More screenshots

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseOpenClawOpenClaw+21 more

    PR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict

    1

    Reviews a PR for security issues and answers: is this safe to merge? Gives ranked findings, fixes, and a BLOCK / FIX-FIRST / MERGE-SAFE decision.

    $15

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    PR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict

    PR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict

    Example session with this skill installed

    PR title: "Hotfix: Meridian support console — user lookup + profile HTML export"
    Stack: Node.js / Express
    Request: "Security gate this PR before we merge — is it safe?"

    // api/support/users.js (new)

    const API_KEY = "sk_live_EXAMPLE_NOT_REAL_0000deadbeefcafe"; // TODO move later

app.get("/api/support/users/:id", async (req, res) => {
  const q = "SELECT * FROM users WHERE id = " + req.params.id;
  const user = await db.query(q);
  if (!user) return res.status(404).json({ error: "not found" });
  res.json({ user, token: API_KEY });
});

app.get("/api/support/users/:id/export", async (req, res) => {
  const row = await db.query(
    "SELECT * FROM profiles WHERE owner_id = " + req.params.id
  );
  res.send(`<div>${row.bio}</div>`);
});
    • Read your context and instructions
    • Compiled the pr review security

    PR Security Gate Review

    Merge verdict: BLOCK
    Merge Risk Score: 9 / 100
    Counts: 1 Critical · 2 High · 1 Medium · 1 Low · 0 Info

    Findings
    INJ-01 CRITICAL Confirmed — SQLi string concat (users.js:4, also :14)
    SEC-01 HIGH Confirmed — hardcoded live-style API key (users.js:1) [masked]
    EXP-01 HIGH Confirmed — API key returned in JSON (users.js:9)
    AUTH-01 MEDIUM Needs-context — no role check on export / IDOR risk
    XSS-01 LOW Suspected — unescaped bio in HTML (users.js:16)

    Priority fixes: INJ-01 → SEC-01 → EXP-01
    JSON: verdict "BLOCK", merge_risk_score 9, full findings array
    Disclaimer: static review aid — not a pen test

    Score check: 100 − 40×1 − 20×2 − 8×1 − 3×1 = 9 ✓ · CRITICAL present → BLOCK ✓

    Connects securely to your tools. The creator never sees your data.

    What you get

    Pre-merge security gate on a risky PR (auth, SQL, secrets, SSRF)Tech lead wants severity-ranked findings with file:line evidence before approveDeveloper self-check before opening a PRCI/human review handoff via machine-readable Review JSONIncident follow-up: re-review the change that introduced a class of bugs

    About this skill

    The problem

    • Asking an agent to “review this PR” often returns style nits and vague opinions — not a clear answer on whether it is safe to merge.
    • Real security problems hide in diffs: unsafe SQL, missing access checks, secrets in code, unsafe URLs/files, weak crypto, and risky config.
    • Teams need a consistent pre-merge security check with proof, severity, and what still matters after a fix — not “looks fine.”

    What it does

    • Reviews a pull request or code diff for common security weaknesses (injection, XSS, auth/IDOR, secrets, SSRF, path issues, deserialization, crypto misuse, data exposure, races, risky config, and validation gaps).
    • Lists findings by severity, with file and line evidence, how each issue could be abused, a recommended fix, and residual risk after the fix.
    • Marks how sure each finding is: Confirmed, Suspected, or Needs-context — so uncertain issues are not treated as proven bugs.
    • Gives a Merge Risk Score and a hard merge decision: BLOCK, FIX-FIRST, or MERGE-SAFE.
    • Adds a short attacker-view summary and a machine-readable Review JSON you can paste into tickets or CI notes.

    Frameworks & tools

    • Works across languages and stacks, with patterns tuned for common web backends and frontends (for example Node/Express, Python, ORMs, React XSS sinks, shell commands, YAML/pickle, CORS).
    • Accepts a unified diff, the changed files, or base/head context your agent can already read.
    • No extra SaaS scanner required — a SKILL.md workflow for Claude Code, Cursor, Codex CLI, OpenClaw, and similar agents.

    Why this beats prompting it yourself

    • Clear merge rules (critical issues block; high issues mean fix first) instead of soft “maybe” prose.
    • A fixed risk score formula so results are consistent from PR to PR.
    • Built-in false-positive traps (for example parameterized queries or framework escaping) to cut noise.
    • Secrets are reported by location only — values are masked, never printed in full.
    • Stable finding IDs and full JSON so humans (or your pipeline) can act on the same report structure every time.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 1 month ago

    • Passed all security checks, Safe to install

    Listed1 month ago

    What's inside

    Frequently Asked Questions