Agent skill

Code Review GitHub

by initializ in initializ/forge

GitHub PR workflow orchestration for code review — list PRs, post comments, apply labels, and guarded auto-merge

Apache-2.0Auto-check passedDevelopment

Install Code Review GitHub

skills CLI
$ npx skills add initializ/forge --skill code-review-github -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install initializ/forge code-review-github --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/initializ/forge.git skills-src && mkdir -p .claude/skills && cp -r skills-src/forge-skills/local/embedded/code-review-github .claude/skills/code-review-github && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
code-review-github
GitHub stars
223
Token cost
~2.1k tokens
SKILL.md length
943 words
Files
1
Skills in repo
15
Repo updated
First seen
Licence
Apache-2.0

At a glance

GitHub PR workflow orchestration for code review — list PRs, post comments, apply labels, and guarded auto-merge

  • Works in 5 steps: Env var gate: REVIEW_AUTO_MERGE must be… → Clean review required: By default, the… → CI checks: All required status checks… → …
  • Tasks that involve Code review
  • SKILL.md covers Authentication, Environment Variables, Tool: review_github_list_prs and Tool:…, plus 5 more sections
  • Needs GH_TOKEN

What it does

Code Review GitHub is an agent skill from initializ/forge. GitHub PR workflow orchestration for code review — list PRs, post comments, apply labels, and guarded auto-merge

Its SKILL.md is about 2.1k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Code review and Pull requests. It works with GitHub. The repository describes itself as: Forge is the open-source runtime for Anthropic's Agent Skills standard — built for the agent that runs next to a service, in your environment, on infrastructure you already… The licence is Apache-2.0.

When your agent uses it

  • Tasks that involve Code review
  • Tasks that involve Pull requests

Example prompts

  • “/code-review-github”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Env var gate: REVIEW_AUTO_MERGE must be explicitly set to true. If unset or any other value, merge is blocked with a clear message.
  2. Clean review required: By default, the PR must have no error-severity findings. Override with require_clean_review: false.
  3. CI checks: All required status checks must pass (enforced by GitHub's branch protection).
  4. No dismissed reviews: The tool never dismisses existing review requests or approvals.
  5. Merge conflicts: GitHub API rejects merges with conflicts — the tool surfaces this clearly.

What it can do on your machine

Read from SKILL.md and the folder at commit 3c608d8. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • GH_TOKEN

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Code Review GitHub loads about 2.1k tokens when it runs. Until then it costs about 33 tokens; SKILL.md has 943 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~33
When it runs · the whole SKILL.md, loaded when a task matches
~2.1k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from initializ/forge at commit 3c608d8, republished under its Apache-2.0 licence (© initializ). 943 words, ~2,135 tokens.

Download SKILL.mdSave it as .claude/skills/code-review-github/SKILL.md (or your agent's skills folder).
name
code-review-github
description
GitHub PR workflow orchestration for code review — list PRs, post comments, apply labels, and guarded auto-merge
icon
🐙
category
developer
tags
code-review, github, pull-request, ci, automation

Code Review GitHub Integration

Orchestrates GitHub PR workflows for AI code review. Provides tools to list pull requests, post inline review comments, apply labels based on review findings, and (with explicit opt-in) auto-merge clean PRs.

All GitHub API interactions go through the gh CLI. Direct HTTP requests and web searches are denied to ensure all operations are auditable and respect GitHub's rate limiting.

Authentication

bash
export GH_TOKEN="ghp_..."

The token needs read-write access since this skill posts comments, applies labels, and can merge PRs:

Scope (classic PAT)Fine-grained permissionWhy
repoPull requests: Read & WriteList PRs, post review comments, merge
repoContents: ReadRead PR diff and file contents
repoIssues: WriteApply and remove labels
read:org (optional)Organization: ReadOrg-level label policies

Minimum fine-grained token permissions: pull_requests: write, contents: read, issues: write on the target repository.

For read-only review without GitHub interaction, use the code-review skill instead — it only needs read access.

Environment Variables

VariableRequiredDescription
GH_TOKENyesGitHub personal access token or fine-grained token
REVIEW_AUTO_MERGEnoSet to true to enable guarded auto-merge. Default: disabled
REVIEW_LABEL_PREFIXnoPrefix for review labels (default: review/). Labels: review/approved, review/needs-changes, review/security-concern

Tool: review_github_list_prs

List open pull requests for a repository, optionally filtered by author or label.

Input:

ParameterTypeRequiredDescription
repostringyesRepository in owner/repo format
authorstringnoFilter by PR author username
labelstringnoFilter by label
limitintegernoMaximum PRs to return (default: 10, max: 100)

Output: JSON array of pull requests with number, title, author, url, labels, created_at, updated_at, mergeable_state.

Detection Heuristics

The agent selects this tool when it detects:

  • Requests to "list PRs", "show open pull requests", "what PRs need review"
  • Requests to find PRs by a specific author or with specific labels

Tool: review_github_post_comments

Post inline review comments on a GitHub pull request based on code review findings.

Input:

ParameterTypeRequiredDescription
repostringyesRepository in owner/repo format
pr_numberintegeryesPull request number
findingsarrayyesArray of findings from code_review_diff output
submit_reviewbooleannoSubmit as a formal review (not just individual comments). Default: true
review_eventstringnoReview event type: COMMENT, APPROVE, REQUEST_CHANGES. Default: COMMENT

Each finding in the array should have: file, line, severity, title, description, suggestion.

Output: JSON object with comments_posted, review_url, and any errors for comments that failed.

Detection Heuristics

The agent selects this tool when it detects:

  • Requests to "post review comments", "comment on the PR", "submit review"
  • After running code_review_diff, user asks to post findings to GitHub
Comment Format

Comments are posted as inline review comments with this format:

**[severity] category: title**

description

💡 **Suggestion:** suggestion

Tool: review_github_apply_labels

Apply review-status labels to a pull request based on review findings.

Input:

ParameterTypeRequiredDescription
repostringyesRepository in owner/repo format
pr_numberintegeryesPull request number
risk_levelstringyesOverall risk level from review: low, medium, high, critical
has_security_findingsbooleannoWhether security issues were found. Default: false

Output: JSON object with labels_applied and labels_removed.

Label Mapping
Risk LevelLabel Applied
lowreview/approved
mediumreview/needs-changes
highreview/needs-changes
criticalreview/security-concern

If has_security_findings is true, review/security-concern is always applied regardless of risk level.

Previous review labels (with the configured prefix) are removed before applying new ones.

Detection Heuristics

The agent selects this tool when it detects:

  • Requests to "label the PR", "apply review labels", "mark PR as approved"
  • After completing a review, user asks to update PR status
Show full SKILL.md (387 more words)Show less

Tool: review_github_auto_merge

Merge a pull request after verifying safety conditions. Requires explicit opt-in via REVIEW_AUTO_MERGE=true.

Input:

ParameterTypeRequiredDescription
repostringyesRepository in owner/repo format
pr_numberintegeryesPull request number
merge_methodstringnoMerge method: merge, squash, rebase. Default: squash
require_clean_reviewbooleannoRequire no error-severity findings before merging. Default: true
review_resultobjectnoReview result from code_review_diff to verify cleanliness

Output: JSON object with merged, sha, message, or blocked_reason if merge was prevented.

Detection Heuristics

The agent selects this tool when it detects:

  • Requests to "merge the PR", "auto-merge if clean"
  • Requests to "merge after review passes"
Safety Guards

This tool enforces multiple safety layers:

  1. Env var gate: REVIEW_AUTO_MERGE must be explicitly set to true. If unset or any other value, merge is blocked with a clear message.
  2. Clean review required: By default, the PR must have no error-severity findings. Override with require_clean_review: false.
  3. CI checks: All required status checks must pass (enforced by GitHub's branch protection).
  4. No dismissed reviews: The tool never dismisses existing review requests or approvals.
  5. Merge conflicts: GitHub API rejects merges with conflicts — the tool surfaces this clearly.

Workflow: Full PR Review Cycle

A typical end-to-end review workflow using all three code-review skills:

  1. List PRs → review_github_list_prs to find PRs needing review
  2. Run review → code_review_diff with the PR URL to generate findings
  3. Post comments → review_github_post_comments to post findings as inline comments
  4. Apply labels → review_github_apply_labels to set status labels
  5. Auto-merge (optional) → review_github_auto_merge if review is clean and opt-in is enabled

Safety Constraints

This skill MUST:

  • Never merge without REVIEW_AUTO_MERGE=true explicitly set
  • Never dismiss existing reviews or review requests
  • Never force-push or modify PR branch contents
  • Never delete branches (leave that to GitHub's auto-delete setting)
  • Never bypass branch protection rules
  • Never approve its own PRs (if the token belongs to the PR author)
  • Post comments as the authenticated user — never impersonate
  • All GitHub operations go through gh CLI — http_request and web_search tools are denied
  • Rate-limit awareness: back off on 403/429 responses from GitHub API

Autonomous Compatibility

This skill is designed to work in automated pipelines:

  • All inputs and outputs are structured JSON
  • Error states return JSON with error field and descriptive messages
  • Idempotent: re-running label application or comment posting produces consistent results
  • Labels are prefix-scoped to avoid conflicting with other label systems

© initializ, Apache-2.0. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in forge-skills/local/embedded/code-review-github of initializ/forge.

Open the folder on GitHubat commit 3c608d8

Compare with similar skills

Code Review GitHub next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Code Review GitHub compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Code Review GitHub this skillinitializ/forge223—~2.1kAutomated safety check: PassApache-2.0
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
GitHub Review Iterationprisma/orm48k—~2.2kAutomated safety check: PassApache-2.0
PR Finalize Reviewmicrosoft/garnet12k—~3.1kAutomated safety check: PassMIT
PR Review State Fetchprisma/orm48k—~767Automated safety check: PassApache-2.0
Fastlane Pull Request Reviewfastlane/fastlane42k—~550Automated safety check: PassMIT

Similar skills

  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed
  • Official

    Runs a loop on a GitHub pull request: fetch review state, triage comments into actions, implement them and resolve threads, repeating until nothing actionable is left.

    48k GitHub stars~2.2k tokensUpdated today
    DevelopmentAuto-check passed
  • PR Finalize Review

    microsoft/garnet

    Official

    Checks that a pull request's title and description match its implementation and reviews the code for Garnet best practices, reporting findings without posting them.

    12k GitHub stars~3.1k tokensUpdated today
    DevelopmentAuto-check passed
  • Official

    Fetches a pull request's canonical review state as JSON, validates it, and renders markdown, a text summary and triage target files from it using bundled scripts.

    48k GitHub stars~767 tokensUpdated today
    DevelopmentAuto-check passed
  • Reviews a fastlane pull request against its linked issue and the project guides, separating blocking from non-blocking findings and handling vulnerabilities privately.

    42k GitHub stars~550 tokensUpdated today
    DevelopmentAuto-check passed
  • Reviews open pull requests in the daisyUI repository using read-only GitHub data and isolated base-versus-PR checks, then writes a merge verdict report.

    43k GitHub stars~766 tokensUpdated 7 days ago
    DevelopmentAuto-check passed

More from initializ/forge

All 15 skills in this repo
  • Code Plan

    initializ/forge

    Turn a task description and repository into a structured implementation plan (files to create, files to modify, tests to add, risks).

    223 GitHub stars~1.9k tokensUpdated 6 days ago
    Auto-check passed
  • Code Review

    initializ/forge

    AI-powered code review for diffs and individual files using LLM analysis

    223 GitHub stars~3k tokensUpdated 6 days ago
    Auto-check passed
  • Codegen HTML

    initializ/forge

    Scaffold and iterate on standalone Preact + HTM applications with zero build dependencies

    223 GitHub stars~1.5k tokensUpdated 6 days ago
    Auto-check passed
  • Code Agent

    initializ/forge

    General-purpose coding agent that reads, writes, and edits code, and searches codebases.

    223 GitHub stars~2.5k tokensUpdated 6 days ago
    Auto-check: warnings
  • Codegen React

    initializ/forge

    Scaffold and iterate on Vite + React applications. An agent skill from initializ/forge.

    223 GitHub stars~1.8k tokensUpdated 6 days ago
    Auto-check passed
  • K8s Cost Visibility

    initializ/forge

    Estimate Kubernetes infrastructure costs by querying cluster node, pod, PVC/PV, and LoadBalancer data, applying cloud pricing models, and producing cost attribution reports with storage and…

    223 GitHub stars~2.7k tokensUpdated 6 days ago
    Auto-check passed

Works with

Categories

Questions about Code Review GitHub

What does Code Review GitHub do?

GitHub PR workflow orchestration for code review — list PRs, post comments, apply labels, and guarded auto-merge. Code Review GitHub is an agent skill from initializ/forge.

When should I use Code Review GitHub?

Code Review GitHub fits situations like: tasks that involve Code review; tasks that involve Pull requests.

How do I install Code Review GitHub in Claude Code?

Run `npx skills add initializ/forge --skill code-review-github -a claude-code`. Or copy the skill folder (forge-skills/local/embedded/code-review-github in initializ/forge) into .claude/skills/code-review-github in your project. Claude Code loads it when a task matches its description.

How do I install Code Review GitHub in Codex?

Run `npx skills add initializ/forge --skill code-review-github -a codex`. Or copy the skill folder (forge-skills/local/embedded/code-review-github in initializ/forge) into .agents/skills/code-review-github in your project. Codex loads it when a task matches its description.

Can I use Code Review GitHub in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add initializ/forge --skill code-review-github -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/code-review-github, .gemini/skills/code-review-github, .github/skills/code-review-github and .opencode/skills/code-review-github in your project.

What does Code Review GitHub need to run?

Going by SKILL.md and its folder, Code Review GitHub needs credentials named GH_TOKEN.

Does Code Review GitHub access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Code Review GitHub safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Code Review GitHub use?

Code Review GitHub is published under the Apache-2.0 licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Code Review GitHub use?

About 2.1k tokens (SKILL.md is roughly 8.5k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Code Review GitHub?

Skills that share tags, products or a category with Code Review GitHub: PR Babysitter (openinterpreter/openinterpreter, 69k stars), GitHub Review Iteration (prisma/orm, 48k stars), PR Finalize Review (microsoft/garnet, 12k stars) and PR Review State Fetch (prisma/orm, 48k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Code Review GitHub?

initializ (a GitHub organization) maintains it in initializ/forge, which has 223 GitHub stars. The repository holds 15 skills in this directory. The repository was last updated on October 1, 2026.

Source: initializ/forge on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.