📦
SkillBuild & connect

GitHub Code Review

Review GitHub pull requests — fetch diffs, analyze code quality, check for secrets/debug statements, and submit reviews with inline comments. Use when asked to review a PR, check code changes, or do a code review on a GitHub repository.

by NeboAIv1.0.0

About this skill

What It Does

GitHub Code Review gives your AI agent the ability to perform thorough, structured code reviews on any GitHub pull request — just like a senior engineer would. It fetches the full diff, checks out the branch locally for complete file context, runs an 8-point analysis checklist, and submits the review directly to GitHub with inline comments on specific lines.

Analysis Checklist

Every review covers:

  • Correctness — Does the change match the PR description? Logic errors?
  • Secrets & credentials — Scans for leaked API keys, tokens, passwords, private keys
  • Debug statements — Catches leftover console.log, print(), debugger, TODO/FIXME/HACK
  • Error handling — Missing try/catch, unchecked returns, unhandled edge cases
  • Security — SQL injection, XSS, path traversal, unsafe deserialization
  • Performance — N+1 queries, unnecessary allocations, missing indexes
  • Tests — Are changed files covered by updated tests?
  • Style — Consistent with existing codebase conventions

Review Actions

Based on findings, it will:

  • Approve clean PRs with a summary
  • Request changes when issues are found, with line-specific inline comments
  • Comment for observations that don't block merge

How It Works

The skill uses the gh CLI (GitHub's official command-line tool) to interact with GitHub's API. It:

  1. Fetches PR metadata and the full diff via gh pr view and gh pr diff
  2. Clones the repo and checks out the PR branch locally for full file context (not just the diff)
  3. Runs grep-based scans for secrets and debug statements across changed files
  4. Reads full files to understand context around each change
  5. Submits the review via gh pr review with inline comments via the REST API

Reviews are structured with severity levels (critical / warning / suggestion) and include file paths and line numbers for every finding.

Setup Requirements

Prerequisites

  • gh CLI installed — The skill auto-downloads the standalone binary from GitHub releases if not present (no sudo required)
  • GitHub authentication — On first use, the agent will run gh auth login --web and present you with a one-time device code to authorize in your browser. This is a one-time setup.

Permissions

The gh CLI needs these GitHub scopes (granted during the browser auth flow):

  • repo — Read/write access to repositories, PRs, and issues
  • read:org — Required for organization-owned repos

Usage

Just ask naturally:

  • "Review PR #42 on my-org/my-repo"
  • "Check this pull request for security issues"
  • "Do a code review on the latest PR"
  • "Review the changes in owner/repo#15"

The agent handles everything else — cloning, analysis, and submitting the review back to GitHub.