TASK GUIDE · SOURCE-AWARE

Best Agent Skills for pull request review

A risk-first Skill stack for diff review, targeted scanning, and review evidence.

Build this plan for my Agent ↗
Desired outcome

Find the highest-impact change risks without drowning the reviewer in generic comments.

Safe working boundary

Review only the proposed diff and directly affected paths; scanning is not certification.

01 · SKILL STACK

A minimal three-role stack

Each role has one job. The personalized builder can adjust the selection for your Agent without changing the decision logic.

01 · Core execution

differential-review

Prioritizes blast radius and security-sensitive changes in the diff.

Main limitation
Not intended for greenfield code or broad initial vulnerability discovery.
First risk
False assurance from incomplete context
Source evidence
Pinned · 9b281335
Inspect the Skill ↗
02 · Guardrail

codeql

Adds a targeted static check with explicit limits.

Main limitation
Requires CodeQL, jq, uv, a buildable target, and potentially long database construction.
First risk
Build and scan side effects
Source evidence
Pinned · 9b281335
Inspect the Skill ↗
03 · Evidence

build-evidence-map

Links review claims to visible or repository evidence.

Main limitation
Validation proves graph integrity, not source quality or inference correctness.
First risk
Sensitive excerpts in portable artifacts
Source evidence
Pinned · 318066d2
Inspect the Skill ↗

02 · ACCEPTANCE

How to know the task is finished

  1. Map each important finding to a changed line or affected path.
  2. Separate blocking defects from optional improvements.
  3. Verify the highest-risk path with a targeted test or scan.

03 · STOP CONDITIONS

When to stop

  • The review expands into unrelated repository cleanup.
  • A scanner result is presented as proof of safety.
  • The reviewer cannot explain the impact of a blocking comment.

04 · METHOD

How this guide was produced

SkillSignal maps a defined task to three non-overlapping responsibilities, then selects from reviewed catalog metadata. Agent fit, source state, permissions, and published scores are evaluated with deterministic rules. No LLM writes or reorders the recommendation at request time.