菜单
Reviews a GitHub pull request diff and produces a structured report covering correctness, security, Python best practices, and test coverage. Use when asked to review a PR, check a pull request, analyze a diff, or validate code before merging.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | pr-review |
| description | Reviews a GitHub pull request diff and produces a structured report covering correctness, security, Python best practices, and test coverage. Use when asked to review a PR, check a pull request, analyze a diff, or validate code before merging. |
| allowed-tools | Bash, Read, Grep, Glob |
Fetch a PR diff via
gh, analyze it across 5 dimensions, and output a structured review report with inline findings.
/pr and wanting a self-review before requesting teammates# By PR number (current repo)
gh pr diff <number>
# By URL
gh pr diff <url>
# Get PR metadata
gh pr view <number> --json title,body,additions,deletions,changedFiles,baseRefName,headRefName
Categorize each file:
src/ or app code → logic reviewtests/ → test quality review*.py → Python-specific checks*.toml, *.yml, *.env*) → secrets + config reviewmigrations/) → database safety reviewRun through each dimension for every changed file:
def f(x=[]))except: clausespytest.raises for exception paths?Output the report in the format below.
IF no PR number or URL is provided: → Ask: "Which PR should I review? Provide a number or GitHub URL."
IF gh is not authenticated:
→ Show: gh auth login instructions and stop.
IF PR has >50 changed files:
→ Focus on files in src/, app/, or core logic. Skip lock files, generated files, assets.
IF security issue found (severity: CRITICAL):
→ Flag at top of report with 🚨 CRITICAL before any other findings.
IF no tests changed but logic files changed: → Always flag as a finding under Test Coverage: "No tests added/modified for changed logic."
DEFAULT: → Run all 5 dimensions, produce full report.
## PR Review: <title> (#<number>)
**Branch**: `<head>` → `<base>`
**Changes**: +<additions> / -<deletions> across <N> files
---
### 🚨 Critical Issues
(Security or correctness blockers — must fix before merge)
- `path/to/file.py:42` — **Hardcoded API key** `SECRET_KEY = "abc123"`. Move to env var.
---
### ⚠️ Warnings
(Should fix — code quality, missing tests, non-critical bugs)
- `path/to/file.py:17` — **Mutable default argument** `def process(items=[])`. Use `None` and assign inside.
- `path/to/service.py` — **No tests added** for new `PaymentService.charge()` method.
---
### 💡 Suggestions
(Nice to have — style, naming, minor improvements)
- `path/to/utils.py:88` — Function `do_stuff()` is 73 lines. Consider splitting.
- `path/to/models.py:12` — Magic number `86400`. Extract as `SECONDS_IN_DAY = 86400`.
---
### ✅ Looks Good
- Test coverage added for happy path and edge cases
- Type hints present on all public functions
- No secrets detected
---
### Summary
| Dimension | Status |
|-----------|--------|
| Correctness | ✅ / ⚠️ / 🚨 |
| Security | ✅ / ⚠️ / 🚨 |
| Python Best Practices | ✅ / ⚠️ / 🚨 |
| Test Coverage | ✅ / ⚠️ / 🚨 |
| Code Quality | ✅ / ⚠️ / 🚨 |
**Verdict**: APPROVE / REQUEST CHANGES / NEEDS DISCUSSION
Input: /pr-review 42
Output:
## PR Review: Add user authentication (#42)
**Branch**: `feat/auth` → `main`
**Changes**: +312 / -18 across 8 files
### 🚨 Critical Issues
- `app/auth.py:56` — SQL query built with string formatting. Use parameterized queries.
### ⚠️ Warnings
- `app/auth.py:23` — No test for invalid token path.
- `tests/test_auth.py` — `requests.post` not mocked; test hits real network.
### ✅ Looks Good
- Password hashed with bcrypt
- JWT expiry set correctly
**Verdict**: REQUEST CHANGES
Input: /pr-review https://github.com/org/repo/pull/7
Output: Full structured report for the linked PR.
| Scenario | Response |
|---|---|
| No PR number given | Ask for PR number or URL |
gh not installed | Show install instructions: brew install gh |
| Draft PR | Note it's a draft; still review if asked |
| Only docs changed | Skip security/logic checks; focus on clarity |
| Binary or lock files in diff | Skip those files silently |
| Merge conflicts in diff | Flag as blocker in Critical Issues |
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications. Use when deploying an application, setting up CI/CD, writing GitHub Actions workflows, configuring health checks, or asking about rollback strategies.
Create Mermaid diagrams (activity, deployment, sequence, architecture) from text descriptions or source code. Use when asked to "create a diagram", "generate mermaid", "document architecture", "code to diagram", "create design doc", or "convert code to diagram". Supports hierarchical on-demand guide loading, Unicode semantic symbols, and Python utilities for diagram extraction and image conversion.
Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. Use when writing a Dockerfile, setting up docker-compose, containerizing an app, or asking about container security and networking.
Deep search via Perplexity API. Three modes: search (quick facts), reason (complex analysis), research (in-depth reports). Returns AI-grounded answers with citations.
PostgreSQL database patterns for query optimization, schema design, indexing, and security. Use when designing a database schema, writing SQL queries, optimizing slow queries, adding indexes, or asking about database security and migrations.
Python development principles and decision-making. Framework selection, async patterns, type hints, project structure. Use when starting a Python project, choosing a framework, structuring code, adding type hints, or asking about Python best practices.