pr-review-merge
Autonomous, safety-first pull request review-and-merge pass over a repository with many open PRs, on any tech stack (Node, PHP, Go, Python, Rust, Ruby, Java/Kotlin, Android, monorepos). Reviews each PR's full diff, classifies it CLEAN / FIXABLE / BLOCKED, fixes small issues, merges safe PRs one at a time, verifies the default branch still builds and passes tests, and produces a final report. Use this skill whenever the user mentions a backlog of pull requests, asks to review and merge PRs, clear the PR queue, "merge what's safe", check that nothing breaks after merging, or hands PR handling to an agent while they are away, even if they don't say "skill" or name a specific stack. Supports "review only" / "dry run" mode.
78
98%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow reads and processes external pull requests, including PR titles, descriptions, comments, and diffs, which are authored by untrusted outsiders.
- Commit
1b92900
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.