Skills pr-review

📦

pr-review

Name: pr-review
Author: MiniMax-AI

v1.0 Content revision r1 Medium Risk 🔑 Env variables📁 Filesystem access⚙️ External commands

Review Skill Pull Requests

Skill repository maintainers need consistent reviews for new skill submissions. This skill combines automated structure checks with manual quality criteria for pull requests.

Supports: Claude Codex Code(CC)

📊 72 Adequate

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "pr-review" from https://skillstore.io/skills/minimax-ai-pr-review.md and its manifest at https://skillstore.io/api/skills/minimax-ai-pr-review/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/minimax-ai-pr-review.md Signed manifest GET /api/skills/minimax-ai-pr-review/manifest Signed lockfile GET /api/skills/minimax-ai-pr-review/lockfile

Test it

Using "pr-review". A new skill PR adds SKILL.md, references, and a helper script.

Expected outcome:

Blockers: missing required description field in SKILL.md.
Warnings: metadata is incomplete and the helper script has no requirements file.
Suggestions: clarify trigger conditions and update the README tables.

Using "pr-review". A reviewer asks whether an API skill is ready to merge.

Expected outcome:

Validation passed with no hard blockers.
Review notes: document the required environment variables and avoid realistic example keys.
Merge recommendation: approve after documentation updates are added.

Using "pr-review". A maintainer wants concise PR feedback for a skill with overlap concerns.

Expected outcome:

Blockers: none found.
Quality feedback: explain how this skill differs from existing repository skills.
Required follow-up: update README entries before merge.

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

The static findings for markdown backticks, YAML documentation, BOM handling, and section titles are false positives. No prompt injection or malicious execution intent was found in the reviewed files. One medium semantic issue remains: the validation script prints matched secret text in error output.

Files scanned

393

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

scripts/validate_skills.py:157-159

Secret Values Printed in Validation Output

The validator includes matched secret text in error messages. If run in CI or shared logs, detected credentials could be exposed to reviewers or log storage.

The script captures matched secret text and appends it to an error message. The value is truncated, but credential prefixes or complete short tokens can still leak.

Risk Factors

🔑 Env variables (1)

references/quality-guidelines.md:37

📁 Filesystem access (1)

scripts/validate_skills.py:176

⚙️ External commands (9)

SKILL.md:22-24 SKILL.md:24-27 SKILL.md:27-29 SKILL.md:29 SKILL.md:30-33 SKILL.md:33 SKILL.md:42-47 SKILL.md:47 SKILL.md:54-63

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/minimax-ai-pr-review/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/minimax-ai-pr-review/security.svg)](https://skillstore.io/skills/minimax-ai-pr-review?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/minimax-ai-pr-review?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/minimax-ai-pr-review/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/minimax-ai-pr-review.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

MiniMax-AI. (2026). pr-review security audit report (audit version 4) [Author version 1.0]. Skillstore. https://skillstore.io/skills/minimax-ai-pr-review/audits/4

BibTeX citation

@techreport{minimax-ai-minimax-ai-pr-review-2026,
  author = {MiniMax-AI},
  title = {pr-review security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/minimax-ai-pr-review/audits/4},
  note = {Author version 1.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "pr-review security audit report (audit version 4)"
version: "1.0"
type: report
authors:
  - name: "MiniMax-AI"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/minimax-ai-pr-review/audits/4"
identifiers:
  - type: other
    value: "skillstore:minimax-ai-pr-review:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Review a New Skill Submission

Apply hard validation rules and soft quality checks before approving a new community skill.

Validate Skill Metadata

Confirm that SKILL.md frontmatter has required fields and follows repository naming rules.

Prepare Marketplace Quality Feedback

Turn validation failures and guideline issues into clear pull request review comments.

Try These Prompts

Basic PR Check

Review this skill pull request with the pr-review checklist. Start with hard validation results, then list any quality issues.

Metadata Review

Check this skill submission for required frontmatter, naming consistency, license, metadata, and clear trigger conditions.

Security-Focused Review

Review this skill for hardcoded secrets, unsafe script behavior, dependency concerns, and missing environment variable documentation.

Full Maintainer Review

Perform a complete maintainer review of this skill PR. Separate blockers, warnings, quality suggestions, and README synchronization issues.

Best Practices

Run automated validation before writing manual review comments.
Separate merge blockers from suggestions so authors can prioritize fixes.
Check README updates whenever a skill is added or renamed.

Avoid

Approving a skill when required SKILL.md fields are missing.
Treating warning-level metadata issues as hard blockers without repository policy support.
Ignoring realistic example credentials because they appear in documentation.