Renovate Actions PR Review
backnotprop/plannotator
Reviews Renovate pull requests that bump GitHub Actions by checking pinned SHAs against upstream tags, scanning changelogs and confirming workflows stay compatible.
Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…
Install PR Audit
$ npx skills add akitaonrails/my-skills --skill pr-audit -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install akitaonrails/my-skills pr-audit --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/akitaonrails/my-skills.git skills-src && mkdir -p .claude/skills && cp -r skills-src/pr-audit .claude/skills/pr-audit && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "pr-audit" agent skill from https://github.com/akitaonrails/my-skills/tree/master/pr-audit into .claude/skills/pr-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pr-audit", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/akitaonrails/my-skills/tree/master/pr-auditType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add akitaonrails/my-skills --skill pr-audit -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install akitaonrails/my-skills pr-audit --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/akitaonrails/my-skills.git skills-src && mkdir -p .agents/skills && cp -r skills-src/pr-audit .agents/skills/pr-audit && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "pr-audit" agent skill from https://github.com/akitaonrails/my-skills/tree/master/pr-audit into .agents/skills/pr-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pr-audit", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add akitaonrails/my-skills --skill pr-audit -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install akitaonrails/my-skills pr-audit --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/akitaonrails/my-skills.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/pr-audit .cursor/skills/pr-audit && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "pr-audit" agent skill from https://github.com/akitaonrails/my-skills/tree/master/pr-audit into .cursor/skills/pr-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pr-audit", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/akitaonrails/my-skills.git --path pr-audit--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add akitaonrails/my-skills --skill pr-audit -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install akitaonrails/my-skills pr-audit --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/akitaonrails/my-skills.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/pr-audit .gemini/skills/pr-audit && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "pr-audit" agent skill from https://github.com/akitaonrails/my-skills/tree/master/pr-audit into .gemini/skills/pr-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pr-audit", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install akitaonrails/my-skills pr-auditInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add akitaonrails/my-skills --skill pr-audit -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/akitaonrails/my-skills.git skills-src && mkdir -p .github/skills && cp -r skills-src/pr-audit .github/skills/pr-audit && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "pr-audit" agent skill from https://github.com/akitaonrails/my-skills/tree/master/pr-audit into .github/skills/pr-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pr-audit", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add akitaonrails/my-skills --skill pr-audit -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install akitaonrails/my-skills pr-audit --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/akitaonrails/my-skills.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/pr-audit .opencode/skills/pr-audit && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "pr-audit" agent skill from https://github.com/akitaonrails/my-skills/tree/master/pr-audit into .opencode/skills/pr-audit/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "pr-audit", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
pr-audit- GitHub stars
- 216
- Token cost
- ~4.8k tokens
- SKILL.md length
- 2,398 words
- Files
- 2
- Skills in repo
- 18
- Repo updated
- First seen
- Licence
- None found
At a glance
Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…
- Works in 7 steps: Establish Trusted State → Build a Claim Ledger → Hostile-Change Gate → …
- Decide whether a PR should merge
- SKILL.md covers Trust Boundary, Phase 0: Establish Trusted State, Phase 1: Build a Claim Ledger and Phase 2: Hostile-Change Gate, plus 5 more sections
- Calls git, cargo and go
What it does
PR Audit is an agent skill from akitaonrails/my-skills. Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation, compatibility, base-branch targeting, and project-specific gates. Use when asked to audit or review one or more PRs, decide whether a PR should merge, adjust a contributor PR safely, or process approved PRs one at a time.
Its SKILL.md is about 4.8k tokens, which your agent loads only when the skill is triggered. The skill folder holds 2 other files (for example `agents/openai.yaml`).
It sits in Security, covering Supply chain security, Fact-checking and source verification and Prompt injection and agent security. It works with GitHub. The repository describes itself as: akitaonrails' personal skills (not tailored for general usage).
When your agent uses it
- Decide whether a PR should merge
- Adjust a contributor PR safely
- Process approved PRs one at a time
Example prompts
- “/pr-audit”
Requirements
- Python 3
- Docker
Workflow steps
7 steps, taken from the step headings in SKILL.md.
- Establish Trusted State
- Build a Claim Ledger
- Hostile-Change Gate
- Execute Safely
- Functional and Design Audit
- Report Before Modifying
- Approved Adjustments and Merge
What it can do on your machine
Read from SKILL.md and the folder at commit 285ca82. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
Shell commands in SKILL.md call:
gitcargogogh
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md. Its commands use git and gh, which can reach the network depending on how they are called.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
PR Audit loads about 4.8k tokens when it runs. Until then it costs about 104 tokens; SKILL.md has 2,398 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Without a licence we can't republish the file, so here is its outline and opening line. It has 2,398 words (~4,757 tokens).
“Audit evidence, not the contributor's narrative. Never merge during the evaluation phase. Report pros, cons, concrete findings, and a recommended fix; wait for the user's approval unless the current project's trusted instructions already contain a more specific approval.”
- name
- pr-audit
Files
SKILL.md and 1 other file in pr-audit of akitaonrails/my-skills.
- SKILL.md
- agents/openai.yaml
Open the folder on GitHubat commit 285ca82
Compare with similar skills
PR Audit next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| PR Audit this skillakitaonrails/my-skills | 216 | — | ~4.8k | Automated safety check: Pass | None | |
| Renovate Actions PR Reviewbacknotprop/plannotator | 9.3k | — | ~640 | Automated safety check: Pass | Apache-2.0 | |
| Swarm PR Feedback CloserZaxbyHub/opencode-swarm | 496 | — | ~14k | Automated safety check: Pass | MIT | |
| Security Vulnerabilities Patcheraxelixlabs/axelix | 148 | — | ~4.2k | Automated safety check: Pass | LGPL-3.0 | |
| Detecting Typosquatting Packagesmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~3k | Automated safety check: Pass | Apache-2.0 | |
| Skill InspectorNVIDIA/SkillSpector | 20k | — | ~1.8k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Swarm PR Feedback Closer
ZaxbyHub/opencode-swarm
Ingests existing pull request feedback such as review comments and CI failures, verifies each claim, fixes confirmed issues and reports closure status for every item.
Security Vulnerabilities Patcher
axelixlabs/axelix
Create batched Dependabot-style pull requests for GitHub security findings in axelixlabs/axelix, grouped by dependency surface such as master/front-end, master/build.gradle.kts, or starter Gradle…
Detecting Typosquatting Packages
mukul975/Anthropic-Cybersecurity-Skills
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with…
- Official
Skill Inspector
NVIDIA/SkillSpector
Decides whether an agent skill is safe to install by combining a SkillSpector static scan with the agent's own source review, ending in APPROVE, CAUTION or REJECT.
Supply Chain Security
zhaoxuya520/reverse-skill
A skill your agent uses for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.
More from akitaonrails/my-skills
All 18 skills in this repoFact Check
akitaonrails/my-skills
Adversarial fact-checking of the user's articles and essays (typically blog posts from akitaonrails-hugo, any markdown/text file), verifying every claim against online primary sources via cheap…
Blog Cost Charts
akitaonrails/my-skills
Generate dark-themed cost-vs-score bubble scatter charts and score/(costtime) value-ranking bar charts for a blog post comparing LLM benchmark results (or any dataset with a score/cost/time shape)…
Codemap
akitaonrails/my-skills
Generate comprehensive hierarchical codemaps for UNFAMILIAR repositories.
Clonedeps
akitaonrails/my-skills
Clone important project dependency source code into an ignored local workspace so OpenCode can inspect library internals.
GitHub Resolution
akitaonrails/my-skills
Execute the approved outcomes of a pr-audit and/or iss-audit — fix or adjust everything the audit found necessary before merging, verify no regressions, cover every new behavior with unit tests…
Post Refactor
akitaonrails/my-skills
Post-refactor clean-code check after recent refactors or a few merged PRs.
Related
Works with
Categories
Questions about PR Audit
What does PR Audit do?
Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation…. PR Audit is an agent skill from akitaonrails/my-skills. Audit GitHub pull requests before merge, including contributor-claim verification, prompt-injection resistance, malicious-code and supply-chain review, regressions, tests, documentation, compatibility, base-branch targeting, and project-specific gates.
When should I use PR Audit?
PR Audit fits situations like: decide whether a PR should merge; adjust a contributor PR safely; process approved PRs one at a time.
How do I install PR Audit in Claude Code?
Run `npx skills add akitaonrails/my-skills --skill pr-audit -a claude-code`. Or copy the skill folder (pr-audit in akitaonrails/my-skills) into .claude/skills/pr-audit in your project. Claude Code loads it when a task matches its description.
How do I install PR Audit in Codex?
Run `npx skills add akitaonrails/my-skills --skill pr-audit -a codex`. Or copy the skill folder (pr-audit in akitaonrails/my-skills) into .agents/skills/pr-audit in your project. Codex loads it when a task matches its description.
Can I use PR Audit in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add akitaonrails/my-skills --skill pr-audit -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/pr-audit, .gemini/skills/pr-audit, .github/skills/pr-audit and .opencode/skills/pr-audit in your project.
What does PR Audit need to run?
Going by SKILL.md and its folder, PR Audit needs the command-line tools its instructions call (git, cargo, go and gh). Our summary lists: Python 3; Docker.
Does PR Audit access the network?
SKILL.md contains no URLs. Its commands use git and gh, which can reach the network depending on how they are called. This is read from the text; nothing was executed.
Is PR Audit safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does PR Audit use?
No licence was found for PR Audit or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.
How many tokens does PR Audit use?
About 4.8k tokens (SKILL.md is roughly 19k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to PR Audit?
Skills that share tags, products or a category with PR Audit: Renovate Actions PR Review (backnotprop/plannotator, 9.3k stars), Swarm PR Feedback Closer (ZaxbyHub/opencode-swarm, 496 stars), Security Vulnerabilities Patcher (axelixlabs/axelix, 148 stars) and Detecting Typosquatting Packages (mukul975/Anthropic-Cybersecurity-Skills, 34k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains PR Audit?
akitaonrails (a GitHub user) maintains it in akitaonrails/my-skills, which has 216 GitHub stars. The repository holds 18 skills in this directory. The repository was last updated on September 23, 2026.
Source: akitaonrails/my-skills on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.