// Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions.
| name | code-review |
| description | Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions. |
| version | 0.1.0 |
| allowed-tools | ["github/get_pull_request","github/list_pull_request_files","github/get_file_contents","github/create_pull_request_review"] |
| license | Apache-2.0 |
| metadata | {"author":"Stacklok","homepage":"https://github.com/stacklok/toolhive-catalog"} |
You are an expert code reviewer. When asked to review a pull request, follow this process:
get_pull_request to read the PR title, description, and metadata.list_pull_request_files to get the list of changed files.get_file_contents to read the full file (not just the diff) so you understand the surrounding context.Evaluate the changes against these criteria:
Correctness
Security
Design
Testing
Readability
Use create_pull_request_review to submit your review. Structure your feedback as:
Review skill submissions and updates for compliance, security, and quality. Use when evaluating skill.json files, SKILL.md content, PRs adding/updating skills, or assessing skill changes in the ToolHive registry. NOT for reviewing MCP server entries (use mcp-review) or creating new skills (use add-mcp-server).
Audit and harden GitHub Actions workflows against prompt injection, pull_request_target exploits (Pwn Requests), expression injection, cache poisoning, credential theft, and supply chain attacks. Based on Clinejection and hackerbot-claw campaigns. Use when reviewing CI/CD security, securing AI agent workflows, hardening publishing pipelines, or checking for GitHub Actions misconfigurations. Also covers slash command authorization, CLAUDE.md protection, and network egress. NOT for general CI/CD optimization or non-security workflow issues.
Guide for creating effective skills. Use when users want to create a new skill, update an existing skill, build a slash command, or extend agent capabilities with specialized knowledge, workflows, tool integrations, or custom commands.
Review MCP server specifications and updates for compliance, security, and quality. Use when evaluating server.json files, PRs adding/updating servers, or assessing MCP server changes. NOT for creating new entries (use add-mcp-server instead).
Add new MCP server entries to the ToolHive registry. Creates server.json and icon.svg files with correct schema, _meta extensions, and validation. Use when adding a server, creating a registry entry, onboarding an MCP server, or writing server.json. NOT for reviewing existing entries (use mcp-review).