A guide for reviewing pull requests, which are proposed code changes awaiting approval. It uses evidence from checks and ranks findings by severity, with suggested fixes.

Use it to inspect code changes, verify behavior, report issues by priority, suggest concrete fixes, and record risk acceptance.

It helps reviewers judge the actual change instead of trusting claims that it works. A consistent format makes important problems and accepted risks visible.

pr-review — Skill for Claude Code by VandanaAjayDubey111/great-pm

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add VandanaAjayDubey111/great-pm --skill pr-review

Clone the repo

git clone --depth 1 https://github.com/VandanaAjayDubey111/great-pm

Made for: Claude Code.

Or install great-pm, the plugin that ships this one along with the rest of its 114 skills, 34 commands, 48 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/vandanaajaydubey111/great-pm/pr-review/github.svg)](https://agentmods.dev/skills/vandanaajaydubey111/great-pm/pr-review)

Your own site

<a href="https://agentmods.dev/skills/vandanaajaydubey111/great-pm/pr-review"><img src="https://agentmods.dev/badge/skills/vandanaajaydubey111/great-pm/pr-review/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/vandanaajaydubey111/great-pm/pr-review"><img src="https://agentmods.dev/badge/skills/vandanaajaydubey111/great-pm/pr-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 40 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,143 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00040	$0.01143
Opus 5.5	$0.00016	$0.00457
Sonnet 5.5	$0.00008	$0.00229
Haiku 4.5	$0.00004	$0.00114

Measured 16d ago against content hash f08f3eb23496, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

pr-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/great-pm/skills/pr-review/SKILL.md · 89 lines

How it starts

The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Codex host binding

Treat references to Claude slash workflows as the equivalently named Codex skill.
Before delegating to any specialist, read the great-pm-runtime skill and the selected packaged role file.
Treat "invoke", "assign", "delegate", "spawn", and source Agent-tool instructions as a required Codex spawn_agent call with that role and a bounded assignment.
For the spawn tool's task_name or agent_name identifier, replace canonical role-name hyphens with underscores (query-refiner-pm → query_refiner_pm). Keep canonical names unchanged in prompts, filenames, verdict logs, and user-facing output; this is an internal identifier mapping, not a role rename.
Store every returned agent identifier. Never call a wait tool until a spawn has returned an identifier, and wait only on identifiers returned by successful spawns.
If spawn_agent is unavailable or a spawn fails, report BLOCKED; do not impersonate the specialist or wait on an empty agent set.
Resolve bundled paths from the installed GreatPM plugin root.
Ignore Claude-only model aliases, colors, turn limits, and tool allowlists.
Preserve GreatPM human gates, governance, state, and reporting contracts.

PR Review — playbook

A review is not an opinion; it is a verification with a verdict. The author owed you an evidence-backed PR (per pr-authoring); you owe back a review that says what you checked, what you found, and exactly what it takes to get to APPROVE.

1. Review output format (in order)

Verdict — one of:
- APPROVE — mergeable as-is.
- APPROVE-WITH-NITS — mergeable; nits listed, author's call.
- REQUEST-CHANGES — not mergeable; the exact path to APPROVE is listed. A REQUEST-CHANGES without that path is a stall, not a review.
- BLOCKED — a question outside this PR must be answered first (file it as a ticket / open decision; link it).
What I verified — table: Claim in PR | How I checked | Result. Re-run at least the highest-risk verification the author claims, and spot-check at least two checklist boxes. Trust is not a review method.
Findings — table: Severity | Location | Issue | Concrete fix. Severity levels:
- Blocker — merging causes harm (bug, security, data, broken contract). Ship-stoppers only.
- Major — wrong but not dangerous; fix before or immediately after merge, reviewer states which.
- Minor — should fix; does not gate merge.
- Nit — style/preference; author may ignore.
Questions — genuine questions are not findings; keep them separate so they don't inflate the change request.
Risk acceptance — if approving despite a known risk, say so on the record: "approving with X risk accepted because Y". Silent risk acceptance is how incidents lose their audit trail.
Post-merge watch — what to monitor after deploy, for how long, and the rollback trigger ("error rate > N% in first hour → revert per the PR's Rollback section").

Read the full file on GitHub · 89 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

16d ago First seen · 89 lines · 40 tokens per session scan A f08f3eb23496

Subscribe to this mod's changes

pr-review is a skill published in the GitHub repository VandanaAjayDubey111/great-pm (3 stars, last pushed 17d ago), licensed MIT. It adds 40 tokens to every session and 1,143 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.

Code review Commits Git and workflow LLM Multi-Agent agentic ai-agents claude-code-plugin

signing-preflight

Before the first commit of a session, check that commit signing will work — the key is loaded and unlocked — and ask the operator to unlock it once, up front, instead of discovering it after a hundred unsigned commits. Never disables signing silently, never re-signs history without asking. Use at the start of…

avelikiy/great_cto · 105 tokens

guardian

Gatekeeping Git/PR by classifying change essence and recommending granularity, naming, and strategy. Use when PR preparation or commit strategy is needed.

simota/agent-skills · 32 tokens

batch-member-cites-a-path-only-a-non-member-adds

You wrote something correct that the default reader cannot reach: a batch member citing a path only a NON-member adds, or a rule, ruling or ledger sitting on an unlanded branch.

wan-huiyan/agent-traffic-control · 53 tokens

working-tree-edits-stranded-on-squash-merge

Diagnose and prevent "I made the fix but it's not on main" cases where the fix was applied in the working tree via Edit / Write but never git added before the squash-merge. Use when: (1) you squash-merged a PR and the user reports the issue is back, (2) git status after the merge shows uncommitted changes for files…

wan-huiyan/agent-traffic-control · 236 tokens

github-pr-workflow

GitHub PR lifecycle: branch, commit, open, CI, merge.

StarryCod/cogitum · 20 tokens

lean-review

CocoLean diff-scoped over-engineering audit — scans uncommitted git diff and applies five classification tags (delete/stdlib/native/yagni/shrink) to identify unnecessary surface area before commit.

Snowflake-Labs/cocoplus · 44 tokens