implement-suggestion
Implements review-comment suggestions across one or more PRs. Multi-PR mode (default when $ARGUMENTS holds PR URLs; empty $ARGUMENTS auto-detects the active PR) resolves a worktree per PR, fetches every actionable comment from human teammates AND AI review bots (claude[bot], coderabbitai[bot], …), validates each through /critical + /confidence, builds a structured suggestion-pack, and dispatches a worker subagent that applies each approved change as its own commit, pushes to the existing branch, and resolves the addressed thread — so every handled comment ends resolved and the PR is left clean. Free-text mode applies a single pasted suggestion in place. --watch re-applies on one PR until the reviewers go quiet (max 5 iterations); --resolve-all also replies to and resolves every non-fix thread it can honestly close. Triggers on "implement suggestion", "apply review comments", "/implement-suggestion".
66
83%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
Low
Low-risk findings worth noting
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow fetches and processes outsider-authored comments and reviews from GitHub PRs via API endpoints (`gh api repos/.../pulls/.../comments`, `issues/.../comments`, and `reviews`), which ingest untrusted free text into the agent's processing pipeline.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The referenced `gw-tools` GitHub repository (https://github.com/mthines/gw-tools) is an unofficial, third-party personal utility repository used to provide operational CLI tooling (`gw`) during setup and worktree creation, placing it in the medium-tier boundary.
- Repository
- mthines/agent-skills
- Commit
39b3f44
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.