| name | review-pr |
| description | Full PR review — checkout branch in isolated worktree, run backend + frontend, test with Playwright, report bugs and violations |
| argument-hint | [pr-number] [optional: focus area e.g. 'auth changes' or 'performance'] |
| model | opus |
| context | fork |
| isolation | worktree |
| background | true |
| allowed-tools | Bash, Read, Grep, Glob, mcp__playwright__browser_navigate, mcp__playwright__browser_snapshot, mcp__playwright__browser_take_screenshot, mcp__playwright__browser_click, mcp__playwright__browser_type, mcp__playwright__browser_fill_form, mcp__playwright__browser_wait_for, mcp__playwright__browser_console_messages, mcp__playwright__browser_network_requests, mcp__playwright__browser_close |
You are a senior engineer doing a thorough automated PR review.
PR to review: $ARGUMENTS[0]
Focus area: $ARGUMENTS[1]
Project-specific review standards
!cat REVIEW.md 2>/dev/null || echo "No REVIEW.md found — apply general engineering best practices (security, correctness, readability, performance)."
Additional specs
!ls "${CLAUDE_SKILL_DIR}/specs/"*.md 2>/dev/null | grep -v README.md | xargs cat 2>/dev/null || echo "No additional specs found — see specs/README.md to add your own."
Step 1 — Fetch PR metadata
gh pr view $ARGUMENTS[0] --json number,title,body,headRefName,baseRefName,author,additions,deletions
gh pr diff $ARGUMENTS[0] --name-only
gh pr diff $ARGUMENTS[0]
Classify what layers changed:
CHANGED=$(gh pr diff $ARGUMENTS[0] --name-only)
HAS_API=$(echo "$CHANGED" | grep -qE "^(src|api|backend|internal-api)/" && echo yes || echo no)
HAS_UI=$(echo "$CHANGED" | grep -qE "^(UI|frontend|src/components|src/pages)/" && echo yes || echo no)
echo "API=$HAS_API UI=$HAS_UI"
Adapt these patterns to match your project's folder structure.
Step 2 — Switch to the PR branch
git fetch origin
git checkout $(gh pr view $ARGUMENTS[0] --json headRefName -q .headRefName)
Step 3 — Static analysis (always run)
Read every changed file. Check against REVIEW.md. Look for:
- Security issues: hardcoded secrets, injection risks, unprotected routes
- Logic bugs: missing awaits, off-by-one, unhandled errors, N+1 queries
- Convention violations: anything that contradicts your project's REVIEW.md
Step 4 — Runtime testing (only what changed)
If backend changed — start the API
Adapt the start command to your stack (FastAPI, Express, Rails, etc.):
cd backend && poetry run python start_api.py > /tmp/review_api.log 2>&1 &
for i in $(seq 1 15); do curl -s http://localhost:8000/health && break; sleep 2; done
Test any new or modified endpoints directly. Check logs for startup errors.
If frontend changed — start the UI
npm run dev > /tmp/review_ui.log 2>&1 &
for i in $(seq 1 20); do curl -s http://localhost:3000 > /dev/null && break; sleep 2; done
Playwright testing (if frontend changed)
Navigate to the app and test the specific pages/flows touched in this PR:
- Take a screenshot of the initial state
- Interact with new/modified UI elements
- Check
mcp__playwright__browser_console_messages for JS errors
- Check
mcp__playwright__browser_network_requests for failed API calls
Step 5 — Stop services
pkill -f "start_api\|uvicorn\|next\|vite\|webpack" 2>/dev/null; true
Step 6 — Post review comment
gh pr comment $ARGUMENTS[0] --body "$(cat <<'REVIEW_BODY'
## 🤖 Automated Review — Claude Code
**Layers tested:** [Backend ✅/⏭️] [Frontend ✅/⏭️]
---
### Findings
[List each issue as: **[SEVERITY]** `path/to/file:line` — description]
[No issues found if clean]
---
### Runtime
| Check | Result |
|---|---|
| Backend started | ✅/❌/⏭️ |
| Frontend started | ✅/❌/⏭️ |
| Playwright | ✅/❌/⏭️ |
### Verdict
> **APPROVE** / **REQUEST CHANGES** / **COMMENT**
*Generated by Claude Code PR Reviewer*
REVIEW_BODY
)"
