Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    PR Pre-Flight — Production Risk & Security Review

    1

    Conservative production-readiness auditor that identifies breaking changes, security risks, and dependency issues in PRs.

    $9.99

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    PR Pre-Flight — Production Risk & Security Review

    PR Pre-Flight — Production Risk & Security Review

    Example session with this skill installed

    Review this diff for production readiness. It updates the user profile API and adds a new dependency. Check for breaking changes and security risks. Give a clear merge decision.

    • Read your context and instructions
    • Compiled the pr pre-flight

    PR Pre-Flight Report

    1. Decision Snapshot

    • Decision: CONDITIONAL — Resolve or Explicitly Accept
    • Overall risk: Moderate
    • Scope reviewed: src/api/user.ts, package.json, migrations/20231027_add_bio.sql
    • Top reason: Breaking change in public API response without versioning.
    • Validation limits: CI logs and integration test results not provided.

    2. Findings

    [P1] Breaking API Change: Modified Response Shape

    • ID: PPF-001
    • Category: Breaking Change
    • Location: src/api/user.ts line 42
    • Confidence: High

    Evidence: The UserProfile interface removed the fullName field and replaced it with firstName and lastName.

    Risk path: Frontend consumers or external API integrations expecting fullName will encounter undefined values, potentially crashing UI components.

    • Potential impact: High - Breaks existing API consumers.
    • Conditions / assumptions: Assumes there are active consumers relying on the previous schema.
    • Required action: Implement a getter for fullName or maintain the field as deprecated.
    • Validation: Run frontend smoke tests against the new API branch.

    [P2] Missing Input Sanitization

    • ID: PPF-002
    • Category: Security
    • Location: src/api/user.ts line 58
    • Confidence: Medium
    • Evidence: The new bio field is saved directly to the database using db.execute() with a template literal.

    Risk path: If the template literal is not properly parameterized by the underlying driver, it could allow SQL injection.

    • Potential impact: Moderate - Data leak or unauthorized modification.
    • Required action: Use parameterized queries or a validated ORM method.
    • Validation: Security review of the db utility implementation.

    3. Change Compatibility Matrix

    AreaObserved changeRisk / uncertaintyRequired verification
    APISchema updateBreaking change for fullNameVerify consumer compatibility
    DatabaseNew bio columnTable lock during migrationCheck table size in production

    4. Dependency Review

    Visible changes in package.json:

    • Added lodash@4.17.21.
    • Verified: No critical CVEs reported for this version in common databases.
    • Recommendation: Ensure npm audit is run in CI.

    5. Test & CI Matrix

    CheckStatusEvidence or next action
    Unit TestsNot shownNo new tests found in diff for bio logic
    Migration TestNot shownVerify migration against a production clone

    6. Required Actions Before Merge

    1. P1: Restore fullName field to API response to maintain backward compatibility.
    2. P2: Refactor db.execute call to use proper parameterization for the bio field.
    3. P3: Add unit tests for the name splitting logic.

    7. Final Decision Rationale

    The PR introduces a breaking API change and a potential security risk in the database layer. While the dependency update is safe, the merge must be blocked until the API contract is honored and input sanitization is verified.

    Next steps

    • Address the breaking change by adding a deprecated fullName field.
    • Refactor the SQL query to use parameter binding.
    • Provide unit test coverage for the new profile fields.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Manually auditing pull requests for production risks is slow and error-prone. This skill acts as a conservative senior engineer and security reviewer to catch breaking changes, dependency vulnerabilities, and operational hazards before they hit main.

    What it does

    • Breaking change detection identifies backward-incompatible modifications to API schemas, function signatures, and database migrations.
    • Security risk assessment flags trust-boundary violations, unsafe input handling, and potential injection patterns based on code evidence.
    • Dependency auditing reviews manifest changes for supply-chain risks and version conflicts.
    • Test gap analysis evaluates whether changes include necessary regression, boundary, and migration tests.
    • Operational readiness review checks for logging gaps, resource leaks, and missing observability in new code paths.

    How it works

    1. Scope definition by analyzing the PR diff, description, and available manifests to establish what is changing.
    2. Evidence-based analysis where the skill maps findings directly to file paths and line numbers provided in the input.
    3. Risk prioritization using a P0 to P3 severity rubric to distinguish between blockers and minor observations.
    4. Report generation producing a structured decision (GO, NO-GO, or CONDITIONAL) with a required action list.

    Frameworks & tools

    This skill works with any language that produces unified diffs or patches, including JavaScript/TypeScript, Python, Go, and Ruby. It specifically analyzes package manifests like package.json, requirements.txt, or Gemfile.lock.

    Why this beats prompting it yourself

    Generic prompts often hallucinate vulnerabilities or miss subtle breaking changes in API contracts. This skill enforces strict evidence rules, ensuring every flagged risk cites specific line numbers and distinguishes between confirmed defects and unverified gaps.

    Use cases

    • Pre-merge audits for critical infrastructure changes where downtime is not an option.
    • Security screening for PRs involving authentication, authorization, or sensitive data handling.
    • Dependency updates to verify that library upgrades don't introduce known supply-chain risks.

    Known limitations

    It cannot verify runtime behavior or run actual build commands. Findings are strictly limited to the code and context provided in the prompt or attached files.

    Cannot execute code or tests. Risk detection is limited to the provided diff and context. Does not replace CI/CD or professional penetration testing.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 12 days ago

    Permissions

    Read Files
    Listed12 days ago

    What's inside

    Frequently Asked Questions

    This skill acts as a conservative senior reviewer, specifically flagging backward-incompatible API changes, dependency supply-chain risks, and security vulnerabilities with mandatory evidence-based line citations.

    The skill is language-agnostic and works with any codebase that generates unified diffs, including specialized support for JavaScript, Python, Go, and Ruby manifest files.

    No, the skill performs static analysis based on the code evidence provided; it does not execute code, run builds, or access external runtime environments.

    You receive the 'pr pre flight' skill logic, a P0-P3 risk prioritization rubric, and structured report templates designed to output clear GO/NO-GO decisions.

    Yes, it is designed to analyze manifest files like package.json or requirements.txt to identify version conflicts and potential supply-chain hazards before they are merged.

    Simply import the skill into your preferred AI agent environment and provide the PR diff and description as input to begin a production-readiness audit.

    New in Code Quality & Review