A workflow for reviewing one other person's GitHub pull request by examining its proposed code changes and project rules. It can leave comments and submit an approval or request for changes.

Reviewing a single pull request, commenting on specific problems, and submitting an APPROVE, COMMENT, or REQUEST_CHANGES review.

It gives a structured review focused on bugs, security problems, regressions, type-safety issues, rule violations, and missing tests.

review-pr — Skill for Claude Code by HsuanYuLee/polaris

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add HsuanYuLee/polaris --skill review-pr

Clone the repo

git clone --depth 1 https://github.com/HsuanYuLee/polaris

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/hsuanyulee/polaris/review-pr/github.svg)](https://agentmods.dev/skills/hsuanyulee/polaris/review-pr)

Your own site

<a href="https://agentmods.dev/skills/hsuanyulee/polaris/review-pr"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/review-pr/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/hsuanyulee/polaris/review-pr"><img src="https://agentmods.dev/badge/skills/hsuanyulee/polaris/review-pr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 322 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,256 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00322	$0.02256
Opus 5.5	$0.00129	$0.00902
Sonnet 5.5	$0.00064	$0.00451
Haiku 4.5	$0.00032	$0.00226

Measured 1mo ago against content hash 151030ff0495, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

review-pr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

The scan reads SKILL.md. This mod also ships 12 executable files (scripts/fetch-pr-info.sh, scripts/lib/github-rest.sh, scripts/lib/main-checkout.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/review-pr/SKILL.md · 142 lines

How it starts

The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.

review-pr

以 reviewer 角色審查別人的單一 PR，依 repo rules / handbook / diff context 留 inline comments，並送出 GitHub review。

Contract

此 skill 只處理單一 PR review。多 PR discovery 與 batch orchestration 交給 review-inbox；修自己的 PR review comments 就直接修（那不需要重簽成功的定義）。

Reviewer stance：prioritize bugs、behavior regressions、security、type safety、project rule violations、missing tests。不要用 personal style preference 擋 merge。 reviewer-side 屬 read-only lane，但對 changes_requested、active unresolved comments、 awaiting_re_review、mergeable_ready 的語義必須與 author-side mutable lane 一致；不得自行重寫。本 skill 可輸出 reviewer 結論（預設是 APPROVE 或 COMMENT；REQUEST_CHANGES 只在使用者明說要擋那一顆的時候，見 references/review-pr-submit-flow.md〈Review Action〉），但不得把 reviewer 結論寫成 author-side stage authority；「可 merge / 可 release / 已完成」仍必須沿用 shared PR / workflow state，而不是 reviewer prose。

這支 skill 有沒有被叫對：`evals/evals.json`

上面那條界線（什麼走這支、什麼走 review-inbox / request-pr-review）不是只寫在散文裡，它有一份具名的案例集：evals/evals.json，13 句真的會被打出來的話，7 句該觸發、6 句不該。每一條帶著它為什麼在那裡（notes）。

它是給人讀的，不是給腳本跑的——這裡沒有 runner，也刻意不要有一支。它的用途是：改 frontmatter 的 description 之前先讀那 13 句，問「改完之後這 13 句的答案還一樣嗎」。負向那 6 句尤其重要，因為觸發詞放寬的代價從來不出現在正向案例上。

什麼時候要更新它：這支 skill 被叫錯、或該叫沒叫到的那一刻——把那句原話補成第 14 條，標好它該不該觸發。一句在真實對話裡走錯的話，比十句想像出來的案例有用。同一趟摩擦也記進你手上那張單可以改的那部分（SKILL-UTILITY，見 driving-work-to-done），兩者不重複：那裡記「這一趟它幫到還是擋到」，這裡記「這句話該路由到哪」。

Reference Loading

Situation	Load
Any run	`review-pr-entry-fetch-flow.md`, `pr-input-resolver.md`, `workspace-config.yaml`
Analysis	`review-pr-analysis-flow.md`, `library-change-protocol.md` as needed
Writing findings up	`review-comment-form.md`
Submit and notify	`review-pr-submit-flow.md`, `scripts/validate-language-policy.sh`, `external-write-gate.md`, `github-slack-user-mapping.md`
Re-review	`review-pr-rereview-learning-flow.md`, `review-lesson-extraction.md`

Large PR 分批 review 可派 sub-agent。 Completion Envelope。Sub-agent 只做 analysis，不送出 review、不改檔。

Flow

從使用者輸入或 Slack context 解析 PR URL；找不到單一 PR 時停止或轉 review-inbox。
依 pr-input-resolver.md 解析 owner、repo、number、本地 project path；找不到本地 repo 時使用 remote read mode。
用 scripts/fetch-pr-info.sh <owner/repo> <pr_number> [--my-user <username>] 取得 metadata、 files、review strategy、existing reviews、approval state、re-review signal。它只放行 open 且非 draft 的 PR——已合併、已關閉、還在 draft 的一律拒絕並說出是哪一種狀態。打 --help 問得到用法。
讀 repo rules、workspace handbook、PR description、changed files、diff、既有 review comments，建立去重清單。
Review changed files；large PR 依 reference 分組派 sub-agent fan-out。
合併 findings，依 severity 決定 APPROVE 或 COMMENT——分級照舊，而 must-fix 送的是 COMMENT，不擋對方的分支。要擋要有使用者的原話，見 references/review-pr-submit-flow.md〈Review Action〉。
Review body、inline comments、Slack notification 送出前跑 language gate。
Submit GitHub review，查詢 approve status，輸出摘要。
若有 validated repo-specific pattern，依 standard-first rule 更新 handbook。
Slack source 時回覆原始 thread。

Read the full file on GitHub · 142 lines

Files

What ships with it

23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago Changed · +5 lines · +26 tokens per session 151030ff0495
1mo ago Changed · +11 lines f978b753777b
1mo ago Changed · +1 lines c5b212ebda02
2mo ago First seen · 125 lines · 296 tokens per session scan A 8a03ce200a09

Subscribe to this mod's changes

review-pr is a skill published in the GitHub repository HsuanYuLee/polaris (5 stars, last pushed today), licensed MIT. It adds 322 tokens to every session and 2,256 once invoked, about $0.0013 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Code review Git and workflow ai-workflows claude-skills developer-tools jira-automation

understand-diff

Use when you need to analyze git diffs or pull requests to understand what changed, affected components, and risks.

Egonex-AI/Understand-Anything · 27 tokens

address-github-comments

Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI.

sickn33/agentic-awesome-skills · 27 tokens

github-pr-comments

Resolve inline code review comments on a GitHub PR. Use when asked to "resolve review comments", "address PR feedback", "fix PR comments", or "work through review comments". Fetches every inline comment with its surrounding code context, then applies each change systematically.

tailcallhq/forgecode · 58 tokens

skills-pr-handle

Use when explicitly asked to handle a pull request in the Scenario skills repository, including review comments and skill validation.

scenario-labs/skills · 27 tokens

pr-handle-comments

Handle review comments received on GitHub for the current branch's PR or a given PR number or URL, by triaging each unresolved thread, fixing what is warranted, pushing, and replying in each thread, when asked to address, fix or answer PR comments. Works in any Scenario repository.

scenario-labs/skills · 63 tokens

pre-publish-review

Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…

code-yeongyu/oh-my-openagent · 161 tokens

review-pr

Getting it into your agent

Wrote this? Show the measurements

What it costs to keep this loaded

Grade A, and why

Nothing flagged

How it starts

review-pr

Contract

這支 skill 有沒有被叫對：evals/evals.json

Reference Loading

Flow

What ships with it

What this file has done since we first saw it

Other skills, from other repositories

understand-diff

address-github-comments

github-pr-comments

skills-pr-handle

pr-handle-comments

pre-publish-review

這支 skill 有沒有被叫對：`evals/evals.json`