Agent skill

Review PR

by WordPress in WordPress/wordcamp.org

Review a pull request in this repo the way we review here, including security fixes under private disclosure.

No licenceAuto-check: notesDevelopment

Install Review PR

skills CLI
$ npx skills add WordPress/wordcamp.org --skill review-pr -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install WordPress/wordcamp.org review-pr --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/WordPress/wordcamp.org.git skills-src && mkdir -p .claude/skills && cp -r skills-src/.claude/skills/review-pr .claude/skills/review-pr && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
review-pr
GitHub stars
160
Token cost
~3.9k tokens
SKILL.md length
2,220 words
Files
1
Skills in repo
2
Repo updated
First seen
Licence
None found

At a glance

Review a pull request in this repo the way we review here, including security fixes under private disclosure.

  • A batch of branches
  • SKILL.md covers Claims, Reproducing, In the browser and Tests, plus 8 more sections
  • Calls docker, npm and curl; needs MARIADB_ROOT_PASSWORD
  • Writing up a security fix

What it does

Review PR is an agent skill from WordPress/wordcamp.org. Review a pull request in this repo the way we review here, including security fixes under private disclosure. The method, not the commands - what to distrust in a PR body, how to reproduce and mutate, how to drive the real UI with claude-in-chrome and read the raw response behind it, how to prove a finding before reporting it, how to merge a batch, and how to split public PR text from a private security issue. Use when reviewing a PR, a branch, or a batch of branches, and when reviewing or writing up a security…

Its SKILL.md is about 3.9k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Development, covering Pull requests. The repository describes itself as: WordCamps are casual, locally-organized conferences covering everything related to WordPress.

When your agent uses it

  • A batch of branches
  • Writing up a security fix

Example prompts

  • “/review-pr”

What it can do on your machine

Read from SKILL.md and the folder at commit 5612384. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • docker
    • npm
    • curl
    • php
    • git

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use docker, npm, curl and git, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • MARIADB_ROOT_PASSWORD

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Review PR loads about 3.9k tokens when it runs. Until then it costs about 133 tokens; SKILL.md has 2,220 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~133
When it runs · the whole SKILL.md, loaded when a task matches
~3.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check: notes

The automated check noted patterns worth knowing about, such as sudo or a known installer.

  • NoteMentions a .env fileSKILL.md:189
    RDCAMP_HTTPS_PORT=8443` in a gitignored `.env`, browse `https://…:8443/`, and delete `.env` afterwards.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 2,220 words (~3,930 tokens).

“Commands are in AGENTS.md. Domain traps are in .claude/skills/groups-gatherpress-compat-test/. This is the method.”

— opening of SKILL.md by WordPress
name
review-pr

Read the full SKILL.md on GitHub

Files

Just SKILL.md in .claude/skills/review-pr of WordPress/wordcamp.org.

Open the folder on GitHubat commit 5612384

Compare with similar skills

Review PR next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Review PR compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Review PR this skillWordPress/wordcamp.org160—~3.9kAutomated safety check: NotesNone
Finishing a Development Branchobra/superpowers296k5 repos~1.9kAutomated safety check: PassMIT
PR Babysitteropeninterpreter/openinterpreter69k3 repos~4.2kAutomated safety check: PassApache-2.0
Check PRonyx-dot-app/onyx32k2 repos~2.3kAutomated safety check: PassMIT
Understand Diff AnalysisEgonex-AI/Understand-Anything85k1 repos~1.4kAutomated safety check: PassMIT
PR Design DocOpenHands/OpenHands90k—~2.4kAutomated safety check: PassMIT

Similar skills

  • Walks the last step of a branch: confirm tests pass, detect the git environment, ask how to integrate, carry out your choice and clean up the worktree.

    296k GitHub starsUsed in 5 repos~1.9k tokens
    DevelopmentAuto-check passed
  • PR Babysitter

    openinterpreter/openinterpreter

    Watches an open GitHub pull request until it merges, handling review comments, diagnosing CI failures and retrying flaky checks along the way.

    69k GitHub starsUsed in 3 repos~4.2k tokens
    DevelopmentAuto-check passed
  • Check PR

    onyx-dot-app/onyx

    Checks a GitHub, GitLab, or Perforce (p4) pull request (or merge request, or shelved changelist) for unresolved review comments, failing status checks, and incomplete PR descriptions.

    32k GitHub starsUsed in 2 repos~2.3k tokens
    DevelopmentAuto-check passed
  • Understand Diff Analysis

    Egonex-AI/Understand-Anything

    Reads your git changes or a pull request against a prebuilt knowledge graph of the project to explain what changed, which components are affected and what is risky.

    85k GitHub starsUsed in 1 repo~1.4k tokens
    DevelopmentAuto-check passed
  • PR Design Doc

    OpenHands/OpenHands

    For a non-trivial pull request, write a self-contained HTML design doc under the temporary .pr/ directory and link a visibility-appropriate preview in the PR description, so maintainers grasp the…

    90k GitHub stars~2.4k tokensUpdated today
    DevelopmentAuto-check passed
  • WooCommerce Code Review

    woocommerce/woocommerce

    Reviews WooCommerce code changes against the project's standards, flagging backend PHP architecture, naming, documentation, data integrity and testing violations.

    11k GitHub starsUsed in 3 repos~1.1k tokens
    DevelopmentAuto-check passed

More from WordPress/wordcamp.org

  • Create PR

    WordPress/wordcamp.org

    End-to-end workflow for shipping a non-trivial feature or fix as a pull request in this repo — plan and get sign-off, implement, verify with PHPUnit/phpcs/build, verify manually in a real browser…

    160 GitHub stars~1.6k tokensUpdated yesterday
    Auto-check passed

Categories

Questions about Review PR

What does Review PR do?

Review a pull request in this repo the way we review here, including security fixes under private disclosure. org. Review a pull request in this repo the way we review here, including security fixes under private disclosure.

When should I use Review PR?

Review PR fits situations like: A batch of branches; writing up a security fix.

How do I install Review PR in Claude Code?

Run `npx skills add WordPress/wordcamp.org --skill review-pr -a claude-code`. Or copy the skill folder (.claude/skills/review-pr in WordPress/wordcamp.org) into .claude/skills/review-pr in your project. Claude Code loads it when a task matches its description.

How do I install Review PR in Codex?

Run `npx skills add WordPress/wordcamp.org --skill review-pr -a codex`. Or copy the skill folder (.claude/skills/review-pr in WordPress/wordcamp.org) into .agents/skills/review-pr in your project. Codex loads it when a task matches its description.

Can I use Review PR in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add WordPress/wordcamp.org --skill review-pr -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/review-pr, .gemini/skills/review-pr, .github/skills/review-pr and .opencode/skills/review-pr in your project.

What does Review PR need to run?

Going by SKILL.md and its folder, Review PR needs the command-line tools its instructions call (docker, npm, curl, php and git) and credentials named MARIADB_ROOT_PASSWORD.

Does Review PR access the network?

SKILL.md contains no URLs. Its commands use docker, npm, curl and git, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Review PR safe to install?

Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. Review the folder before installing.

What licence does Review PR use?

No licence was found for Review PR or its repository. Without one, default copyright applies: ask the author before reusing or redistributing it.

How many tokens does Review PR use?

About 3.9k tokens (SKILL.md is roughly 16k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Review PR?

Skills that share tags, products or a category with Review PR: Finishing a Development Branch (obra/superpowers, 296k stars), PR Babysitter (openinterpreter/openinterpreter, 69k stars), Check PR (onyx-dot-app/onyx, 32k stars) and Understand Diff Analysis (Egonex-AI/Understand-Anything, 85k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Review PR?

WordPress (a GitHub organization) maintains it in WordPress/wordcamp.org, which has 160 GitHub stars. The repository holds 2 skills in this directory. The repository was last updated on October 6, 2026.

Source: WordPress/wordcamp.org on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.