pr-review-expert
PassAudited by ClawScan on May 1, 2026.
Overview
The skill is a coherent PR/MR review helper, with expected but noticeable use of GitHub/GitLab access, local diff files, and test commands.
This appears safe for its stated PR review purpose. Before using it, make sure GitHub/GitLab access is limited to the repositories you intend to review, run tests in an isolated environment for untrusted PRs, and clean up temporary diff files when finished.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used in a private repository, the agent may read PR or MR information available to the logged-in GitHub/GitLab account.
The workflow uses GitHub/GitLab CLI commands to read PR/MR metadata and diffs, which may rely on the user's existing provider login for private repositories.
gh pr view <PR_NUMBER> --json title,body,labels,assignees,milestone
Use an account or token with only the repository access needed for review, and review commands before running them.
For untrusted contributions, running tests locally could execute code supplied by the PR author.
The skill recommends running local test/coverage commands, which can execute project code from the branch under review.
npm test -- --coverage --changedSince=main 2>/dev/null | tail -20 pytest --cov --cov-report=term-missing 2>/dev/null | tail -20
Run these commands only in a trusted checkout or isolated development environment, especially for external or unfamiliar PRs.
Private source changes or secret-like values present in a diff could remain in a local temporary file after review.
The workflow stores retrieved PR diff content in a temporary local file, which may include private code or accidentally committed secrets.
gh pr diff $PR > /tmp/pr-$PR.diff
Delete temporary diff files after use and avoid sharing review output that includes secret values.