Is review-pr safe to install?

SaferSkills independently audited review-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

plugins/github-dev/skills/review-pr/SKILL.md · 1 file

plugins/github-dev/skills/review-pr/SKILL.md2.0 KB · Markdown

name: review-pr

description: This skill should be used when user asks to "review a PR", "review pull request", "review this pr", "code review this PR", "check PR #N", provides a GitHub PR URL, or explicitly invokes "review-pr".

Review PR

Review a pull request for bugs, regressions, missing tests, and risky changes.

When explicitly invoked with extra text, treat that text as the PR number or URL. If no PR reference is provided, infer it from the current branch.

Process

Preferred execution

If subagents are available, use github-dev:pr-reviewer and pass the PR reference.
Otherwise follow the manual steps below.

Parse PR reference

If a PR number or URL is provided, extract owner, repo, and PR number.
If not, auto-detect the PR from the current branch with gh pr view --json number,headRefName.

Fetch PR data

Use gh pr diff <number> for the full diff.
Use gh pr view <number> --json files for the changed file list.
Skip generated or vendored files such as .lock, .min.js, .min.css, dist/, build/, vendor/, node_modules/, _pb2.py, and images.

Review focus

Only report issues that require fixes.
Only review PR changes, never pre-existing issues in unchanged code.
Prioritize bugs, security issues, breaking changes, performance issues, edge cases, and missing tests.
Combine related issues that share the same root cause.
Keep the list short and high signal.

Review comment rules

Only create pending PR comments, never submit or confirm the review automatically.
Use gh for GitHub operations.
Start comments in lowercase, keep them short, avoid end punctuation when possible.
Use simple language for both bot-facing and human-facing comments.

Output Format

If issues are found, report them in descending severity with file references and a final recommendation of NEEDS_CHANGES.

If no issues are found, return APPROVE - No fixes required.

review-pr— agent skill

Is review-pr safe to install?

Review PR

Process

Output Format

Audit the pieces. Scan the whole. Decide.