0xhoneyjar/bridgebuilder-review
.claude/skills/bridgebuilder-review/SKILL.md
Bridgebuilder — Autonomous PR Review
$ install --global
skillsauthnpx skillsauth add 0xhoneyjar/loa-dixie bridgebuilder-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 28, 2026, 4:08 AM36.5s60 files scanned
SKILL.md
- name:
- bridgebuilder-review
- description:
- Bridgebuilder — Autonomous PR Review
- schema_version:
- 1
- read_files:
- true
- search_code:
- true
- write_files:
- true
- execute_commands:
- true
- web_access:
- true
- user_interaction:
- false
- agent_spawn:
- true
- task_management:
- false
- cost-profile:
- heavy
- path:
- .claude
- permission:
- none
- paths:
- [grimoires/bridgebuilder]
Bridgebuilder — Autonomous PR Review
Prerequisites
ghCLI installed and authenticated (gh auth status)ANTHROPIC_API_KEYenvironment variable set- Node.js >= 20.0.0
Usage
/bridgebuilder # Review all open PRs on auto-detected repo
/bridgebuilder --dry-run # Preview reviews without posting
/bridgebuilder --pr 42 # Review only PR #42
/bridgebuilder --repo owner/repo # Target specific repo
/bridgebuilder --no-auto-detect # Skip git remote detection
How It Works
- Resolves configuration from 5-level precedence: CLI > env > YAML > auto-detect > defaults
- Detects current repo from
git remote -v(unless--no-auto-detect) - Fetches open PRs via
ghCLI - For each PR:
- Checks if already reviewed (marker:
<!-- bridgebuilder-review: {sha} -->) - Builds review prompt from persona + truncated diff
- Calls Anthropic API for review generation
- Sanitizes output (redacts leaked secrets)
- Posts review to GitHub (
COMMENTorREQUEST_CHANGES)
- Checks if already reviewed (marker:
- Prints JSON summary:
{ reviewed, skipped, errors }
Configuration
Set in .loa.config.yaml under bridgebuilder: section, or via environment variables:
| Setting | Env Var | Default |
|---------|---------|---------|
| repos | BRIDGEBUILDER_REPOS | Auto-detected from git remote |
| model | BRIDGEBUILDER_MODEL | claude-opus-4-6 |
| dry_run | BRIDGEBUILDER_DRY_RUN | false |
| max_prs | — | 10 |
| max_files_per_pr | — | 50 |
| max_diff_bytes | — | 100000 |
| max_input_tokens | — | 8000 |
| max_output_tokens | — | 4000 |
| persona_path | — | grimoires/bridgebuilder/BEAUVOIR.md |
Persona
Override the default reviewer persona by creating grimoires/bridgebuilder/BEAUVOIR.md. The default persona reviews across 4 dimensions: Security, Quality, Test Coverage, and Operational Readiness.
Execution
This skill runs entry.sh which invokes the compiled Node.js application:
.claude/skills/bridgebuilder-review/resources/entry.sh [flags]
Exit Codes
| Code | Meaning | |------|---------| | 0 | All reviews completed successfully | | 1 | One or more reviews encountered errors |
Related Skills
0xhoneyjar/tests/fixtures/registry/skills/test-vendor/valid-skill
testing
VerifiedTrustedCommunity
# valid-skill Test skill with valid license for unit testing. ## Purpose Used in test_constructs_loader.bats to verify correct handling of valid licenses.
2SKILL.mdUpdated Mar 24, 2026
0xhoneyjar/tests/fixtures/registry/skills/test-vendor/grace-skill
testing
VerifiedTrustedCommunity
# grace-skill Test skill in license grace period for unit testing. ## Purpose Used in test_constructs_loader.bats to verify correct handling of licenses in grace period.
2SKILL.mdUpdated Mar 24, 2026
0xhoneyjar/tests/fixtures/registry/skills/test-vendor/expired-skill
testing
VerifiedTrustedCommunity
# expired-skill Test skill with expired license for unit testing. ## Purpose Used in test_constructs_loader.bats to verify correct handling of expired licenses.
2SKILL.mdUpdated Mar 24, 2026
0xhoneyjar/tests/fixtures/registry/packs/test-pack/skills/skill-b
testing
VerifiedTrustedCommunity
# skill-b Test skill B from test-pack for unit testing. ## Purpose Used in test_pack_support.bats to verify pack validation and skill loading.
2SKILL.mdUpdated Mar 24, 2026