stack-review

80 / 100 · Low risk

Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By apache/magpie (GitHub) · security · 146 stars · scanned at commit 8d24b52

Review a GitHub stacked pull request as one unit on `<upstream>`: resolve the stack from any member PR or its stack number, check that the chain is linear and current, map every file to the layers that touch it, trace definitions removed in one layer and still used in another, and read code by tier with a coverage table instead of line by line. Drafts one rolling `COMMENT` on the lowest open layer and names the layers that deserve a `pr-management-code-review` pass. Never approves.

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

The author does not mention this. Expected for a security skill.

Found in 5 places.

plugins/magpie-pr-management/skills/stack-review/SKILL.md, line 54PYTHONPATH="$(python3 -I -c 'import hashlib,os,sys;h,d,m,i=sys.argv[1:];r=os.path.realpath(os.curdir);s=os.stat(r);p=os.path.join(h,d,hashlib.sha256(r.encode())
plugins/magpie-pr-management/skills/stack-review/SKILL.md, line 177uv run --project <framework>/tools/pr-management pr-management stack-review resolve --saved-dir <workspace>/saved --viewer <viewer> (--pr <N> | --stack <S>) --c
plugins/magpie-pr-management/skills/stack-review/SKILL.md, line 190uv run --project <framework>/tools/pr-management python -m pr_management.stack_review.stack_chain --repo <clone> chain --prefix magpie-stack/<S> --size <size>

Show 2 more

plugins/magpie-pr-management/skills/stack-review/SKILL.md, line 204uv run --project <framework>/tools/pr-management pr-management stack-review findings --chain chain.json --seams seams.json --floors floors.json --ledger ledger.
plugins/magpie-pr-management/skills/stack-review/SKILL.md, line 236uv run --project <framework>/tools/pr-management pr-management stack-review post --saved-dir <workspace>/saved --viewer <viewer> --resolved <scratch>/resolved.j

Downloads and installs other software

The author does not mention this.

Found in 2 places.

AGENTS.md, line 458uv tool install prek # or: pipx install prek
AGENTS.md, line 522`uvx --from ~/.claude/magpie/vetted-ops …`, and `uvx --from ~/.claude/magpie/adversarial-review adversarial-review …`.

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'stack-review' ] || [ -L ~/.agents/skills/'stack-review' ]; then echo 'A skill folder named stack-review already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/apache/magpie' "$d" && git -C "$d" checkout --quiet '8d24b52457f7a2731d7cc3329af96430a16715fd' -- 'plugins/magpie-pr-management/skills/stack-review' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/magpie-pr-management/skills/stack-review' ~/.agents/skills/'stack-review' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'stack-review' ~/.claude/skills/'stack-review' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for apache/magpie shows the score of its lowest-scoring skill.

SkillTrust badge for apache/magpie

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/apache/magpie.svg)](https://zalavijaysinh.github.io/skilltrust/repos/apache/magpie/)

Score history

Date	Version	Score
2026-11-13	`8d24b52`	80
2026-11-09	`3fd660b`	80
2026-11-07	`c099f3f`	80