PR Risk Reviewer

PRs move fast, and critical regressions often hide in the noise of large diffs. This skill audits code changes specifically for stability, security, and operational risk rather than just syntax or style. It identifies high-impact changes like database migrations, API contract breaks, and auth logic shifts that standard linters miss.

What it does

• Risk Scoring provides a structured verdict based on ten dimensions of operational risk.
• Automated Triage flags sensitive files including lockfiles, infrastructure config, and payment logic.
• Evidence-Based Auditing maps every medium to high risk finding to specific file paths and line numbers.
• Test Planning generates concrete verification steps including specific inputs, user roles, and expected results.
• Rollback Strategy defines how to revert the change if the deployment fails in production.

How it works

1. Input Diff: The user provides a git diff, patch file, or a GitHub PR URL to be fetched.
2. Signal Gathering: The skill runs an internal analysis script to calculate diff stats and flag risky patterns.
3. Deep Analysis: Targeted files are reviewed against specific security and Python-stack rubrics.
4. Report Generation: A structured risk report is produced, highlighting top concerns and a final merge verdict.

Frameworks & tools

Built for teams using Git, GitHub, and Python backends (Django, FastAPI, SQLAlchemy, Alembic). It utilizes custom scripts for diff parsing and scoring rubrics for consistent assessment.

Why this beats prompting it yourself

Generic prompts often miss silent logic changes or focus too much on code style. This skill enforces evidence-based reporting and applies a rigorous rubric to ensure findings are objective and actionable for the person merging the code.

Use cases

• Auditing complex database migrations for potential locking or data loss.
• Reviewing sensitive auth or security changes before they hit production.
• Assessing the blast radius of dependency bumps in large Python projects.
• Providing a final sanity check for high-stakes releases.

Known limitations

The skill reviews code diffs, not the full running system, so it cannot detect environment-specific runtime issues. Performance is best on PRs under 2,000 lines.