The Agent Skills Directory

Command Execution via GitHub CLI: The skill utilizes the gh command-line tool to fetch pull request data and post comments. This interaction is central to the skill's functionality and is implemented using standard subprocess calls that follow the user's explicit instructions regarding repository and PR scope.
Static Analysis of Source Content: To identify potential defects, the skill reads the source code of the pull request and uses the ast module for analysis. This approach is a secure alternative to dynamic execution or eval calls, as it allows the agent to process the code structure and logic without actually running it.
Input and Output Sanitization: The skill includes robust mechanisms to escape content before rendering reports or posting comments. For example, the build_report.py script specifically prevents spreadsheet formula injection in CSV exports and ensures Markdown and HTML characters are correctly handled in the final review report.
Verification and Integrity Checks: The verify_findings.py script performs an automated validation to ensure all identified issues are actually present in the source files and are correctly anchored to valid lines within the pull request's diff hunks, significantly reducing the risk of hallucinated or misplaced findings.
Human-in-the-Loop Requirement: The skill's design includes a "hard stop" that requires explicit user review and approval before any comments are posted to GitHub. This keeps the user in control of the agent's external actions and ensures that all posted reviews are manually vetted.

github-pr-review