trailofbits/review-pr
plugins/code-improver/tests/fixtures/pr-review-toolkit/skills/review-pr/SKILL.md
Reviews the current branch's changes against its base branch as a pull request: correctness of new and modified code, test coverage for it, and documentation accuracy. Use when asked to review a branch, a diff, or a pull request.
$ install --global
skillsauthnpx skillsauth add trailofbits/skills review-prInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Aug 26, 2026, 3:14 AM161.6s1 file scanned
SKILL.md
- name:
- review-pr
- description:
- Reviews the current branch's changes against its base branch as a pull request: correctness of new and modified code, test coverage for it, and documentation accuracy. Use when asked to review a branch, a diff, or a pull request.
- allowed-tools:
- Read Grep Glob Bash
PR Review
Review the branch's change surface, not the whole repository.
- Establish the diff:
git diff <base>...HEAD(andgit diff <base>when the working tree carries uncommitted changes that belong to the branch). The base branch is named by the caller; fall back tomain. - Review every changed hunk for correctness: wrong results on edge inputs, unhandled error paths, and behavior that contradicts the function's name or callers.
- Check test coverage for the changed behavior: new logic without a test exercising its edge cases is a finding.
- Check documentation the diff made stale: statements in README or docs that were true on the base branch and are false after the change.
- Report every defect found, each with a severity; include minor and informational findings. Do not report defects in files the branch did not touch — they are outside the pull request.
Related Skills
trailofbits/panel-review
development
VerifiedTrustedCommunity
Reviews a code target by launching a panel of specialist auditor agents and merging their reports. Use when asked to run a panel review.
6,852SKILL.mdUpdated Aug 26, 2026
trailofbits/skill-improver
tools
VerifiedTrustedCommunity
Runs an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev skill-reviewer agent. Use to fix skill quality issues, iteratively refine a skill, or resume a loop after an escalation ('fix my skill', 'improve this skill until it passes review', 'skill improvement loop'). NOT for a one-time review — use the plugin-dev skill-reviewer agent directly.
6,852SKILL.mdUpdated Aug 26, 2026
trailofbits/pr-improver
tools
VerifiedTrustedCommunity
Runs an autonomous review-and-fix improvement loop over the current branch's changes until a PR review comes back clean, scoped mechanically to the directories the branch touched. Reviews are performed by an installed PR-review skill (default: pr-review-toolkit's review-pr). Use to fix review findings on a branch before opening or updating a pull request ('clean up this branch', 'fix this PR until review passes', 'run review-and-fix on my changes'). NOT for a one-time review — run the PR-review skill directly.
6,852SKILL.mdUpdated Aug 26, 2026
trailofbits/code-improver
tools
VerifiedTrustedCommunity
Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and guards scope mechanically. Use when asked to 'improve this code until review passes', 'run an improvement loop with <reviewer>', or to iterate review-and-fix with a specific reviewer. For skills prefer the skill-improver entry; for a branch prefer pr-improver.
6,852SKILL.mdUpdated Aug 26, 2026