菜单
Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Add new MCP server entries to the ToolHive registry. Creates server.json and icon.svg files with correct schema, _meta extensions, and validation. Use when adding a server, creating a registry entry, onboarding an MCP server, or writing server.json. NOT for reviewing existing entries (use mcp-review).
Review MCP server specifications and updates for compliance, security, and quality. Use when evaluating server.json files, PRs adding/updating servers, or assessing MCP server changes. NOT for creating new entries (use add-mcp-server instead).
Audit existing ToolHive catalog server entries for drift: whether the pinned image still exists, the upstream repo is still alive and active, and the declared env vars and network-permission profile still match what the server actually needs. Use whenever asked to audit, health-check, sweep, or spot-check catalog entries / server.json files for staleness, broken images, dead repos, abandoned projects, or wrong env-vars/permissions - for the community tier, the official tier, the whole registry, or a named subset. Report-only; it never edits entries. NOT for reviewing a new submission (use mcp-review) or creating one (use add-mcp-server).
Review skill submissions and updates for compliance, security, and quality. Use when evaluating skill.json files, SKILL.md content, PRs adding/updating skills, or assessing skill changes in the ToolHive registry. NOT for reviewing MCP server entries (use mcp-review) or creating new skills (use add-mcp-server).
Audit and harden GitHub Actions workflows against prompt injection, pull_request_target exploits (Pwn Requests), expression injection, cache poisoning, credential theft, and supply chain attacks. Based on Clinejection and hackerbot-claw campaigns. Use when reviewing CI/CD security, securing AI agent workflows, hardening publishing pipelines, or checking for GitHub Actions misconfigurations. Also covers slash command authorization, CLAUDE.md protection, and network egress. NOT for general CI/CD optimization or non-security workflow issues.
Guide for creating effective skills. Use when users want to create a new skill, update an existing skill, build a slash command, or extend agent capabilities with specialized knowledge, workflows, tool integrations, or custom commands.
| name | code-review |
| description | Reviews pull requests by analyzing code changes, checking for common issues, and providing structured feedback with suggestions. |
| version | 0.1.0 |
| allowed-tools | ["github/get_pull_request","github/list_pull_request_files","github/get_file_contents","github/create_pull_request_review"] |
| license | Apache-2.0 |
| metadata | {"author":"Stacklok","homepage":"https://github.com/stacklok/toolhive-catalog"} |
You are an expert code reviewer. When asked to review a pull request, follow this process:
get_pull_request to read the PR title, description, and metadata.list_pull_request_files to get the list of changed files.get_file_contents to read the full file (not just the diff) so you understand the surrounding context.Evaluate the changes against these criteria:
Correctness
Security
Design
Testing
Readability
Use create_pull_request_review to submit your review. Structure your feedback as: