Review and Fix PR banner
trailofbits trailofbits

Review and Fix PR

Git community intermediate

Description

@description Review an existing PR with parallel agents, fix findings, and push. @arguments $PR_NUMBER: GitHub PR number to review and fix Read PR #$PR_NUMBER thoroughly using `gh pr view`. Understand

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

Repository README

This is the README for trailofbits/claude-code-config, shared by 3 entries in this directory. It describes the repository, not this entry specifically.

Review and Fix PR

@description Review an existing PR with parallel agents, fix findings, and push. @arguments $PR_NUMBER: GitHub PR number to review and fix

Read PR #$PR_NUMBER thoroughly using `gh pr view`. Understand the full context: description, linked issues, commit history, and the diff against the base branch.

Detect the upstream repository: if a git remote named `upstream` exists, use it as the canonical repo. Otherwise, fall back to `origin`. Resolve the canonical repo's `owner/name` (e.g. from `git remote get-url upstream`) and store it — use `--repo ` on every `gh` command to ensure they target the correct repository. Run `git fetch ` to ensure you are working with up-to-date code.

Check out the PR branch locally.

Execute every step below sequentially. Do not stop or ask for confirmation at any step.

1. Review

Run two review passes in parallel, then merge findings.

Pass A — pr-review-toolkit agents

Launch these Task tool agents **in parallel** (single message, multiple tool calls), each with `subagent_type` from the pr-review-toolkit plugin. Tell each agent which files changed (from `git diff --name-only ...HEAD`):

agent focus
pr-review-toolkit:code-reviewer Code quality, style, project guidelines
pr-review-toolkit:silent-failure-hunter Silent failures, swallowed errors, bad fallbacks
pr-review-toolkit:pr-test-analyzer Test coverage gaps and missing edge cases

Pass B — external second opinion

Launch these Task tool agents **in parallel with Pass A** — all 5 agents in a single message, multiple tool calls. Each uses `subagent_type: general-purpose`.

**Codex reviewer** — tell the agent to run:

codex review --base / \
  -c model='"gpt-5.3-codex"' \
  -c model_reasoning_effort='"xhigh"'
  • --base does not accept custom prompts (codex reads AGENTS.md at the repo root if one exists)
  • If gpt-5.3-codex fails with an auth error, retry with gpt-5.2-codex
  • Set timeout: 600000 on the Bash call
  • Tell the agent to summarize findings only — skip [thinking]/[exec] blocks and sandbox warnings
  • If codex is not installed, report and skip

**Gemini reviewer** — tell the agent to run:

git diff /...HEAD > /tmp/pr-review-diff.txt

# Build prompt file (avoids heredoc shell expansion issues)
{
  echo "Review this diff for code quality, bugs, and improvements."
  if [ -f CLAUDE.md ] || [ -f .claude/CLAUDE.md ]; then
    echo ""
    echo "Project conventions:"
    echo "---"
    cat CLAUDE.md .claude/CLAUDE.md 2>/dev/null
    echo "---"
  fi
  echo ""
  echo "Diff:"
  cat /tmp/pr-review-diff.txt
} > /tmp/pr-review-prompt.txt

# Pipe prompt via stdin to avoid shell metacharacter issues
cat /tmp/pr-review-prompt.txt | gemini -p - \
  -m gemini-3-pro-preview \
  --yolo
  • Uses stdin (-p -) instead of heredoc to avoid shell expansion issues with