pr-review

target = $ARGUMENTS

Resolve the target

• Empty → PR/MR of the current branch.
• Number → that PR/MR on the current remote (use gh for GitHub, glab for GitLab).
• Branch name or local path → diff against its merge base.

Read PR description, linked issues, commit messages, and CI status before the diff — diff-only review misses drift from stated intent, and a failing pipeline is load-bearing context.

Stance

Frame feedback as questions and impact; author decides the fix. Explain consequences, not rule citations.

Dimensions

Correctness is table stakes — the diff shows bugs directly. These dimensions catch what the diff hides:

Security — Trace user-controlled data from source to sink: SQL concatenation, input reaching command execution or file paths, hardcoded secrets, missing authorization on new endpoints, removed or weakened validation. Source-to-sink flow without sanitization is CRITICAL regardless of perceived exploitability.