PR Review Crew

    1

    A staff-level PR reviewer that audits diffs for security, performance, and logic errors with evidence-backed reports.

    $12

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    PR Review Crew

    Example session with this skill installed

    Review the staged changes in this repo and check for any critical security risks or performance bottlenecks.

    • Read your context and instructions
    • Compiled the pr review crew
    • Generated the document

    I have completed a Staff Engineer review of the staged changes across the security and performance lenses. Stack pack detected: Next.js/React.

    PR Review Report

    Verdict: REQUEST CHANGES
    One HIGH severity security issue and one MEDIUM performance bottleneck identified.

    Scope Drift

    Intent:    Staged changes in local repository
Delivered: Auth middleware updates and new dashboard component
IN SCOPE:  ✅ Auth hardening
DRIFT:     ⚠️ Added 'DashboardStats' component (Not mentioned in staged intent)

    Critical & Specialist Findings

    SeverityCategoryFindingEvidenceConfidence
    HIGHSecurityMissing CSRF protection on new POST endpointapp/api/profile/route.ts:149/10
    MEDIUMPerformanceUnnecessary re-renders; unstable object literal in dependency arraycomponents/Dashboard.tsx:428/10
    LOWMaintainabilityTODO comment without owner or ticket referencelib/utils/auth.ts:8910/10

    Adversarial Pass

    How to break this: The profile/route.ts endpoint accepts JSON without validating content-type headers, potentially allowing cross-site request forgery if the session cookie is not SameSite=Strict. (Status: FIXABLE)

    Next steps

    1. Apply the missing CSRF token validation to the profile API route.
    2. Memoize the chartOptions object in Dashboard.tsx to prevent unnecessary sub-component updates.
    3. Run npm audit to verify the three new dependencies added to package.json.

    Dashboard.tsx

    PDF · document

    Generated

    Example file from a real run - the skill writes it into your workspace.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Reviewing pull requests is often a choice between a shallow skim that misses bugs or a deep dive that stalls the sprint. This skill acts as a Staff Engineer in your terminal, performing a multi-lens audit of git diffs to catch production-breaking defects before they merge.

    What it does

    • Multi-lens auditing performs focused passes for security (OWASP), performance (N+1 queries), testing coverage, and maintainability.
    • Stack-specific analysis loads specialized rule packs for Next.js, Python, and Go to detect framework-level anti-patterns.
    • Automated safety checks identifies critical risks like SQL injection, race conditions, IDOR, and unvalidated LLM output boundaries.
    • Intent verification compares the diff against PR descriptions or tickets to detect scope drift or missing requirements.
    • Evidence-based reporting assigns a confidence score to every finding and links it to specific file:line locations using grep and rg.

    How it works

    1. Targeting identifies the review scope by checking a PR ID, staged changes, or a branch diff against the merge base.
    2. Detection identifies the repository stack and loads the corresponding rule pack and local audit tools.
    3. Execution runs the critical safety pass followed by five specialist lenses and an adversarial pass to try and break the implementation.
    4. Reporting generates a structured report with findings categorized by severity and confidence.

    Frameworks & tools

    Works with any git-based workflow. Leverages gh CLI, rg, and stack-specific auditors like npm audit, pip-audit, and govulncheck. Includes specialized rules for Next.js, React, Python, and Go.

    Why this beats prompting it yourself

    Generic prompts often produce style nits and vague "best practice" advice. This skill uses a systematic staff-level rubric, executes real CLI tools to verify dependencies, and demands file:line evidence for every claim, ensuring findings are technical rather than subjective.

    Use cases

    • Catching SQL injections and race conditions in a complex backend PR.
    • Auditing new dependencies for known CVEs before they enter the lockfile.
    • Ensuring a frontend refactor doesn't introduce N+1 component re-renders.
    • Verifying that all acceptance criteria from a spec are actually implemented in the diff.

    Known limitations

    Requires a git environment. Automated dependency auditing requires the respective package managers and audit tools to be installed in the environment.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scanned

    Verified clean 9 days ago

    • Passed all security checks, Safe to install

    Requires

    Metrics
    Node.js
    Python

    Listed9 days ago

    What's inside

    Frequently Asked Questions