviews" \
-H "Accept: application/vnd.cnb.api+json" \
-H "Authorization: Bearer $CNB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"body": "**评审结果**: 需要修改",
"event": "comment",
"comments": [
{
"body": "问题: ...\n建议: ...",
"path": "文件路径",
"start_line": 起始行号,
"start_side": "right",
"end_line": 结束行号,
"end_side": "right",
"subject_type": "line"
}
]
}'
无问题时：调用 PostPullComment 接口发送总结评论：
curl -X POST \
"${CNB_API_ENDPOINT:-https://api.cnb.cool}/${CNB_REPO_SLUG}/-/pulls/${CNB_PULL_REQUEST_IID}/comments" \
-H "Accept: application/vnd.cnb.api+json" \
-H "Authorization: Bearer $CNB_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"body": "**评审结果**: 通过\n\n代码质量良好，未发现明显问题。"
}'
Create professional architecture, workflow, sequence, data-flow, and lifecycle/state diagrams as standalone HTML files with SVG graphics, a built-in dark/light theme toggle, and one-click export to PNG / JPEG / WebP / SVG. Accepts plain-language descriptions or pasted Mermaid code (flowchart, sequenceDiagram, stateDiagram) and lays the diagram out from scratch in archify style. Use when the user asks for system architecture diagrams, infrastructure diagrams, cloud architecture visualizations, security diagrams, network topology, technical workflows, approval flows, runbooks, CI/CD flows, process diagrams, API call sequences, request lifecycles, data pipelines, ETL/ELT maps, PII boundaries, data lineage, state machines, lifecycle diagrams, status transitions, or asks to convert/beautify a Mermaid diagram.
Use when the user requests diagrams, flowcharts, architecture diagrams, ER diagrams, UML / sequence / class diagrams, network topology, cloud architecture from Terraform or Kubernetes manifests, ML/DL model figures (Transformer/CNN/LSTM), mind maps, or any visualization. Also use proactively when explaining systems with 3+ components, complex data flows, or relationships that benefit from visual representation. Best suited when the diagram needs custom styling, rich shape vocabulary, swimlanes, or exportable images (PNG/SVG/PDF/JPG). Generates .drawio XML and exports locally via the native draw.io desktop CLI.
专家团总路由器。用于 Codex CLI 的 $expert-team 调用。 自动在软件开发团队、设计原型专家团、产品战略团队、基础设施运维专家和安全专家之间路由，也支持显式指定 software/design/product/ops/security。 触发词：专家团、团队协作、软件开发、设计原型、产品战略、基础设施运维、安全专家、威胁建模、代码审计、SRE、PRD、竞品、路线图、监控、部署、安全加固
Specialized agent for developing AIUI applications. Invoke when writing AIUI code, needing API references for jsui/wx, debugging AIUI applications, or aligning AIUI visual design with this Skill's design guidelines.
为文章规划并生成可读性强的极简强线条手绘配图。先建立文章地图，识别段落适合流程图、架构图、对比图、关系图、结构图还是概念插图，再通过构思卡组织单一命题、原文指纹、信息单位、阅读顺序和固定橙白圆猫角色。构思通过可读性测试后默认直接生成。用户说配图、手绘配图、给文章配图、文章插图、技术文章插图、流程图、架构图、关系图或 illustrate my article 时使用。
CNB 平台交互命令，支持代码仓库、Issue、PR、CI、制品库读写等操作。