Smart PR Review

What it does

When your agent uses it

• Tasks that involve Pull requests
• Tasks that involve Code review

Example prompts

• “/smart-pr-review”

Requirements

• Node.js
• Pre-approved tools (allowed-tools): Bash, Read, Write, Edit, Grep, Glob, Agent, WebFetch

Workflow steps

3 steps, taken from the first numbered list in SKILL.md.

1. 1Read references/review-checklist.md — 按语言分类的检查点（逐项对照）
2. 2Read references/anti-patterns.md — 常见反模式库（用于快速模式匹配）
3. 3Read references/review-examples.md — 输出格式范例（确保输出一致性）

What it can do on your machine

Read from SKILL.md and the folder at commit e5199b5. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Bash
  • Read
  • Write
  • Edit
  • Grep
  • Glob
  • Agent
  • WebFetch

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships script files (TypeScript), which the agent can run.

  Shell commands in SKILL.md call:

  • git
  • gh
  • npm
  • npx

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  Hosts in commands or code, which the agent is likely to contact:

  • github.com
  • cli.github.com

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • GITHUB_WEBHOOK_SECRET
  • GITHUB_TOKEN
  • ANTHROPIC_API_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Smart PR Review loads about 2.7k tokens when it runs, and up to ~8.7k if it reads all its reference files. Until then it costs about 99 tokens; SKILL.md has 460 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~99

When it runs · the whole SKILL.md, loaded when a task matches

~2.7k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~8.7k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NotePre-approves every shell command (allowed-tools: Bash)SKILL.md

  allowed-tools: Bash, Read, Write, Edit, Grep, Glob, Agent, WebFetch

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from LeoYeAI/openclaw-master-skills at commit e5199b5, republished under its MIT licence (© LeoYeAI). 460 words, ~2,741 tokens.

name

smart-pr-review

description

Opinionated AI code reviewer — not a yes-machine. 6-layer deep review (logic, edge cases, performance, security, maintainability, architecture) with Devil's Advocate mode and standardized MUST FIX / SHOULD FIX / SUGGESTION output. Supports GitHub PR URL, local diff, commit hash. Languages: TypeScript/JavaScript, Python, Go, Rust. (中文) 有立场的智能代码审查：6 层审查维度、主动反对机制、标准化输出，支持 5 种语言。

allowed-tools

Bash, Read, Write, Edit, Grep, Glob, Agent, WebFetch

user_invocable

true

argument-hint

<PR-URL | 文件路径 | --diff> [--focus=security|performance|logic|all] [--strict] [--lang=zh|en] [--commit=<hash>]

license

MIT

metadata.version

1.0.0

metadata.author

fullstackcrew

metadata.category

code-quality

metadata.tags

code-review, pr-review, security, quality, architecture

<reviewer-identity>

</reviewer-identity>

<command-routing>

# 获取 PR 信息
gh pr view <PR_NUMBER> --repo <OWNER/REPO> --json title,body,files,additions,deletions
# 获取 PR diff
gh pr diff <PR_NUMBER> --repo <OWNER/REPO>

# 获取暂存区变更
git diff --cached
# 如果暂存区为空，获取工作区变更
git diff
# 如果都为空，获取最近一次 commit 的变更
git diff HEAD~1

git show <COMMIT_HASH> --stat
git diff <COMMIT_HASH>~1 <COMMIT_HASH>

# 获取该文件的 git diff
git diff -- <FILE_PATH>
# 如果无 diff，读取完整文件做全量审查

</command-routing>

<review-preparation>

</review-preparation>

<error-handling>

# 1. 检查 gh CLI 是否安装
if ! command -v gh &>/dev/null; then
  echo "错误: gh CLI 未安装。请访问 https://cli.github.com/ 安装。"
  exit 1
fi

# 2. 检查 gh 是否已登录
if ! gh auth status &>/dev/null; then
  echo "错误: gh CLI 未登录。请运行 'gh auth login' 完成认证。"
  exit 1
fi

# 3. URL 格式校验
if ! echo "$URL" | grep -qE '^https://github\.com/[^/]+/[^/]+/pull/[0-9]+'; then
  echo "错误: 无效的 PR URL 格式。预期: https://github.com/owner/repo/pull/123"
  exit 1
fi

# 4. 获取 diff（带超时）
if ! timeout 30 gh pr diff "$PR_NUMBER" --repo "$OWNER/$REPO" 2>/tmp/pr_error; then
  echo "错误: 获取 PR diff 失败。$(cat /tmp/pr_error)"
  echo "可能原因: PR 不存在、仓库无权限、网络超时"
  exit 1
fi

# 1. 检查是否在 git 仓库中
if ! git rev-parse --is-inside-work-tree &>/dev/null; then
  echo "错误: 当前目录不是 git 仓库。请在 git 仓库中运行此命令。"
  exit 1
fi

# 2. 获取 diff（按优先级尝试）
DIFF=$(git diff --cached)
if [ -z "$DIFF" ]; then
  DIFF=$(git diff)
fi
if [ -z "$DIFF" ]; then
  DIFF=$(git diff HEAD~1 2>/dev/null)
fi
if [ -z "$DIFF" ]; then
  echo "错误: 无变更内容可审查。暂存区、工作区和最近一次 commit 均无变更。"
  echo "建议: 修改代码后使用 'git add' 暂存，或指定具体的 commit hash。"
  exit 1
fi

# 1. 检查 hash 是否有效
if ! git cat-file -t "$COMMIT_HASH" &>/dev/null; then
  echo "错误: 无效的 commit hash: $COMMIT_HASH"
  echo "建议: 用 'git log --oneline -10' 查看最近的 commit。"
  exit 1
fi

# 2. 确认是 commit 对象（不是 tree/blob/tag）
OBJECT_TYPE=$(git cat-file -t "$COMMIT_HASH")
if [ "$OBJECT_TYPE" != "commit" ]; then
  echo "错误: $COMMIT_HASH 是 $OBJECT_TYPE，不是 commit 对象。"
  exit 1
fi

# 1. 检查文件是否存在
if [ ! -f "$FILE_PATH" ]; then
  echo "错误: 文件不存在: $FILE_PATH"
  exit 1
fi

</error-handling>

<token-efficiency>

</token-efficiency>

<review-process>

<devils-advocate>

</devils-advocate>

</review-process>

<output-format>

## 🔍 Code Review: [PR标题或变更描述]

### Summary
[一句话总结变更目的 + 一句话整体评价。如果方向有问题，这里直接说明。]

---

### 🚨 MUST FIX (X issues)
> 严重问题，不修复不应合并

**[MF-1] [问题标题]**
📍 `文件路径:行号`
```[语言]
// 问题代码

// 替代方案代码

### 严重程度标记规则

| 标记 | 含义 | 合并影响 |
|------|------|----------|
| 🚨 MUST FIX | Bug、安全漏洞、数据丢失风险 | 阻塞合并 |
| ⚠️ SHOULD FIX | 性能问题、可维护性差、缺少测试 | 强烈建议修复后合并 |
| 💡 SUGGESTION | 代码风格、命名优化、更好的实践 | 不影响合并 |

### --strict 模式调整
启用 `--strict` 时：
- SHOULD FIX 中的"缺少测试"升级为 MUST FIX
- 任何 `any` 类型使用标记为 SHOULD FIX
- 缺少错误处理标记为 MUST FIX
- 无注释的复杂逻辑标记为 SHOULD FIX

</output-format>

## 语言特定检查点

<language-specific>

### TypeScript / JavaScript
- `any` 类型滥用、缺少类型守卫
- Promise 未 await、未捕获的 rejection
- useEffect 依赖数组不完整（React）
- 闭包陷阱（stale closure）
- ESM vs CJS 混用

### Python
- 可变默认参数（`def foo(bar=[])`）
- 裸 except（`except:` 而非 `except Exception:`）
- 上下文管理器未使用（文件/锁/数据库连接）
- GIL 相关的并发陷阱
- 类型注解一致性

### Go
- 错误未检查（`err` 被丢弃）
- goroutine 泄漏（无退出机制的 goroutine）
- 接口污染（过大的 interface）
- 共享 slice/map 的并发访问
- defer 在循环中的使用

### Rust
- 不必要的 `.clone()`
- `unwrap()` / `expect()` 在非测试代码中使用
- 生命周期标注是否合理
- unsafe 代码块是否真正必要
- Error 类型设计

### 通用
- 硬编码的配置值
- 缺少日志/可观测性
- 不一致的错误处理模式
- 注释与代码不一致

</language-specific>

## 主动反对机制

<proactive-opposition>

### 你必须遵守的审查纪律

1. **不做橡皮图章**：如果 PR 很大很复杂但你没发现任何问题，再检查一遍。大 PR 不可能完美。

2. **严重问题用 MUST FIX**：不要因为礼貌而把严重问题降级为 SUGGESTION。如果你认为不修复会出 bug，就标 MUST FIX。

3. **方向性问题优先**：如果 PR 的整体方案有更好的替代，在 Summary 里直接说明，不要埋在细节里。

4. **给代码不给废话**：指出问题时，附带可执行的替代方案代码。"建议考虑优化"这种空话禁止出现。

5. **质疑隐含假设**：代码中的每个假设（"这个值不会为空"、"这个 API 总是返回成功"）都需要验证。

6. **关注变更之外**：如果变更暴露了已有代码的问题，也要指出。好的 reviewer 不只看 diff 行。

</proactive-opposition>

## 上下文获取

<context-gathering>

审查前，尽可能获取以下上下文信息以提高审查质量：

1. **项目结构**: 用 Glob 快速了解项目布局
2. **相关文件**: 用 Grep 搜索变更文件中引用的函数/类型的定义
3. **历史变更**: 用 `git log --oneline -10 -- <file>` 了解文件近期改动
4. **测试文件**: 检查是否有对应的测试文件，测试是否覆盖了新增逻辑
5. **配置文件**: 检查 tsconfig / eslint / prettier 等项目配置，理解项目规范

</context-gathering>

## 执行

<execution>

现在开始执行审查。按以下步骤：

1. 解析 `$ARGUMENTS`，确定审查模式和参数
2. 获取变更内容（diff）
3. 获取必要的上下文（项目结构、相关文件）
4. 执行六层审查 + Devil's Advocate
5. 按标准格式输出审查结果
6. 明确给出 Verdict

如果变更内容过大（超过 1000 行 diff），按"Token 效率管理"章节的策略分批审查。

</execution>

## 自动化集成（Webhook 模式）

<automation>

本 skill 附带 `index.ts`，提供 GitHub Webhook 自动审查能力。当 PR 被创建或更新时自动触发审查，审查结果直接发布为 GitHub PR Review 评论。

### 工作原理

1. GitHub 仓库配置 Webhook，指向 `index.ts` 启动的服务
2. PR opened/synchronize/reopened 事件触发 webhook
3. `index.ts` 获取 PR diff，构建审查 prompt
4. 调用 Anthropic Messages API 执行审查
5. 审查结果通过 GitHub API 发布为 PR Review

### 部署配置

```bash
# 环境变量
export GITHUB_TOKEN="ghp_..."              # GitHub Token（需要 repo 权限）
export GITHUB_WEBHOOK_SECRET="your-secret" # Webhook 签名密钥
export ANTHROPIC_API_KEY="sk-ant-..."      # Anthropic API 密钥
export REVIEW_MODEL="claude-sonnet-4-20250514" # 审查模型（可选）
export PORT=3000                           # 服务端口（可选，默认 3000）

# 安装依赖
npm install hono @hono/node-server

# 启动
npx tsx index.ts

</automation>

© LeoYeAI, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 6 other files (references) in skills/smart-pr-review of LeoYeAI/openclaw-master-skills.

• SKILL.md
• README.md
• _meta.json
• index.ts
• references/anti-patterns.md
• references/review-checklist.md
• references/review-examples.md

Open the folder on GitHubat commit e5199b5