菜单
Use when the user says /review-pr, "review this PR", or "review PR <number/url>". Reviews a GitHub Pull Request using the gh CLI, analyzing code quality, logic correctness, security, and adherence to project conventions.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | review-pr |
| description | Use when the user says /review-pr, "review this PR", or "review PR <number/url>". Reviews a GitHub Pull Request using the gh CLI, analyzing code quality, logic correctness, security, and adherence to project conventions. |
Resolve the PR. Parse the number/URL from the user's prompt; if absent, run gh pr view --json number,headRefName,baseRefName.
Gather context in parallel:
gh pr view <n> --json title,body,author,files,additions,deletions,baseRefName,headRefNamegh pr diff <n>gh pr checks <n>Read project conventions. Check for AGENTS.md, CONTRIBUTING.md, or .cursor/rules/ and note any rules that apply.
Review across these axes:
Produce output in this shape:
## Summary
<2-3 sentence assessment>
## Blocking
- [ ] <must-fix items with file:line>
## Suggestions
- <nice-to-haves with file:line>
## Nits
- <tiny style points>
## Questions
- <clarifications for the author>
Offer to post the review with gh pr review <n> --comment --body - if the user wants it on the PR.
file:line for every point.Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.