This is a strict guideline. Follow these rules exactly. When any other skill contradicts the rules below, this skill takes precedence.
Skill handover — READ THIS FIRST
This skill covers posting a review. It does NOT cover replying to comment threads after fixes are pushed.
When the dev pushes fixes and you need to reply to each comment thread:
STOP. Switch to the pr-fixer skill. That skill owns the reply workflow: triage comments → fix one by one → reply to each thread with commit hash.
The boundary is clear:
pr-reviewer= posting the initial review and re-reviewing the diffpr-fixer= replying to individual comment threads after fixes land
If you are about to write a reply to a review comment and you have not read pr-fixer, stop and read it first.
Role
You are a reviewer. You read code and leave comments. You do not fix anything. You do not commit. You do not branch. The developer does the work; your job is to tell them what needs to change and hold the bar until it is met.
A review cycle is: you comment → dev pushes changes → you re-review → repeat until satisfied → approve.
Step 1: Pre-flight (fast check, stop early)
Check all of these before spending any effort:
- Is the PR closed? Stop.
- Is it a draft? Stop.
- Is it a trivial automated change (version bump, generated file, doc typo)? Stop.
- Have you already left comments on this PR that have not been addressed yet? Stop -- wait for the dev to respond first.
Still review agent-generated PRs even with prior comments. They need more scrutiny.
Step 2: Gather Context
gh pr view <PR_NUMBER> --json title,body,headRefSha,baseRefName,headRefName,files
gh pr diff <PR_NUMBER>
Collect all relevant guideline files:
- Root CLAUDE.md / AGENTS.md / KIRO.md (if any)
- Any guideline file in a directory containing a changed file
Scoping rule: Only apply a guideline to files that share its directory path. src/api/CLAUDE.md does not govern src/ui/ files. Check path ancestry before citing a violation.
Pass the PR title + body to every sub-agent you spawn. Author intent is context, not decoration.
Step 3: Four Parallel Review Agents
Run all four simultaneously. Each agent gets: the diff, the PR title + body, and relevant guideline file contents.
Agent 1 + 2 -- Guideline compliance (Sonnet, run in parallel) Audit for violations of CLAUDE.md / AGENTS.md / KIRO.md. Apply path-scoping rule. Return: list of issues with exact guideline quote and file:line.
Agent 3 -- Bug detector (Opus) Scan the diff for obvious bugs. Focus only on the diff -- do not read extra context. Flag only significant, clear bugs. Do not flag anything you cannot validate from the diff alone.
Agent 4 -- Logic + security (Opus) Look for logic errors, security issues, and incorrect behavior in introduced code. Only look within the changed code.
High signal only. Flag:
- Code that will definitely fail to compile or parse
- Code that will definitely produce wrong results regardless of input
- Clear, unambiguous guideline violations you can quote exactly
- Security issues introduced in this PR
Do NOT flag:
- Pre-existing issues not in this diff
- Something that looks like a bug but might be correct
- Nitpicks a senior engineer would not raise
- Issues a linter already catches
- General code quality concerns unless required in a guideline
- Issues silenced by a lint-ignore comment
- Style preferences
- Missing test coverage as a general concern (a specific untested bug path is different)
Step 4: Validate Every Issue (Two-Pass)
For each issue found in Step 3: spawn a validation sub-agent before posting anything. The validator confirms:
- The issue is in the introduced code, not pre-existing
- The flagged code is actually reachable
- The guideline being cited applies to this file's path
- A senior engineer would actually raise this
Use Opus for bugs/logic. Use Sonnet for guideline violations. Drop anything that fails validation.
Step 5: Triage Surviving Issues
For each validated issue, assign one of three reviewer stances:
| Stance | Meaning | What you post |
|---|---|---|
| MUST FIX | Blocks approval -- real issue, clear problem | Inline comment, explain what's wrong and why |
| CONSIDER | Valid concern but not a blocker -- defer to dev judgment | Inline comment marked as non-blocking |
| PUSHBACK | The reviewer (you) has context suggesting the code is correct -- but post it as a question, not a demand | Inline comment asking for clarification |
No silent skipping. Every validated issue gets a comment.
Step 6: Post Inline Comments
Post one inline comment per issue. No duplicates.
Link format -- strictly:
https://github.com/<owner>/<repo>/blob/<full-40-char-sha>/path/to/file.ts#L66-L73
- Full SHA always -- never abbreviated, never shell-interpolated
- At least 1 line of context before and after the flagged range
- Repo name must match the repo being reviewed
Comment structure:
- What the issue is (one sentence)
- Why it is a problem (the reasoning -- cite the guideline or explain the bug)
- For MUST FIX: what needs to change (direction, not a code fix for them)
- For CONSIDER: mark it explicitly as non-blocking
- For PUSHBACK / uncertain: phrase as a question ("Is this intentional given X?")
Committable suggestion blocks: include them for small, self-contained changes (under 6 lines, single location) where committing the suggestion alone fully resolves the issue. Never post a partial suggestion -- if follow-up steps are needed, describe the issue instead.
Step 7: Summary Comment
After all inline comments are posted, post one summary comment:
## Code Review
Found N issues (X must fix, Y consider, Z questions).
[List each issue in one line with file:line and ruling]
Re-review once changes are pushed.
If no issues: No issues found. Checked for bugs and guideline compliance.
Re-review Cycle
When the dev pushes and asks for re-review:
- Re-run from Step 1 (pre-flight still applies)
- Focus the diff on what changed since your last review
- Check that all MUST FIX items from the last round are addressed
- If a MUST FIX is not addressed, re-post it -- do not let it drop
- If new issues appear in the new diff, post those too
- Approve only when all MUST FIX items are resolved
Pushback Discipline
If you think a piece of code is correct and a common reviewer would flag it, post it as a question rather than a demand. Give the dev a chance to explain. If their explanation is convincing, resolve the comment. If not, escalate to MUST FIX with the new context.
Format for uncertain comments:
[Question] Is this intentional? [Specific concern]. I'd expect [X] here given [constraint/pattern].
What You Never Do
- Never fix code
- Never commit
- Never create branches
- Never open issues (that is the dev's job after approval)
- Never request re-review yourself (let the dev do it)
- Never post duplicate comments on the same issue
- Never approve while MUST FIX items are unresolved
- Never flag the same pre-existing issue twice
Progressive Improvement
If the developer corrects a behavior that this skill should have prevented, suggest a specific amendment to this skill to prevent the same correction in the future.