Menu
Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Add new MCP server entries to the ToolHive registry. Creates server.json and icon.svg files with correct schema, _meta extensions, and validation. Use when adding a server, creating a registry entry, onboarding an MCP server, or writing server.json. NOT for reviewing existing entries (use mcp-review).
Review MCP server specifications and updates for compliance, security, and quality. Use when evaluating server.json files, PRs adding/updating servers, or assessing MCP server changes. NOT for creating new entries (use add-mcp-server instead).
Audit existing ToolHive catalog server entries for drift: whether the pinned image still exists, the upstream repo is still alive and active, and the declared env vars and network-permission profile still match what the server actually needs. Use whenever asked to audit, health-check, sweep, or spot-check catalog entries / server.json files for staleness, broken images, dead repos, abandoned projects, or wrong env-vars/permissions - for the community tier, the official tier, the whole registry, or a named subset. Report-only; it never edits entries. NOT for reviewing a new submission (use mcp-review) or creating one (use add-mcp-server).
Review skill submissions and updates for compliance, security, and quality. Use when evaluating skill.json files, SKILL.md content, PRs adding/updating skills, or assessing skill changes in the ToolHive registry. NOT for reviewing MCP server entries (use mcp-review) or creating new skills (use add-mcp-server).
Audit and harden GitHub Actions workflows against prompt injection, pull_request_target exploits (Pwn Requests), expression injection, cache poisoning, credential theft, and supply chain attacks. Based on Clinejection and hackerbot-claw campaigns. Use when reviewing CI/CD security, securing AI agent workflows, hardening publishing pipelines, or checking for GitHub Actions misconfigurations. Also covers slash command authorization, CLAUDE.md protection, and network egress. NOT for general CI/CD optimization or non-security workflow issues.
Guide for creating effective skills. Use when users want to create a new skill, update an existing skill, build a slash command, or extend agent capabilities with specialized knowledge, workflows, tool integrations, or custom commands.
| name | code-review |
| description | Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions. |
| version | 0.1.0 |
| allowed-tools | ["github/get_pull_request","github/list_pull_request_files","github/get_file_contents","github/create_pull_request_review"] |
| license | Apache-2.0 |
| metadata | {"author":"Stacklok","homepage":"https://github.com/stacklok/toolhive-catalog"} |
You are an expert code reviewer. When asked to review a pull request, follow this process:
get_pull_request to read the PR title, description, and metadata.list_pull_request_files to get the list of changed files.get_file_contents to read the full file (not just the diff) so you understand the surrounding context.Evaluate the changes against these criteria:
Correctness
Security
Design
Testing
Readability
Use create_pull_request_review to submit your review. Structure your feedback as: