post-code-review-to-pr — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited post-code-review-to-pr (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When running a PR code review, follow the process outlined here.
which gh 2>/dev/null || echo "not installed"which jq 2>/dev/null || echo "not installed"If gh is not found, inform the user it must be installed and configured; if jq is not found, inform the user it must be installed. In either case, immediately stop.
git branch --show-current 2>/dev/null || echo unknowngit symbolic-ref --short refs/remotes/origin/HEAD 2>/dev/null || echo unknowngh pr diff --name-only 2>/dev/null || echo "no pr"bash "${CLAUDE_PLUGIN_ROOT}/scripts/han-config-dir.sh" 2>/dev/null || echo "$HOME/.claude"cat .han/config.md 2>/dev/null || echo ""As your first action, use the Read tool on .han/config.md inside the personal config directory path above. A read that returns no file is no personal configuration: continue silently. When that file or the project .han/config.md probe supplies content, apply it per config-rule.md, which governs precedence between the two files, relative-path resolution, and what to do with a file that reads but cannot be used.
If changed files is empty or reads no pr, or gh pr view --json number,url fails, inform the user no reviewable PR exists for the current branch and stop.
Invoke the /code-review skill to perform the full code review. Pass along any user-provided focus areas or context from the original arguments.
/code-review writes its report to a file and names the path in its closing message; it does not print the review into the conversation. Capture that path — Step 3 reads the report from it. After /code-review completes, proceed immediately to Step 3 — do not stop here.
Ask the user whether they'd like to post the review to the PR on GitHub using AskUserQuestion with options "Yes, post the review to GitHub" and "No, just the local review". If the user declines, proceed to Step 5.
If the user accepts:
${CLAUDE_SKILL_DIR}/scripts/pr-metadata.sh, which outputs JSON with owner_repo,pr_number, head_sha, pr_author_login, and current_user_login.
Recommendation, and all findings organized by severity, plus any optional sections that are present. Treat every section other than the Review Summary table and the Review Recommendation as optional — the code-review skill renders a section only when it has content, so a section (the Review Coverage section, the What's Good section, an absent severity section on a clean review, the Security Vulnerabilities section, the Remediation note) may simply not be there. Include each section when present and omit it without error or an empty heading when absent. Review Coverage always crosses when present. It appears only when no specialist read the change, and a reviewer on the pull request is the reader who most needs to know that.
Because the review body will be publicly visible on the PR, run a clarity pass on the draft before posting.
Match the body's length to what the review found. Every finding earns its place by naming a specific problem at a specific location. Skip filler sections, a restated summary of the diff, and boilerplate the reader can see for themselves on the PR. Three sections are exempt from that length-matching and are never cut or shortened: the Review Summary table, the Review Recommendation, and the Review Coverage section. Review Coverage names no problem at any location by construction; it says which coverage the review did not have, and deleting it as filler would hide that from the widest audience the review reaches. Stay inside what the review covered: this step edits wording and severity, and never adds a finding /code-review did not raise.
/tmp/post-code-review-to-pr-draft.md) using the Write tool.han-core:junior-developer agent in artifact-review mode with the prompt: "You are reviewing thetext of a code review that is about to be posted publicly on a GitHub pull request. The review is at {draft_path}. Do not re-review the code — review the review. Flag findings whose wording is unclear, severity is mis-assigned (CRIT used where WARN would be accurate, or vice versa), language is accusatory or blaming rather than evidence-based, or file_path:line_number references are missing or invalid. Leave the Review Summary table, the Review Recommendation, and any Review Coverage section as they are; they are not findings and are not subject to the length-matching bar. Return a short list of specific edits with before/after text; return an empty list if the review reads well as-is."
task ID and the Review Summary table to match.
${CLAUDE_SKILL_DIR}/scripts/create-review-tempfile.sh. Write the final,edited review body to that path using the Write tool (not Bash).
pr_author_login matches current_user_login (self-authored PR), post as a PRcomment (GitHub rejects formal reviews from PR authors) by running ${CLAUDE_SKILL_DIR}/scripts/post-pr-comment.sh {pr_number} {temp_file_path}. If they differ, determine event type (REQUEST_CHANGES if any CRIT or WARN findings exist, COMMENT if only SUGG) and post as a formal review by running ${CLAUDE_SKILL_DIR}/scripts/post-pr-review.sh {owner/repo} {pr_number} {head_sha} {event_type} {temp_file_path}.
If any Critical or Warning issues were identified, ask the user using AskUserQuestion — "Would you like me to create a plan to fix the identified issues?" with options "Yes, create a fix plan" and "No, just the review". If yes, enter plan mode and create a detailed implementation plan listing each Critical and Warning item by task ID, with specific code changes, file paths, and line numbers, ordered by priority (Critical first). If no Critical or Warning issues were found, the review is complete — suggestions alone do not warrant a fix plan.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.