agent-skills

Address review comments on your own pull request: implement valid suggestions, reply to invalid ones, and resolve threads. Covers inline review threads, review body comments, and plain PR timeline comments. Use when: user says "address PR comments", "implement PR feedback", "respond to review comments", "handle review feedback", "process PR review comments", "fix review feedback", "handle bot review comments", "process Copilot suggestions", "address Claude review", or wants to work through open review threads on their pull request. Gives credit to commenters in commit messages.

Analyzes a PR diff and appends a categorized review guide to the PR description, highlighting where human judgment is needed: security, config/infrastructure, new dependencies, data model changes, novel patterns, and concurrency/state. Use this whenever a user wants to prepare a PR for human review or flag areas for reviewer attention — including casual phrasing like "prep this for review", "what should reviewers look at?", "add a review guide", or "flag this for human review".

Get a fresh-context review of staged changes, branches, PRs, or file sets. Delegates to a fresh-context reviewer by default; routes to external LLM CLIs (Copilot, Codex, Gemini) when --model specifies one. Use when: user says "peer review" (e.g. "peer review PR 5", "peer review staged", "peer review this branch"), "fresh review", "another set of eyes", "sanity check", "quick review before I push", or routes to an external model ("review with Gemini", "review with Copilot", "review using Codex"). Do NOT trigger on bare "review" phrases (e.g. "review my changes", "review PR N", "review staged") — those route to code-review.

Extracts lessons learned from conversations and persists them to AI assistant config files (CLAUDE.md, GEMINI.md, AGENTS.md, Cursor, Copilot, Windsurf, Continue) or creates new skills from discovered workflows. Use this skill whenever: a command failed then succeeded (especially with a flag or env change), debugging revealed a workaround, an assumption proved wrong, undocumented behavior was discovered, a multi-step pattern was invented on the fly, or the user says "/learn", "remember this", "save this", "add this to CLAUDE.md", "don't forget this", or "make a skill for this". Also invoke proactively after any complex troubleshooting session where notable lessons emerged, even if the user didn't explicitly ask.

Create branch, commit, push, and open a pull request. Use when: user says "ship it", "ship this", "create a PR", "open a PR", "push and PR", or wants to go from uncommitted changes to an open pull request.

Fix JavaScript package security vulnerabilities or upgrade outdated npm/yarn/pnpm/bun dependencies. Use when the user wants to patch CVEs, resolve npm audit findings, bump package versions, modernize node_modules, or update specific packages across a JS project or monorepo. Handles any project with package.json files. Also triggers for "/js-deps" with or without specific package names or glob patterns. Not for non-JS ecosystems, adding brand-new packages, creating package.json from scratch, switching package managers, or debugging runtime errors.

Maintain Python packages through security audits or dependency updates using an isolated git worktree and uv. Use for security audits, CVE fixes, vulnerability checks, dependency updates, package upgrades, outdated packages, bump versions, fix Python vulnerabilities, check for Python CVEs, audit Python packages, update pyproject.toml dependencies, modernize Python deps, or when user types /uv-deps with or without specific package names or glob patterns.