name: pr description: | Use when reviewing an incoming GitHub pull request — runs the multi-level (L1-L5) audit against the PR's real diff range, posts findings as one batched review (inline, summary, or local-only), offers the standard fix chain on NEEDS_FIX, and optionally merges. The maintainer-side counterpart to /hyperflow:issue. Trigger with /hyperflow:pr, "review PR #N", "review this pull request ", "audit the PR", "check this contribution". allowed-tools: Read, Write, Edit, Bash(git:), Bash(gh:), Glob, Grep, Agent, Skill, AskUserQuestion argument-hint: "<pr url | #number> [level=1-5] [comment=ask|never] [merge=ask|never]" version: 1.0.0 license: MIT compatibility: Claude Code, Codex, OpenCode, Antigravity (needs gh CLI + git remote); Desktop/web via pasted diff (lossy) tags: [github, pull-request, code-review, audit, maintainer, multi-agent]

PR

GitHub-native inbound review: point it at a pull request and the existing L1-L5 audit machinery runs over the PR's real code — then the verdict flows back to GitHub as one batched review, behind a gate. This skill owns ingestion, the untrusted-code boundary, posting, and the merge exit; the review itself is unchanged. The outbound counterpart is .

Signal	Level
Docs/comments-only diff	L1
Internal contributor, small surface	L2-L3 (default L3)
External contributor (`isCrossRepository`), or touches auth/secrets/CI/dependency manifests	L4
Security-sensitive path + external author, or `level=5` requested	L5

Failure	Behavior
`gh` missing / unauthenticated	Local-only mode — full review, manual posting commands printed
PR not found / no access	Stop: `PR #<n> not found in <repo> — check the number and gh auth scope.`
Fetch of `pull/<n>/head` fails	Fall back to `gh pr diff <n>` text review at ≤L2 with an explicit "context-limited review" caveat in any posted summary
`SECURITY_VIOLATION` from audit	Halt. Nothing posts. Surface locally only
Headless	Requires `comment=` and `merge=` pre-elected; contributor code never runs

pr

Install

Related skills

Questions

PR

Step 0 — Preflight

Step 1 — Untrusted-code boundary (iron rule)

Step 2 — Review (delegates to audit)

Step 3 — Posting gate

Step 4 — Fix path (on NEEDS_FIX)

Step 5 — Merge exit

Error handling

Portability

Doctrine