PR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict

Name: PR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict
Price: 15 USD
Availability: InStock
Author: Agensi

Reviews a PR for security issues and answers: is this safe to merge? Gives ranked findings, fixes, and a BLOCK / FIX-FIRST / MERGE-SAFE decision.

$15

30-day refund guarantee

Secure checkout via Stripe

0 installsSecurity scanned

See it in action

You say

PR title: "Hotfix: Meridian support console — user lookup + profile HTML export" Stack: Node.js / Express Request: "Security gate this PR before we merge — is it safe?" // api/support/users.js (new) const API_KEY = "sk_live_EXAMPLE_NOT_REAL_0000deadbeefcafe"; // TODO move later app.get("/api/support/users/:id", async (req, res) => { const q = "SELECT * FROM users WHERE id = " + req.params.id; const user = await db.query(q); if (!user) return res.status(404).json({ error: "not found" }); res.json({ user, token: API_KEY }); }); app.get("/api/support/users/:id/export", async (req, res) => { const row = await db.query( "SELECT * FROM profiles WHERE owner_id = " + req.params.id ); res.send(`${row.bio}`); });

Your agent does

# PR Security Gate Review Merge verdict: BLOCK Merge Risk Score: 9 / 100 Counts: 1 Critical · 2 High · 1 Medium · 1 Low · 0 Info Findings: INJ-01 CRITICAL Confirmed — SQLi string concat (users.js:4, also :14) SEC-01 HIGH Confirmed — hardcoded live-style API key (users.js:1) [masked] EXP-01 HIGH Confirmed — API key returned in JSON (users.js:9) AUTH-01 MEDIUM Needs-context — no role check on export / IDOR risk XSS-01 LOW Suspected — unescaped bio in HTML (users.js:16) Priority fixes: INJ-01 → SEC-01 → EXP-01 JSON: verdict "BLOCK", merge_risk_score 9, full findings array Disclaimer: static review aid — not a pen test Score check: 100 − 40×1 − 20×2 − 8×1 − 3×1 = 9 ✓ · CRITICAL present → BLOCK ✓

What you get

Pre-merge security gate on a risky PR (auth, SQL, secrets, SSRF)Tech lead wants severity-ranked findings with file:line evidence before approveDeveloper self-check before opening a PRCI/human review handoff via machine-readable Review JSONIncident follow-up: re-review the change that introduced a class of bugs

About this skill

The problem

Asking an agent to “review this PR” often returns style nits and vague opinions — not a clear answer on whether it is safe to merge.
Real security problems hide in diffs: unsafe SQL, missing access checks, secrets in code, unsafe URLs/files, weak crypto, and risky config.
Teams need a consistent pre-merge security check with proof, severity, and what still matters after a fix — not “looks fine.”

What it does

Reviews a pull request or code diff for common security weaknesses (injection, XSS, auth/IDOR, secrets, SSRF, path issues, deserialization, crypto misuse, data exposure, races, risky config, and validation gaps).
Lists findings by severity, with file and line evidence, how each issue could be abused, a recommended fix, and residual risk after the fix.
Marks how sure each finding is: Confirmed, Suspected, or Needs-context — so uncertain issues are not treated as proven bugs.
Gives a Merge Risk Score and a hard merge decision: BLOCK, FIX-FIRST, or MERGE-SAFE.
Adds a short attacker-view summary and a machine-readable Review JSON you can paste into tickets or CI notes.

Frameworks & tools

Works across languages and stacks, with patterns tuned for common web backends and frontends (for example Node/Express, Python, ORMs, React XSS sinks, shell commands, YAML/pickle, CORS).
Accepts a unified diff, the changed files, or base/head context your agent can already read.
No extra SaaS scanner required — a SKILL.md workflow for Claude Code, Cursor, Codex CLI, OpenClaw, and similar agents.

Why this beats prompting it yourself

Clear merge rules (critical issues block; high issues mean fix first) instead of soft “maybe” prose.
A fixed risk score formula so results are consistent from PR to PR.
Built-in false-positive traps (for example parameterized queries or framework escaping) to cut noise.
Secrets are reported by location only — values are masked, never printed in full.
Stable finding IDs and full JSON so humans (or your pipeline) can act on the same report structure every time.