PR Review Agent

The problem

Manual code reviews are inconsistent, slow, and prone to missing critical security or data issues during off-hours. Developers often waste time pointing out trivial style nits while accidentally overlooking high-risk database migrations or auth flaws.

What it does

• Analyzes pull request diffs against an eight-tier checklist covering correctness, security, data, and concurrency.
• Consolidates all findings into a single review comment categorized by severity: blocker, warning, or nit.
• Automatically applies size and risk labels based on line counts and sensitive file paths.
• Triggers mandatory human escalation for changes touching authentication, billing, or database migrations.
• Prevents notification fatigue by debouncing rapid pushes and performing incremental reviews on new commits.

Frameworks & tools

Built for OpenClaw. Interfaces with GitHub/GitLab webhook events and requires tools for PR comments, labeling, and reviewer requests.

Why this beats prompting it yourself

A standard LLM prompt lacks the statefulness to handle incremental reviews or the strict permission fencing required for repository security. This skill includes built-in logic for SHA deduplication, event debouncing, and hard boundaries that prevent the agent from ever merging code or exceeding its token scope.

Use cases

• Enforcing consistent security and performance checks across all repository contributors.
• Automatically labeling PRs by risk level to help leads prioritize their review queue.
• Ensuring database migrations follow production safety standards before reaching a human.
• Providing immediate feedback to developers on weekends or across different time zones.

Known limitations

Requires an explicit repository allowlist to operate. The agent cannot merge, approve, or push code, and will only review files exposed by the repository tool.