← Back to Skills Marketplace
pr-reviewer
by
Brian Colinger
· GitHub ↗
· v1.0.1
8133
Downloads
0
Stars
0
Active Installs
2
Versions
Install in OpenClaw
/install pr-reviewer
Description
Automated GitHub PR code review with diff analysis, lint integration, and structured reports. Use when reviewing pull requests, checking for security issues,...
Usage Guidance
Review this skill carefully before installing or running it on untrusted pull requests. Use a low-privilege GitHub account or token, avoid running it in an environment with unrelated secrets, and do not enable cron or automated review until the filename-to-Python injection issue is fixed by passing PR file data through stdin, argv, or JSON rather than embedding it in source code.
Capability Analysis
Type: OpenClaw Skill
Name: pr-reviewer
Version: 1.0.1
The OpenClaw skill `pr-reviewer` is designed for automated GitHub PR code review, utilizing `gh` CLI and Python. It is classified as suspicious due to critical vulnerabilities rather than malicious intent. Specifically, the `scripts/pr-review.sh` script allows arbitrary file writes if the `PR_REVIEW_STATE` or `PR_REVIEW_OUTDIR` environment variables are set to sensitive paths (e.g., `/etc/passwd`), as there is no path sanitization or restriction. Additionally, there is a potential for shell injection in the `run_local_lint` function, where filenames obtained from GitHub PRs are directly expanded into `ruff` and `golangci-lint` commands, which could lead to arbitrary command execution if a malicious actor crafts a PR with specially named files containing shell metacharacters. No evidence of intentional data exfiltration, persistence, or obfuscation was found.
Capability Assessment
Credentials
Using gh, python3, and optional linters is proportionate for PR review, but the script processes attacker-controlled GitHub PR metadata with local interpreter privileges and an authenticated gh environment.
Install Mechanism
No installer, remote payload retrieval, dependency installation, or tool wrapping was found; metadata only declares required binaries, though it does not define a tighter tool or write scope.
Instruction Scope
The skill discloses GitHub authentication, local state/report files, and a post command, but remote commenting and cron-style use would benefit from stronger confirmation guidance; the documented quick-start path also differs from the packaged script path.
Persistence & Privilege
Local state and markdown reports are expected and disclosed, and there is no system-level persistence; however, the post command uses the user's authenticated gh session to publish the generated report to GitHub, and the unsafe filename handling could expose that same environment to attacker-controlled code.
Purpose & Capability
Automated PR review, GitHub reads, local report generation, linting, and optional PR commenting are coherent with the stated purpose, but untrusted PR filenames are interpolated into a python3 -c program during test-coverage checks, creating local code-execution risk while reviewing a PR.
How to Use
- Make sure OpenClaw is installed (local or Docker)
- Run the install command in chat:
/install pr-reviewer - After installation, invoke the skill by name or use
/pr-reviewer - Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.1
Fix security scan flags: declare runtime dependencies, document env vars and write paths
v1.0.0
Initial release — automated GitHub PR code review with diff analysis for Go, Python, and JS/TS. Security scanning, error handling checks, test coverage gaps, local lint integration, and structured markdown reports.
Metadata
Frequently Asked Questions
What is pr-reviewer?
Automated GitHub PR code review with diff analysis, lint integration, and structured reports. Use when reviewing pull requests, checking for security issues,... It is an AI Agent Skill for Claude Code / OpenClaw, with 8133 downloads so far.
How do I install pr-reviewer?
Run "/install pr-reviewer" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.
Is pr-reviewer free?
Yes, pr-reviewer is completely free (open-source). You can download, install and use it at no cost.
Which platforms does pr-reviewer support?
pr-reviewer is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).
Who created pr-reviewer?
It is built and maintained by Brian Colinger (@briancolinger); the current version is v1.0.1.
More Skills