More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
DeepSeek
Muse+22 moreClaude CodeCursorCodex CLIDeepSeekMuse
Dots
Manus
Grok
Grok Bot+18 agentsPR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict
Reviews a PR for security issues and answers: is this safe to merge? Gives ranked findings, fixes, and a BLOCK / FIX-FIRST / MERGE-SAFE decision.
$15
PR Review Security Gate — Pre-Merge BLOCK / FIX-FIRST Verdict
Example session with this skill installed
PR title: "Hotfix: Meridian support console — user lookup + profile HTML export"
Stack: Node.js / Express
Request: "Security gate this PR before we merge — is it safe?"
// api/support/users.js (new)
const API_KEY = "sk_live_EXAMPLE_NOT_REAL_0000deadbeefcafe"; // TODO move later
app.get("/api/support/users/:id", async (req, res) => {
const q = "SELECT * FROM users WHERE id = " + req.params.id;
const user = await db.query(q);
if (!user) return res.status(404).json({ error: "not found" });
res.json({ user, token: API_KEY });
});
app.get("/api/support/users/:id/export", async (req, res) => {
const row = await db.query(
"SELECT * FROM profiles WHERE owner_id = " + req.params.id
);
res.send(`<div>${row.bio}</div>`);
});
- Read your context and instructions
- Compiled the pr review security
PR Security Gate Review
Merge verdict: BLOCK
Merge Risk Score: 9 / 100
Counts: 1 Critical · 2 High · 1 Medium · 1 Low · 0 Info
Findings
INJ-01 CRITICAL Confirmed — SQLi string concat (users.js:4, also :14)
SEC-01 HIGH Confirmed — hardcoded live-style API key (users.js:1) [masked]
EXP-01 HIGH Confirmed — API key returned in JSON (users.js:9)
AUTH-01 MEDIUM Needs-context — no role check on export / IDOR risk
XSS-01 LOW Suspected — unescaped bio in HTML (users.js:16)
Priority fixes: INJ-01 → SEC-01 → EXP-01
JSON: verdict "BLOCK", merge_risk_score 9, full findings array
Disclaimer: static review aid — not a pen test
Score check: 100 − 40×1 − 20×2 − 8×1 − 3×1 = 9 ✓ · CRITICAL present → BLOCK ✓
Connects securely to your tools. The creator never sees your data.
About this skill
The problem
- Asking an agent to “review this PR” often returns style nits and vague opinions — not a clear answer on whether it is safe to merge.
- Real security problems hide in diffs: unsafe SQL, missing access checks, secrets in code, unsafe URLs/files, weak crypto, and risky config.
- Teams need a consistent pre-merge security check with proof, severity, and what still matters after a fix — not “looks fine.”
What it does
- Reviews a pull request or code diff for common security weaknesses (injection, XSS, auth/IDOR, secrets, SSRF, path issues, deserialization, crypto misuse, data exposure, races, risky config, and validation gaps).
- Lists findings by severity, with file and line evidence, how each issue could be abused, a recommended fix, and residual risk after the fix.
- Marks how sure each finding is: Confirmed, Suspected, or Needs-context — so uncertain issues are not treated as proven bugs.
- Gives a Merge Risk Score and a hard merge decision: BLOCK, FIX-FIRST, or MERGE-SAFE.
- Adds a short attacker-view summary and a machine-readable Review JSON you can paste into tickets or CI notes.
Frameworks & tools
- Works across languages and stacks, with patterns tuned for common web backends and frontends (for example Node/Express, Python, ORMs, React XSS sinks, shell commands, YAML/pickle, CORS).
- Accepts a unified diff, the changed files, or base/head context your agent can already read.
- No extra SaaS scanner required — a SKILL.md workflow for Claude Code, Cursor, Codex CLI, OpenClaw, and similar agents.
Why this beats prompting it yourself
- Clear merge rules (critical issues block; high issues mean fix first) instead of soft “maybe” prose.
- A fixed risk score formula so results are consistent from PR to PR.
- Built-in false-positive traps (for example parameterized queries or framework escaping) to cut noise.
- Secrets are reported by location only — values are masked, never printed in full.
- Stable finding IDs and full JSON so humans (or your pipeline) can act on the same report structure every time.
Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.
• Static review only — not a pen test, red team, or compliance certification.
• Scope-limited: no runtime, infra, or out-of-diff code unless provided.
• “No findings” ≠ “secure.”
• Read-only: will not modify, merge, push, or deploy.
• Recommend professional review for high-risk systems.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before buying a skill.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 21 days ago
Permissions
Read-only. Reviews the PR/diff you provide. No shell, file changes, network, or secret access. Does not merge or push.