📦

alan-review-pr

Name: alan-review-pr
Author: supatest-ai

v1.0.0 Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos

Review GitHub Pull Requests with Alan

Pull request reviews often miss context or produce vague feedback. This skill gathers GitHub evidence and posts focused, line-specific findings through Alan MCP tools.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "alan-review-pr" from https://skillstore.io/skills/supatest-ai-alan-review-pr.md and its manifest at https://skillstore.io/api/skills/supatest-ai-alan-review-pr/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/supatest-ai-alan-review-pr.md Manifest firmado GET /api/skills/supatest-ai-alan-review-pr/manifest Lockfile firmado GET /api/skills/supatest-ai-alan-review-pr/lockfile

Pruébalo

Usando "alan-review-pr". Review owner/payments#42 and focus on security regressions.

Resultado esperado:

Blocking: Missing authorization check in the updated refund handler. The review identifies the affected line, explains the unauthorized refund scenario, and proposes a focused repair.

Usando "alan-review-pr". Review the current repository pull request number 87.

Resultado esperado:

Important: Retry handling can submit the same operation twice after a timeout.
Nit: The new error branch lacks a meaningful assertion in its test.
Summary: Two findings, with CI status and links to each inline comment.

Auditoría de seguridad

Riesgo alto

v1 • 20/8/2026 Abrir el informe versionado

Most static findings are false positives caused by Markdown backticks or examples that explicitly prohibit credential access. Three Alan URLs are real low-risk network references, while session URL publication, untrusted PR content, and automatic review posting create meaningful semantic risks.

Archivos escaneados

226

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (3)

Alto

SKILL.md:202-207 SKILL.md:220-224

Session URL Published in GitHub Reviews

The skill requires the current Alan session URL in every inline comment and summary. Posting a private or access-bearing URL could disclose session access.

The publication requirement is explicit, but the source does not establish whether Alan session URLs are public or contain access credentials.

Alto

SKILL.md:57-69 SKILL.md:87-106

Untrusted Pull Request Content Lacks an Instruction Boundary

The workflow sends PR descriptions, diffs, reviews, and comments to an agent with write-capable GitHub tools without directing it to ignore embedded instructions.

The skill explicitly combines untrusted repository content with tools that can comment, merge, close, label, and request reviewers. No prompt-injection boundary is stated.

Medio

SKILL.md:112-113 SKILL.md:209-225

GitHub Review Is Posted Without Confirmation

The workflow always posts inline comments and can request changes based on model findings. It does not require user approval before mutating the pull request.

The posting requirement and event selection are explicit. The workflow contains no confirmation step before the write operation.

Elementos de revisión de capacidades (3)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Bajo

SKILL.md:155

Hardcoded URL

The skill embeds an image hosted by app.tryalan.ai in posted GitHub reviews. Rendering the review can cause an external request and disclose request metadata.

Bajo

SKILL.md:194

Hardcoded URL

The skill embeds an image hosted by app.tryalan.ai in posted GitHub reviews. Rendering the review can cause an external request and disclose request metadata.

Bajo

SKILL.md:207

Hardcoded URL

If no session URL is provided, fall back to `https://app.tryalan.ai`.

The skill instructs reviews to link to a fixed external Alan endpoint when no session URL exists. This creates an off-platform navigation and trust boundary.

Factores de riesgo

⚙️ Comandos externos (50)

🌐 Acceso a red (4)

SKILL.md:79 SKILL.md:155 SKILL.md:194 SKILL.md:207

📁 Acceso al sistema de archivos (2)

SKILL.md:21 SKILL.md:21

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/supatest-ai-alan-review-pr/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/supatest-ai-alan-review-pr/security.svg)](https://skillstore.io/skills/supatest-ai-alan-review-pr?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/supatest-ai-alan-review-pr?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supatest-ai-alan-review-pr/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/supatest-ai-alan-review-pr.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

supatest-ai. (2026). alan-review-pr security audit report (audit version 1) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/supatest-ai-alan-review-pr/audits/1

Cita BibTeX

@techreport{supatest-ai-supatest-ai-alan-review-pr-2026,
  author = {supatest-ai},
  title = {alan-review-pr security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/supatest-ai-alan-review-pr/audits/1},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "alan-review-pr security audit report (audit version 1)"
version: "1.0.0"
type: report
authors:
  - name: "supatest-ai"
date-released: "2026-08-20"
url: "https://skillstore.io/skills/supatest-ai-alan-review-pr/audits/1"
identifiers:
  - type: other
    value: "skillstore:supatest-ai-alan-review-pr:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

100

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Review a Maintainer Pull Request

Inspect a pending change and publish focused feedback before merge.

Screen Security-Sensitive Changes

Check authentication, input handling, and secret management changes for concrete vulnerabilities.

Standardize Team Review Quality

Apply consistent severity, confidence, and comment formats across pull requests.

Prueba estos prompts

Review a Pull Request

Review owner/repository#42. Analyze the changed code and prepare evidence-based inline findings.

Review From a GitHub URL

Review https://github.com/owner/repository/pull/42. Include CI status, existing discussion, and only issues introduced by this pull request.

Focus on Security and Correctness

Review owner/repository#42. Prioritize authentication, injection, validation, race conditions, and missing tests. Exclude style-only feedback.

Perform a High-Confidence Release Review

Review owner/repository#42 for release readiness. Correlate the diff, full files, prior comments, and CI results. Report only findings above 90 percent confidence.

Mejores prácticas

Provide a complete PR URL or repository reference to avoid remote resolution errors.
Review the proposed comments and session links before authorizing GitHub writes.
Use focused review priorities when the pull request affects sensitive or critical systems.

Evitar

Do not use the skill when Alan GitHub MCP tools are unavailable.
Do not treat generated findings as a substitute for tests or human approval.
Do not publish private session URLs or sensitive repository details in review comments.

Preguntas frecuentes

Which pull request formats are supported?

You can provide a PR number, a GitHub pull request URL, or an owner/repository#number reference.

Does this skill require GitHub credentials?

The Alan MCP server handles authentication. The skill instructs agents not to inspect local credentials or use GitHub CLI authentication.

Does the skill post comments automatically?

Yes. Its workflow calls the GitHub review tool after analysis, so users should preview and approve the review before execution.

What issues does the review prioritize?

It prioritizes security, correctness, performance, error handling, maintainability, and test coverage in that order.

Can it read failed CI logs?

No. It can report check status and provide the returned log link, but the configured tool does not return log contents.

Will it report existing repository problems?

No. The workflow targets issues introduced by the selected pull request and excludes pre-existing defects.

Detalles del desarrollador

Autor

supatest-ai

Licencia

MIT

Versión del autor

v1.0.0

Revisión de Skillstore

Repositorio

https://github.com/supatest-ai/alan-skills/tree/e6ebae2c86d4d3ad8597e588f3e820ab0c90658f/skills/alan-review-pr

Ref.

bdb71a4bc34515f37772ae85fd5501f9c2ff33b0

Actualidad del mantenimiento

20/8/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md