review-pr

62 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a coding skill usually runs build and test commands.

By yonatangross/orchestkit (GitHub) · coding · 301 stars · scanned at commit 0d38e66

PR review by parallel agents (quality, security, tests, architecture, performance) with conventional comments and an approve or request-changes verdict. Use when a pull request needs a reviewer. Not for design scores (use assess).

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed. Expected for a coding skill.

Found in 177 places.

plugins/ork/skills/review-pr/SKILL.md, line 38review-pr 123
plugins/ork/skills/review-pr/SKILL.md, line 53bash ${CLAUDE_SKILL_DIR}/scripts/resolve-target.sh <the arguments without the four flags> # prints one JSON object: TARGET
plugins/ork/skills/review-pr/SKILL.md, line 166gh pr view $PR_NUMBER --json title,body,files,additions,deletions,commits,author

Show 17 more

plugins/ork/skills/review-pr/SKILL.md, line 178gh pr diff <PR_NUMBER> --name-only # CHANGED_FILES, for agent scope injection
plugins/ork/skills/review-pr/SKILL.md, line 296gh pr checks <PR_NUMBER> --required
plugins/ork/skills/review-pr/SKILL.md, line 359node ${CLAUDE_SKILL_DIR}/scripts/post-review.mjs --pr 4668 --event comment --body-file /tmp/review-4668.md --post
plugins/ork/skills/review-pr/SKILL.md, line 364The skill's `skill/review-post-gate` hook enforces this in code. While the skill runs, Bash is an ALLOWLIST (#4678): a call passes only as simple read-only comm
plugins/ork/skills/review-pr/SKILL.md, line 371python3 ${CLAUDE_SKILL_DIR}/scripts/verdict_writeback.py "$CLAUDE_JOB_DIR"
plugins/ork/skills/review-pr/SKILL.md, line 399claude --from-pr 123
plugins/ork/skills/review-pr/scripts/collect-rules.mjs, line 47import { execFileSync } from 'node:child_process';
plugins/ork/skills/review-pr/scripts/collect-rules.mjs, line 142const git = (...a) => execFileSync('git', ['-C', REPO, ...a], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
plugins/ork/skills/review-pr/scripts/collect-rules.mjs, line 173reviewed = execFileSync('gh', ['repo', 'view', '--json', 'nameWithOwner', '--jq', '.nameWithOwner'], { cwd: REPO, encoding: 'utf8', stdio: ['ignore', 'pipe', 'i
plugins/ork/skills/review-pr/scripts/collect-rules.mjs, line 182realDefault = execFileSync('gh', ['api', `repos/${slug}`, '--jq', '.default_branch'], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 30000 })
plugins/ork/skills/review-pr/scripts/collect-rules.mjs, line 189meta = JSON.parse(execFileSync('gh', ['api', `repos/${slug}/contents/${STANDARDS_FILE}?ref=${encodeURIComponent(def)}`], { encoding: 'utf8', stdio: ['ignore', '
plugins/ork/skills/review-pr/scripts/collect-rules.mjs, line 239text = execFileSync('git', ['-C', REPO, 'show', `${sha}:${STANDARDS_FILE}`], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });
plugins/ork/skills/review-pr/scripts/post-review.mjs, line 26import { execFileSync } from 'node:child_process';
plugins/ork/skills/review-pr/scripts/post-review.mjs, line 208execFileSync('gh', args, { input: body, stdio: ['pipe', 'inherit', 'inherit'] });
plugins/ork/hooks/README.md, line 1466(count unchanged at 171, 2026-09-22, sc47 F23/F24): `lifecycle/session-cleanup` gains a 14-day age cap on per-session event dirs. `bin/run-hook.mjs` appends one
plugins/ork/hooks/README.md, line 1478(count unchanged at 172, 2026-09-04, #3917 FH-ready handler policy): no hook changed; a gate did. Claude Code is designing Function Hooks (anthropics/claude-cod
plugins/ork/hooks/README.md, line 1526(count unchanged at 171, 2026-08-24, second entry): `instructions-loaded/debt-surfacer` became a reader instead of a scanner (#3708, sibling of #3705). It ran `

and 157 more places

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.

Found in 7 places.

plugins/ork/settings.json, line 11"Read(~/.aws/credentials)",
plugins/ork/settings.json, line 12"Read(~/.ssh/**)",
plugins/ork/settings.json, line 13"Read(~/.gnupg/**)",

Show 4 more

plugins/ork/settings.json, line 14"Read(~/.netrc)",
plugins/ork/settings.json, line 15"Read(~/.npmrc)",
plugins/ork/hooks/README.md, line 1562(218 -> 219, global 152 -> 153, 2026-08-09): added `pretool/read/credential-read-guard`, the first PreToolUse hook on the Read tool that can deny. `src/settings
plugins/ork/hooks/dist/lifecycle.mjs, line 22`)}catch{}Oo(t,e)}}import{existsSync as ip,readFileSync as cp}from"node:fs";function xn(){let t=U();if(!ip(t))return 0;try{let n=JSON.parse(cp(t,"utf-8")).tools

Downloads and installs other software

The author does not mention this. It runs automatically when the plugin is installed.

Found in 7 places.

plugins/ork/hooks/README.md, line 165- `pretool/bash/network-egress-guard` - Deny commands that execute fetched remote content (`curl url | sh`)
plugins/ork/hooks/README.md, line 1586(count unchanged, 2026-07-24): pretool/bash network-egress-guard DENY tier is now QUOTE-AWARE (#3122). It scanned `normalizeSingle(raw)`, which strips quote cha
plugins/ork/hooks/README.md, line 1588(count unchanged, 2026-07-24): pretool/bash compound-command-validator deny for a process substitution feeding an interpreter (`bash <(curl x)`, `python3 <(curl

Show 4 more

plugins/ork/hooks/dist/permission.mjs, line 13`)}catch{}}function ht(t,e,n,r){let o=dt(t,e);if(b(o))try{let s=$t(o,"utf8");if(j(s)===j(n))return l(r,`Rules file ${e} unchanged, skipping write`),!1}catch{}re
plugins/ork/hooks/dist/pretool.mjs, line 20${s}`)}function Sr(t){let e=t.replace(/\\\s*[\r\n]+/g," ");if(/\n/.test(e))return!0;let n=Ot(t);if(/(?:&&|\|\||[|;])/.test(n))return!0;let r=_r(yr(t)),o=Xe(br(r
plugins/ork/hooks/dist/pretool.mjs, line 117`);return e.log(kt,`Consolidated ${n.length} hooks into ${r}t`),x(o,t)}var nd="headless-defer",rd=["Bash(git push --force*)","Bash(git push -f*)","Bash(npm publ
plugins/ork/hooks/dist/setup.mjs, line 22Run 'npm audit' or 'pip-audit' for full details.`;if(vt(r,S),e.log("dependency-version-check",g),u>0||f>0)return m(S,t)}else vt(r,"none"),e.log("dependency-vers

Changes files outside its own folder

This is disclosed by the author in the skill's SKILL.md or README. It runs automatically when the plugin is installed.

Found in 1 place.

plugins/ork/hooks/README.md, line 7523. Persist it: echo 'export ORCHESTKIT_HOOK_TOKEN=...' >> ~/.zshrc

Sends data to these websites: example.com

The author does not mention this. It runs automatically when the plugin is installed.

Found in 22 places.

plugins/ork/hooks/README.md, line 1510(count unchanged at 175, 2026-08-30, #3322 sandbox posture): `pretool/bash/network-egress-guard` stands its ASK tier down when CC's own Bash sandbox is on with
plugins/ork/hooks/README.md, line 1530(count unchanged at 171, 2026-08-22): `pretool/bash/network-egress-guard` false-positive fix (#3632). A quoted heredoc (`<<'SH' … SH`) writing a local script wa
plugins/ork/hooks/README.md, line 1548(count unchanged, 2026-08-12): the compaction layer stopped reading fields nobody writes, and stopped writing a field CC reads as something else (#3321 claims 2

Show 17 more

plugins/ork/hooks/bin/telemetry-sync.mjs, line 88const response = await fetch(url, {
plugins/ork/hooks/dist/lifecycle.mjs, line 21`))}function So(t,e){if(!t)return!1;let n=le(e);return n?t.toLowerCase()===n.toLowerCase():!1}function Pl(){let t=null,e=process.env.ORK_HQ_TELEMETRY_URL;return
plugins/ork/hooks/dist/lifecycle.mjs, line 22`)}catch{}Oo(t,e)}}import{existsSync as ip,readFileSync as cp}from"node:fs";function xn(){let t=U();if(!ip(t))return 0;try{let n=JSON.parse(cp(t,"utf-8")).tools
plugins/ork/hooks/dist/lifecycle.mjs, line 62`,r=Ms();Og(r,n,"utf8").catch(()=>{g(Yn,"Failed to write telemetry event (non-blocking)")})}async function xe(){let t=Ms();try{let e=await Ls(t);if(e.size<=Ag)r
plugins/ork/hooks/dist/posttool.mjs, line 46`))}function xo(e,t){if(!e)return!1;let n=ot(t);return n?e.toLowerCase()===n.toLowerCase():!1}function Ml(){let e=null,t=process.env.ORK_HQ_TELEMETRY_URL;return
plugins/ork/hooks/dist/posttool.mjs, line 101`)}catch{}}function ms(e,t){let n=process.env[e];if(!n)return t;let r=parseFloat(n);return!Number.isFinite(r)||r<=0||r>=1?t:r}function Dm(){let e=Bn(),t=process
plugins/ork/hooks/dist/posttool.mjs, line 104`,r=ws();rh(r,n,"utf8").catch(()=>{S(qn,"Failed to write telemetry event (non-blocking)")})}async function Yn(){let e=ws();try{let t=await Ts(e);if(t.size<=uh)r
plugins/ork/hooks/dist/posttool.mjs, line 112`);break}return p()}function na(e,t){if(e===void 0||e===""||e==="*")return!0;if(/^[\w|-]+$/.test(e))return e.split("|").includes(t);try{return new RegExp(e).tes
plugins/ork/hooks/dist/pretool.mjs, line 68`).filter(Boolean),i=Su(),s=Qr(o,e).length;if(e&&s>=i)return`Context7 session limit reached (${i} queries this session). Rely on already-fetched documentation o
plugins/ork/hooks/dist/pretool.mjs, line 70`,{flag:"a"})}catch{}}var no=200,Xt=1e3,Vt=20,Cu=new Set(["person","project","technology","concept","tool","pattern","decision","preference","workflow","organiz
plugins/ork/hooks/dist/pretool.mjs, line 74`))}function po(t,e){if(!t)return!1;let n=ne(e);return n?t.toLowerCase()===n.toLowerCase():!1}function ol(){let t=null,e=process.env.ORK_HQ_TELEMETRY_URL;return
plugins/ork/hooks/dist/pretool.mjs, line 145`,r=ki();pf(r,n,"utf8").catch(()=>{m(In,"Failed to write telemetry event (non-blocking)")})}async function On(){let t=ki();try{let e=await mi(t);if(e.size<=kf)r
plugins/ork/hooks/dist/prompt.mjs, line 62`;return Hs(t,r,"utf8"),!0}catch{return!1}}var qs="ORK_SESSION_IDENTITY_RATE_MAX",Xs="ORK_SESSION_IDENTITY_RATE_WINDOW_MS",Ys=5,ur=10*6e4;function Zs(){return p
plugins/ork/hooks/dist/prompt.mjs, line 69`))}function ze(t,e,n){let r=0,o=(s,a,u)=>s.replace(a,()=>(r+=1,u)),i=Ve(typeof t=="string"?t:"");for(let s of bu)i=o(i,s,"[SECRET]");return i=o(i,xu,"[EMAIL]")
plugins/ork/hooks/dist/setup.mjs, line 13`)}catch{}}function St(t,e,n,r){let o=kt(t,e);if(T(o))try{let i=Gt(o,"utf8");if(F(i)===F(n))return l(r,`Rules file ${e} unchanged, skipping write`),!1}catch{}re
plugins/ork/hooks/dist/skill.mjs, line 55`)}catch{}return k()}import{existsSync as gs}from"node:fs";function cn(t,n=v){let e=typeof t.tool_input.file_path=="string"?t.tool_input.file_path:"",r=t.tool_i
plugins/ork/hooks/dist/stop.mjs, line 49`,"utf8"),Wo(n,t),!0}catch{return!1}}function He(t,e,n,r,o=new Date().toISOString()){return{...t??{repo:n,session_id:r,started_at:o,last_heartbeat:o,status:"run

and 2 more places

Safer alternatives

Low-risk skills in the same category (coding) that look related. Check that one does what you need.

Other copies in this repository

yonatangross/orchestkit has 1 more folder with a skill named review-pr. This page shows the lowest-scoring copy.

src/skills/review-pr 97/100 · Low risk

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'review-pr' ] || [ -L ~/.agents/skills/'review-pr' ]; then echo 'A skill folder named review-pr already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/yonatangross/orchestkit' "$d" && git -C "$d" checkout --quiet '0d38e66123f2a4a70737bfae758df796070f07df' -- 'plugins/ork/skills/review-pr' && mkdir -p ~/.agents/skills && cp -R "$d"/'plugins/ork/skills/review-pr' ~/.agents/skills/'review-pr' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'review-pr' ~/.claude/skills/'review-pr' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for yonatangross/orchestkit shows the score of its lowest-scoring skill.

SkillTrust badge for yonatangross/orchestkit

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/yonatangross/orchestkit.svg)](https://zalavijaysinh.github.io/skilltrust/repos/yonatangross/orchestkit/)

Score history

Date	Version	Score
2026-11-10	`0d38e66`	62
2026-11-07	`caa5346`	90