Skills pr-review

📦

pr-review

Name: pr-review
Author: MiniMax-AI

Low Risk

Review pull requests for skill quality

Manual review of pull requests in the MiniMax Skills repository can miss structural issues and quality standards. This skill provides automated validation and guided content review to ensure every skill meets repository standards before merging.

Supports: Claude Codex Code(CC)

🥈 78 Silver

Download the skill ZIP

Upload in Claude

Go to Settings → Capabilities → Skills → Upload skill

Toggle on and start using

Test it

Using "pr-review". Review PR #42 adding a new weather-api skill

Expected outcome:

Phase 1 Validation: PASS - validate_skills.py exited with code 0
Phase 2 Review:
- Skill scope: No overlap with existing skills
- Description quality: Includes trigger conditions and keywords
- File size: SKILL.md is 45 lines, references are 120 lines total
- Credential handling: API key documented as required environment variable
- Script quality: Shebang present, requirements.txt included, error handling clear
- Language: All content in English
- README sync: Both README.md and README_zh.md updated with Community source
Verdict: Approve - all checks passed

Using "pr-review". Validate the weather-api skill submission

Expected outcome:

Validating 1 skill(s)...
[PASS] skills/weather-api
0 errors, 0 warnings
Validation PASSED.
Name matches directory. Frontmatter valid. No secrets detected.

Security Audit

Low Risk

v1 • 4/16/2026

All 70 static analysis findings are false positives. The scanner misinterpreted Markdown backtick code fences (used for documentation formatting) as Ruby/shell command execution. Blocker findings for 'weak cryptographic algorithm' matched on secret-scanning regex patterns in the validation script, not actual cryptography. 'System reconnaissance' findings matched standard PR review terminology in documentation. No malicious intent, data exfiltration, or unsafe behavior was found. The skill is a legitimate PR review tool with a Python validation script that uses only standard library modules.

Files scanned

393

Lines analyzed

findings

Total audits

Low Risk Issues (3)

SKILL.md:22-24 references/quality-guidelines.md:21-22 references/structure-rules.md:9-17

Static Scanner False Positives - Markdown Code Fences

The static analyzer flagged 41 instances of Markdown backtick code fences as Ruby/shell backtick execution. These are documentation formatting characters, not command execution. All findings in SKILL.md, references/quality-guidelines.md, and references/structure-rules.md are inline code examples or code blocks showing users how to run commands.

scripts/validate_skills.py:76-80 references/structure-rules.md:42-48

Static Scanner False Positives - Secret Scanning Regex Misidentified

26 blocker findings for 'weak cryptographic algorithm' matched on regex patterns used for secret detection (sk-, AKIA, Bearer token patterns) in scripts/validate_skills.py and documentation describing what the scanner looks for. These are not cryptographic operations but string pattern matching for credential detection.

references/quality-guidelines.md:3 references/structure-rules.md:3

Static Scanner False Positives - Documentation Terminology

Low-severity 'system reconnaissance' findings matched on standard PR review terminology such as 'review', 'check', and 'scan' in documentation text. These are not system scanning operations.

Audited by: claude

Quality Score

Architecture

100

Maintainability

Content

Community

Security

Spec Compliance

What You Can Build

Automated PR validation for skill submissions

Run the validation script to check new skill submissions against structural requirements before manual review begins.

Quality review of existing skills

Apply content review guidelines to evaluate skill descriptions, file sizes, and credential handling practices.

Standardizing skill documentation

Ensure all skills follow consistent naming, frontmatter format, and documentation standards across the repository.

Try These Prompts

Basic PR review

Review this pull request for the MiniMax Skills repository. Run the validation script first, then check the PR against the quality guidelines.

Validate a new skill

Validate the new skill in this PR. Check that SKILL.md has valid frontmatter, required fields, no hardcoded secrets, and follows the kebab-case naming convention.

Full quality audit

Perform a complete review of this PR. Phase 1: run validate_skills.py and check all ERROR items pass. Phase 2: review description quality, file size, API key handling, script quality, language, and README sync status.

Audit multiple skills

Run the validation script across all skills in the repository. List any that fail ERROR checks or have WARNING items. For failures, summarize what needs to be fixed.

Best Practices

Always run validate_skills.py before starting manual content review
Check that API credentials are documented as environment variables, not hardcoded values
Verify the README.md and README_zh.md tables are updated when adding new skills

Avoid

Approving a PR without running the validation script first
Ignoring WARNING items that indicate missing license or metadata fields
Allowing hardcoded API keys or passwords in skill files or scripts

Frequently Asked Questions

What does the validation script check?

The script checks for SKILL.md presence, valid YAML frontmatter, required fields like name and description, directory name matching the frontmatter name, and scans for hardcoded secrets.

Can this skill review skills outside the MiniMax repository?

No. The validation script and guidelines are specific to the MiniMax Skills repository structure and conventions.

What happens if the validation script fails?

ERROR-level failures must be fixed before the PR can merge. The script exits with code 1 when errors are found.

Are WARNING items blockers?

No. WARNING items such as missing license or metadata fields should be flagged but do not block merging.

What secret patterns does the scanner detect?

It detects OpenAI-style API keys (sk- prefix), AWS Access Key IDs (AKIA prefix), and hardcoded Bearer tokens (JWT format). Other credential patterns require manual review.

Does this skill require external dependencies?

No. The validation script uses only Python standard library modules. No pip install is required.