Skill: lnguyen1996/pull-request-reviewer (version 1.0.0)

# pr-reviewer ## Description Review pull requests and code diffs across any language. Finds logic bugs, missing tests, security holes, breaking API changes, and naming problems before they merge. Returns a structured report: block-merge issues first, then warnings, then style suggestions. ## Use when - "review my PR" - "check this diff" - "is this PR mergeable" - "what's wrong with this change" - "code review" - Any git diff, patch file, or PR description paste ## Supported languages Any language with a git diff. Specialised checklist for: Python, JavaScript/TypeScript, C#, Go, Rust, Java/Kotlin, SQL migrations. ## Input Paste one of: - A git diff (`git diff main...feature-branch`) - A GitHub/GitLab PR URL (if accessible) - Raw code with a description of what it changes Optionally specify: target branch, framework, whether this is a library (breaking changes matter more) or an app. ## Output format ``` ## PR Review ### Block Merge - [Finding] — [why this must be fixed before merging] ✗ Problem: [problematic code] ✓ Fix: [corrected code] ### Warnings (fix before next release) - [Finding] — [explanation] ### Suggestions (style / future-proofing) - [Finding] — [explanation] ### Approved - [Specific patterns done right — always include at least one] ### Summary [2–3 sentences: biggest risk, top fix, overall verdict (merge / fix first / needs major work)] ``` ## Review checklist ### Logic & correctness - Off-by-one errors in loops or slices - Null/nil dereference without guard - Incorrect error handling (swallowed, wrong type checked) - Wrong variable captured in closure/lambda - Race condition introduced (shared mutable state, no lock) - Missing edge case (empty input, zero value, max value) ### Security - User input used without sanitisation (SQL, shell, HTML) - Secret or credential added to source (API key, password, token) - Insecure deserialization - Overly permissive CORS / auth bypass - Path traversal risk ### Tests - New behaviour with zero test coverage - Test that only tests the happy path (no error case) - Mock that makes the test vacuously pass - Missing assertion (test calls but never asserts) ### API / interface - Public method signature changed without deprecation - Required parameter added to existing public function - Return type narrowed or widened unexpectedly - Serialised field renamed (breaks existing clients) ### Performance - N+1 query introduced - Unbounded loop over user-supplied collection - Synchronous I/O in async context - Large allocation in hot path ### Style - Inconsistent naming with surrounding code - Dead code left in (commented-out blocks, unused variables) - TODO left without ticket reference - Misleading variable/function name ## Severity definitions - **Block Merge:** Correctness bug, security hole, data loss risk, or breaking API change — must be fixed - **Warning:** Performance issue, missing test coverage, or hard-to-debug behavior — fix before release - **Suggestion:** Style, clarity, or maintainability improvement — up to the author ## Self-improvement instructions After each review, note the most common finding category (logic, security, tests, API, performance, style). After 20 reviews, surface the top 3 patterns as "Most common PR issues in [language]" to help users learn, not just fix.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)