| name | paladin-pr-review |
| description | Orchestrate security review for pull requests and PR diffs. Use for GitHub PR security review, inline PR comments, previous review-thread follow-up, and final PR security decisions; delegate core changed-code analysis to paladin-code-review. |
PR Security Review
Handle PR-specific context, automation, and final review decisions. Use paladin-code-review for the core security analysis of the changed code.
Load Order
- Read
PALADIN.md if present.
- Read
../paladin-code-review/SKILL.md.
- Read
../paladin-code-review/references/output-contract.md before writing the final review, posting comments, or making a task.
- Read the configured source list only when current advisory context matters. Use
PALADIN.md paladin_source_list, or default to repo-root references/security-sources.md.
Workflow
- Resolve PR context when tooling is available:
git branch --show-current
gh pr view --json number,title,url,baseRefName,headRefName,files
git diff --stat
- If GitHub review tooling is available, review previous unresolved security-review threads and re-check whether each still applies.
- Run the
paladin-code-review workflow with the PR diff as the scope. Review only changed code plus unchanged surrounding code required to prove reachability, controls, exploitability, and what security property changed.
- Use the
paladin-code-review output contract for findings, checks, misuse cases, advisory lookup, and final decision.
- Post inline PR comments only for current high-confidence findings on exact diff lines. Keep each comment to severity, issue, impact, and required fix.
- If no high-confidence vulnerability remains, leave no new finding comments and return the clean review summary.
- Post a Slack summary only when Slack tooling is available and configured.
- Do not push code, open fix PRs, or mutate production systems from this workflow.
PR Automation Rules
- Prefer fresh evidence over stale review comments.
- Re-report still-valid prior findings with updated file and line evidence.
- Resolve or supersede old automation threads only when the current tool supports it and the user has authorized that workflow.
- If inline comments are unavailable, return comment-ready notes in the final response.
- If a PR cannot be detected and no PR diff is supplied, route to
paladin-code-review for local changed-code review.
Conversion
Follow the conversion contract from paladin-code-review: read paladin_conversion, paladin_action_destination, and paladin_custom_action from PALADIN.md; create follow-up items only when the local action contract allows it and actionable findings exist.
