Identify the current branch, base branch, and available remote information:

git status --short
git branch --show-current
git branch --format='%(refname:short)'
git remote -v

Determine the comparison range. Prefer the user-provided PR/base branch. If absent, infer from local branch names or ask one concise question if multiple bases are plausible.

Inspect commit and diff shape:

git log --oneline --decorate <base>..HEAD
git diff --stat <base>...HEAD
git diff --name-only <base>...HEAD
git diff <base>...HEAD

Read important changed files and nearby unchanged context.
Check tests, migrations, generated files, configuration, and public API changes.

Check review status and existing PR feedback when GitHub CLI context is available:

gh pr view --comments --json title,body,reviews,comments,checks,baseRefName,headRefName

Run a security-focused pass over the diff:
- Obfuscated code, dynamic evaluation, encoded strings, hidden network calls, or data exfiltration.
- Suspicious dependency additions, typosquatting risk, or unexpected lockfile changes.
- Hardcoded secrets, tokens, API keys, credentials, or sensitive logging.
- Command injection, SQL injection, unsafe deserialization, XSS, or path traversal.
- Weakened authentication, permissions, validation, or authorization checks.
- Suspicious file system, process, shell, or environment variable access.
Summarize the PR's intent, implementation approach, affected areas, likely risks, and merge blockers.

Output

Return:

Guardrails