Agent skill

PR Review

by cdklabs in cdklabs/cdk-nextjs

Review the current PR branch and fix the findings in rounds until reviews come back clean.

Apache-2.0Auto-check passedDevelopment

Install PR Review

skills CLI
$ npx skills add cdklabs/cdk-nextjs --skill pr-review -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install cdklabs/cdk-nextjs pr-review --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/cdklabs/cdk-nextjs.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/pr-review .claude/skills/pr-review && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
pr-review
GitHub stars
111
Token cost
~2.4k tokens
SKILL.md length
1,353 words
Files
1
Skills in repo
1
Repo updated
First seen
Licence
Apache-2.0

At a glance

Review the current PR branch and fix the findings in rounds until reviews come back clean.

  • Works in 7 steps: Setup → Review (fresh subagent every round) → Triage (main agent) → …
  • Asked to review a PR to convergence
  • SKILL.md covers 0. Setup, 1. Review (fresh subagent…, 2. Triage (main agent) and 3. Fix and verify, plus 4 more sections
  • Calls git, pnpm and gh; reaches github.com

What it does

PR Review is an agent skill from cdklabs/cdk-nextjs. Review the current PR branch and fix the findings in rounds until reviews come back clean. Each round, a fresh reviewer runs /code-review high, findings are triaged against a ledger and recorded decisions, accepted ones are fixed, verified and committed. Use when asked to review a PR to convergence, "review and implement it all", or to resume a previous pr-review run.

Its SKILL.md is about 2.4k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Pull requests. It works with Next.js, Amazon Web Services, React and Node.js. The repository describes itself as: Deploy Next.js on AWS with CDK. The licence is Apache-2.0.

When your agent uses it

  • Asked to review a PR to convergence
  • Review and implement it all
  • Resume a previous pr-review run

Example prompts

  • “review and implement it all”
  • “/pr-review”

Requirements

  • Node.js

Workflow steps

7 steps, taken from the step headings in SKILL.md.

  1. Setup
  2. Review (fresh subagent every round)
  3. Triage (main agent)
  4. Fix and verify
  5. Commit and log
  6. Convergence
  7. Finish

What it can do on your machine

Read from SKILL.md and the folder at commit aadf654. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • git
    • pnpm
    • gh
    • npx

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    Hosts in commands or code, which the agent is likely to contact:

    • github.com

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

PR Review loads about 2.4k tokens when it runs. Until then it costs about 95 tokens; SKILL.md has 1,353 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~95
When it runs · the whole SKILL.md, loaded when a task matches
~2.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from cdklabs/cdk-nextjs at commit aadf654, republished under its Apache-2.0 licence (© cdklabs). 1,353 words, ~2,442 tokens.

Download SKILL.mdSave it as .claude/skills/pr-review/SKILL.md (or your agent's skills folder).
name
pr-review
description
Review the current PR branch and fix the findings in rounds until reviews come back clean. Each round, a fresh reviewer runs /code-review high, findings are triaged against a ledger and recorded decisions, accepted ones are fixed, verified and committed. Use when asked to review a PR to convergence, "review and implement it all", or to resume a previous pr-review run.
argument-hint
[PR#] [--rounds N]

PR review to convergence

Loop: review → triage → fix → verify → commit, until a review finds nothing new or the round cap is hit. Everything stays local until the end: no pushes and no PR comments during the loop.

Arguments: optional PR number (defaults to the current branch's PR), and --rounds N (default 5, counting every review including the final full pass).

0. Setup

  1. Refuse to run on main. The working tree must be clean. If it isn't, stop and ask; do not git stash (the user keeps real work in the stash).
  2. Resolve the PR: gh pr view [PR#] --json number,title,baseRefName,headRefName. Run git fetch origin <baseRefName>.
  3. FULL_BASE=$(git merge-base origin/<baseRefName> HEAD).
  4. Ledger: .claude/pr-review/<branch-with-slashes-as-dashes>.md (gitignored). If it exists, resume: read it, continue the round numbering, and keep every recorded outcome. Otherwise create it from the template at the bottom.
  5. Upstream sources (UPSTREAM_SOURCES): if the branch mirrors, parses or calls code that lives outside this repo, have that code available at the version the branch targets. That covers a package's runtime (next itself, @next/routing), a restated upstream function (extractEtag), and upstream code no package ships, such as the next.js test harness whose @force-gate pragmas screen.mjs evaluates. Packages are in node_modules/<pkg>. Anything else needs a shallow clone at the matching tag, for example git clone --depth 1 --branch v<version> https://github.com/vercel/next.js /tmp/nextjs-<version>. Reuse a clone that already exists. Record the paths in the ledger header.
  6. Collect recorded decisions: read the project memory index (MEMORY.md) and every memory describing a deliberate design choice (e.g. "X chosen over Y", "X is kept", "Y rejected"). Add a one-line summary of each to the ledger's Recorded decisions section. The triage step checks findings against these.

1. Review (fresh subagent every round)

Pick the range:

  • Round 1, and the final pass: FULL, i.e. FULL_BASE..HEAD.
  • Rounds in between: DELTA, i.e. <HEAD sha when the previous review started>..HEAD, which covers just the fix commits.

Spawn one new general-purpose subagent each round. Never reuse an earlier reviewer, because it would anchor on its own earlier findings. Give it this prompt, filled in:

Review the changes in <RANGE> on branch <branch> (PR #<n>: <title>) for correctness bugs. Invoke the code-review skill with args high. Do not pass --comment or --fix. That skill may pick its own diff range (it tends to use @{upstream}...HEAD, or the remote PR, which lacks local commits). Compare the files it reviewed with git diff --name-only <RANGE>. If they differ, or the skill doesn't say, also review git diff <RANGE> yourself at the same rigor: read the surrounding code, not just the hunks. Do that review while the skill runs, then wait for the skill's results before you report. You can't send anything after you hand back, so results that arrive later are lost. Upstream sources, at the version this branch targets: <UPSTREAM_SOURCES>. A finding about how code outside this repo behaves must cite that code. Don't infer the behaviour ("presumably", "as in JS"). Filter the skill's findings; don't discard them wholesale:

  • In range: on lines <RANGE> changes. Verify each against the code and report it with your own findings.
  • Outside range: elsewhere in code this branch changes (git diff <FULL_BASE>..HEAD). Verify each one too, and report it in a separate "outside range" list.
  • Noise: in uncommitted or unrelated files. Drop these. For a DELTA range: also check that each fix actually resolves the ledger finding it cites, and doesn't break callers outside the diff. Already decided. Don't re-raise these unless the code shows the fix is wrong or incomplete; if so, cite the ledger ID: <paste ledger rows (ID, location, finding, status) + Recorded decisions> Return a list. For each finding give: file:line, a one-sentence defect, a concrete failure scenario, severity (high/medium/low), and the ledger ID it relates to (if any). Make no edits. If you find nothing, say so explicitly.

Record in the ledger: the round number, range type, range SHAs, and the raw count of findings. Outside-range findings are triaged in the same round as the rest and count toward its totals. If a reviewer reports without the skill's results anyway, note it in the ledger and make the next review a FULL pass.

Show full SKILL.md (662 more words)Show less

2. Triage (main agent)

Read the cited code for every finding before you classify it. If a finding rests on how code outside this repo behaves (a grammar's precedence, what Next.js passes to a hook), check that code in UPSTREAM_SOURCES before you mark it fix. A wrong fix costs a revert and another round. Then give it exactly one status:

StatusWhenAction
duplicateSame issue as an existing ledger row, with nothing newDrop. Note the ID only
invalidThe code shows the claim is falseRecord the reason
escalatedContradicts a recorded decision; or would reverse a fix from an earlier round (oscillation); or the same location has already been fixed in 2+ rounds; or needs a product/API decision (public API break, new dependency, behaviour change users would notice)Record it. Don't implement. Keep looping
fix (revert)Would reverse an earlier round's fix, and the code (this repo's, or upstream code in UPSTREAM_SOURCES) shows that fix was wrong. This isn't oscillation, because the earlier fix had no valid basisRevert it. Mark the earlier row invalid (citing the code that proves it wrong) and this one fix
fixEverything else, at any severity: correctness, performance, simplification, style, test and docs findingsImplement

Default to fix: the user has said "implement it all." Escalate only for the reasons in the table, not because a finding is minor: low-severity fixes rarely break anything, the next review catches it when one does, and unfixed ones add up.

3. Fix and verify

  1. Implement every fix finding. Match the surrounding code. Add or adjust tests when a finding describes a behaviour bug.
  2. Verify:
    • pnpm compile if JSII sources (src/, excluding the bundled runtime code) or struct definitions changed
    • pnpm bundle if src/adapter/, src/lambdas/ or src/nextjs-build/patch-fetch.js changed
    • pnpm jest <affected test files>
    • pnpm eslint (whole repo; no file args, no npx eslint)
    • Never pnpm build (docgen hangs; CI regenerates API.md)
  3. If a fix can't be made to pass, revert just that fix, mark it escalated ("fix broke X: <error>"), and continue.

4. Commit and log

  1. Commit with fix: address review round <N> (use the test:/docs: prefix if that's all the round touched). The body is one line per fix: - <ledger ID>: <what changed>. Never pass --no-verify.
  2. Update each ledger row with its outcome (fixed <short sha>, invalid: <reason>, escalated: <reason>).

5. Convergence

After each round, count the blocking findings: those triaged fix or escalated with severity medium or high. Low-severity findings are still fixed (or escalated) and recorded, but don't keep the loop going on their own. duplicate and invalid don't count.

  • A DELTA round with 0 blocking findings → fix any lows, then run the final FULL pass next (it reviews those fixes too). If that FULL pass was already the last review, you've converged.
  • A FULL round with 0 blocking findings → fix any lows; converged. Say in the report that those last fixes weren't reviewed.
  • Any blocking findings → run another round (a DELTA review of the new commits).
  • The round cap is hit with blocking findings still coming → stop, not converged. If the cap leaves room for only one more review, make it the FULL pass.

6. Finish

  1. Run the full pnpm test once.
  2. Report to the user:
    • Converged or not, and how many rounds
    • A per-round table: range type, raw findings, new, blocking, fixed, escalated
    • Escalations needing a decision: each with ledger ID, file:line, the finding, why it was escalated, and your recommendation
    • Any test failures, with their output
  3. Ask before pushing and before posting the summary. Both are outward-facing. If the user approves, push, then post one condensed ledger comment (rounds table, then fixes grouped by area, then escalations and how they were resolved) with gh pr comment <n> --body-file <file>.
  4. If the user resolves escalations, record the outcomes in the ledger. If an outcome is a durable design decision, offer to save it as a memory so future runs skip it.

Ledger template

markdown
# pr-review ledger: PR #<n> <title>

Branch: <branch> · Base: origin/<base> @ <FULL_BASE short sha>
Upstream sources: <UPSTREAM_SOURCES, or "none">

## Recorded decisions
- <memory slug>: <one line>

## Rounds
| Round | Range | SHAs | Raw | New | Blocking | Fixed | Escalated | Commit |
|---|---|---|---|---|---|---|---|---|

## Findings
| ID | Round | Location | Finding | Status | Detail |
|---|---|---|---|---|---|
| R1-1 | 1 | src/adapter/cache-handler.ts:120 | … | fixed | a1b2c3d |

© cdklabs, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in .claude/skills/pr-review of cdklabs/cdk-nextjs.

Open the folder on GitHubat commit aadf654

Compare with similar skills

PR Review next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

PR Review compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
PR Review this skillcdklabs/cdk-nextjs111—~2.4kAutomated safety check: PassApache-2.0
Git Workflowsoftmaple/softmaple161—~814Automated safety check: PassApache-2.0
Create PRvercel/next.js143k—~943Automated safety check: PassMIT
Nylas Nodejs Releasenylas/nylas-nodejs181—~1.6kAutomated safety check: WarnMIT
Senior Fullstackdavila7/claude-code-templates32k7 repos~1.1kAutomated safety check: NotesMIT
PRalamenai/terrae244—~767Automated safety check: NotesMIT

Similar skills

  • Git Workflow

    softmaple/softmaple

    Softmaple Git branching, commits, pre-commit hooks, and pull requests.

    161 GitHub stars~814 tokensUpdated yesterday
    DevelopmentAuto-check passed
  • Create PR

    vercel/next.js

    Official

    Create Git branches, commits, pushes, and GitHub pull requests for Next.js.

    143k GitHub stars~943 tokensUpdated today
    DevelopmentAuto-check passed
  • Nylas Nodejs Release

    nylas/nylas-nodejs

    Prepares nylas-nodejs SDK releases on a versioned release branch with CHANGELOG updates, version bump, git tag, and PR body.

    181 GitHub stars~1.6k tokensUpdated 6 days ago
    DevelopmentAuto-check: warnings
  • Senior Fullstack

    davila7/claude-code-templates

    Comprehensive fullstack development skill for building complete web applications with React, Next.js, Node.js, GraphQL, and PostgreSQL.

    32k GitHub starsUsed in 7 repos~1.1k tokens
    DevelopmentAuto-check: notes
  • PR

    alamenai/terrae

    Commit, push, and open a pull request on GitHub. An agent skill from alamenai/terrae.

    244 GitHub stars~767 tokensUpdated 6 mo ago
    DevelopmentAuto-check: notes
  • Create PR

    go-to-k/cdkd

    Run /verify-pr checks, then create a GitHub PR if all pass. An agent skill from go-to-k/cdkd.

    144 GitHub stars~873 tokensUpdated today
    DevelopmentAuto-check passed

Categories

Questions about PR Review

What does PR Review do?

Review the current PR branch and fix the findings in rounds until reviews come back clean. PR Review is an agent skill from cdklabs/cdk-nextjs. Review the current PR branch and fix the findings in rounds until reviews come back clean.

When should I use PR Review?

PR Review fits situations like: asked to review a PR to convergence; review and implement it all; resume a previous pr-review run.

How do I install PR Review in Claude Code?

Run `npx skills add cdklabs/cdk-nextjs --skill pr-review -a claude-code`. Or copy the skill folder (.claude/skills/pr-review in cdklabs/cdk-nextjs) into .claude/skills/pr-review in your project. Claude Code loads it when a task matches its description.

How do I install PR Review in Codex?

Run `npx skills add cdklabs/cdk-nextjs --skill pr-review -a codex`. Or copy the skill folder (.claude/skills/pr-review in cdklabs/cdk-nextjs) into .agents/skills/pr-review in your project. Codex loads it when a task matches its description.

Can I use PR Review in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add cdklabs/cdk-nextjs --skill pr-review -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/pr-review, .gemini/skills/pr-review, .github/skills/pr-review and .opencode/skills/pr-review in your project.

What does PR Review need to run?

Going by SKILL.md and its folder, PR Review needs the command-line tools its instructions call (git, pnpm, gh and npx). Our summary lists: Node.js.

Does PR Review access the network?

SKILL.md names 1 domain. In commands or code: github.com; the agent is likely to contact it when it follows the instructions. This is read from the text; nothing was executed.

Is PR Review safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does PR Review use?

PR Review is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does PR Review use?

About 2.4k tokens (SKILL.md is roughly 9.8k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to PR Review?

Skills that share tags, products or a category with PR Review: Git Workflow (softmaple/softmaple, 161 stars), Create PR (vercel/next.js, 143k stars), Nylas Nodejs Release (nylas/nylas-nodejs, 181 stars) and Senior Fullstack (davila7/claude-code-templates, 32k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains PR Review?

cdklabs (a GitHub organization) maintains it in cdklabs/cdk-nextjs, which has 111 GitHub stars. The repository was last updated on October 8, 2026.

Source: cdklabs/cdk-nextjs on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.