メニュー
Use when the user says /review-pr, "review this PR", or "review PR <number/url>". Reviews a GitHub Pull Request using the gh CLI, analyzing code quality, logic correctness, security, and adherence to project conventions.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
| name | review-pr |
| description | Use when the user says /review-pr, "review this PR", or "review PR <number/url>". Reviews a GitHub Pull Request using the gh CLI, analyzing code quality, logic correctness, security, and adherence to project conventions. |
Resolve the PR. Parse the number/URL from the user's prompt; if absent, run gh pr view --json number,headRefName,baseRefName.
Gather context in parallel:
gh pr view <n> --json title,body,author,files,additions,deletions,baseRefName,headRefNamegh pr diff <n>gh pr checks <n>Read project conventions. Check for AGENTS.md, CONTRIBUTING.md, or .cursor/rules/ and note any rules that apply.
Review across these axes:
Produce output in this shape:
## Summary
<2-3 sentence assessment>
## Blocking
- [ ] <must-fix items with file:line>
## Suggestions
- <nice-to-haves with file:line>
## Nits
- <tiny style points>
## Questions
- <clarifications for the author>
Offer to post the review with gh pr review <n> --comment --body - if the user wants it on the PR.
file:line for every point.