What makes Structured PR Review notable?

1.6K downloads. Trust evidence available

How should Structured PR Review be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

agentCLAWHUBUnverified

Structured PR Review

Layered PR code review with severity tiers (MUST FIX/SHOULD FIX/SUGGESTION) and addressing-mode. Default: gh CLI only; optional Lobster pipeline. Skill: Structured PR Review Owner: ggettert Summary: Layered PR code review with severity tiers (MUST FIX/SHOULD FIX/SUGGESTION) and addressing-mode. Default: gh CLI only; optional Lobster pipeline. Tags: latest:0.1.1 Version history: v0.1.1 | 2026-07-08T22:28:43.077Z | auto - Added optional Lobster pipeline support for parallel PR data gathering; falls back to gh CLI-only if Lobster is unavailable. - New script suit

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

1.6k

Updated

Oct 10, 2026

Version

0.1.1

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 1.6K downloads reported by the source. Last updated 10/10/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 10, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 10, 2026
Adoption signal: 1.6K downloadsadoption · observed Oct 10, 2026
Latest release: 0.1.1release · observed Jul 8, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s17bj3ze3bdgz5fv4m1dbjz8mn84wmhv:structured-pr-review

Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-ggettert-structured-pr-review/snapshot"

Documentation

CLAWHUB

42,056 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: structured-pr-review
description: "Layered PR code review with severity tiers (MUST FIX/SHOULD FIX/SUGGESTION) and addressing-mode. Default: gh CLI only; optional Lobster pipeline."
---

# Structured PR Review

Two modes: giving reviews and addressing review comments. The default/fallback path uses `gh` CLI only — no extra dependencies. An optional Lobster pipeline parallelises data gathering when Lobster (Node/npx) is available; see [references/lobster-integration.md](references/lobster-integration.md).

## Data gathering (optional Lobster pipeline)

`run-pr-review.sh` gathers PR metadata, diff, CI status, and existing review
comments in one step and emits a `pr-context-v0` JSON blob. Use this context
for analysis instead of making multiple sequential `gh` calls.

```bash
# Auto-detect Lobster; falls back transparently to direct pipe-through
scripts/run-pr-review.sh https://github.com/owner/repo/pull/123

# Force direct path (no Lobster required)
scripts/run-pr-review.sh 42 --repo owner/repo --no-lobster
```

See [references/lobster-integration.md](references/lobster-integration.md) for
the full workflow, Lobster args, explicit commands, and install instructions.

## Giving Reviews

When asked to review or check a PR:

1. Fetch the PR details and full diff (use `run-pr-review.sh` or `gh` directly)
2. Walk through each review layer in order (see [references/review-layers.md](references/review-layers.md)):
   - **Security** — secrets, injection, auth, exposure
   - **Correctness** — logic errors, edge cases, error handling
   - **Conventions** — team standards (customize via [references/conventions.md](references/conventions.md))
   - **IaC** — Terraform/CloudFormation checks (customize via [references/iac-checklist.md](references/iac-checklist.md))
   - **Testing** — coverage, new code has tests
3. Produce a structured verdict with severity tiers

**Key principles:**
- Be direct — "this approach has problems" beats "interesting choice"
- Every issue includes what to fix, not just what's wrong
- Acknowledge what the PR does well
- When in doubt on severity, go one level lower

See [references/review-layers.md](references/review-layers.md) for the full framework and verdict format.

## Addressing Review Comments

When asked to address, fix, or respond to PR feedback:

1. Fetch all review comments (inline + review-level)
2. Fix each issue or document why not
3. Reply to every comment — none left unacknowledged
4. Resolve threads, update PR description, push

See [references/addressing-workflow.md](references/addressing-workflow.md) for the step-by-step workflow.

**Key rules:**
- Never leave comments unacknowledged — reply to every one
- Always update the PR description after making changes
- Verify the PR is actually merged before closing linked issues

## Customization

This skill ships with generic review layers. Customize for your team:

- **[references/conventions.md](references/conventions.md)** — coding conventions, commit format, n

_meta.json

{
  "ownerId": "kn7b5fvyf3k1xw6hxrqp9j0a5d84wcz0",
  "slug": "structured-pr-review",
  "version": "0.1.1",
  "publishedAt": 1783549723077
}

references/addressing-workflow.md

# Addressing Review Comments

Step-by-step workflow for responding to PR review comments.

## Workflow

1. **Fetch PR details:**
   ```bash
   gh pr view <number> --repo <owner/repo> --json title,body,headRefName,baseRefName,files
   ```

2. **Clone and checkout the PR branch:**
   ```bash
   gh repo clone <owner/repo> && cd <repo>
   git fetch origin && git checkout <headRefName>
   ```

3. **Fetch all review comments:**
   ```bash
   # Inline comments
   gh api repos/<owner/repo>/pulls/<number>/comments --paginate
   # Review-level comments
   gh api repos/<owner/repo>/pulls/<number>/reviews --paginate
   ```

4. **Address each comment:** Fix the code, or document a clear reason not to.

5. **Commit fixes** — atomic commits per logical change:
   ```bash
   git commit -m "fix: <what was fixed>

   Addresses review comment by @<reviewer>"
   ```

6. **Reply to every comment** — no comment left unacknowledged:
   ```bash
   # Reply to inline comment
   gh api repos/<owner/repo>/pulls/<number>/comments/<id>/replies \
     -f body="<your reply>"
   # Reply to review-level comment
   gh api repos/<owner/repo>/issues/<number>/comments \
     -f body="<your reply>"
   ```
   - If fixed: describe exactly how
   - If not fixed: explain why (disagree, out of scope, won't fix)

7. **Resolve threads via GraphQL:**
   ```bash
   # List review threads
   gh api graphql -f query='
   {
     repository(owner:"<owner>", name:"<repo>") {
       pullRequest(number:<number>) {
         reviewThreads(first:100) {
           nodes {
             id
             isResolved
             comments(first:10) {
               nodes { body author { login } }
             }
           }
         }
       }
     }
   }'

   # Resolve a thread
   gh api graphql -f query='
   mutation {
     resolveReviewThread(input:{threadId:"<THREAD_ID>"}) {
       thread { isResolved }
     }
   }'
   ```

8. **Update the PR description** to reflect all changes made.

9. **Push and present a summary:**
   ```bash
   git push origin <headRefName>
   ```

   | Comment / Issue | Action Taken |
   |-----------------|--------------|
   | @reviewer: "..." | Fixed in commit abc1234 — ... |
   | @reviewer: "..." | Won't fix — reason |

references/conventions.md

# Team Conventions

Review checklist for layer 3 (Conventions). Ships with common defaults — customize for your team.

## Commit Format

- Follows a consistent format (Conventional Commits, Gitmoji, or team standard)
- Subject line is imperative, under 72 characters
- Body explains *why*, not *what* (the diff shows what)
- References issue/ticket numbers where applicable

## Branch Naming

- Lowercase with hyphens (no spaces, underscores, or mixed case)
- Includes ticket/issue reference when applicable
- Descriptive enough to understand the purpose

## PR Requirements

- Title clearly describes the change
- Description includes context — why the change was made
- Links to related issues or tickets
- Breaking changes are called out explicitly

## Code Style

- Consistent with the existing codebase
- No commented-out code committed (use version control instead)
- No debug logging left in (console.log, print, debugger)
- Imports are organized (stdlib → external → internal)

## Naming

- Variables and functions are descriptive (not `x`, `temp`, `foo`)
- Boolean variables read as questions (`isEnabled`, `hasAccess`, not `flag`)
- Constants are UPPER_SNAKE_CASE (or team convention)
- File names match the primary export

## Customize

Replace or extend the sections above with your team's specific standards.
Delete sections that don't apply.

references/iac-checklist.md

# Infrastructure as Code Checklist

Review checklist for Terraform, CloudFormation, Pulumi, and other IaC files.
The review skill checks these during layer 4 (IaC).

Customize for your organization's specific policies.

## Terraform

### Resource Tags (commonly enforced via SCP or policy)
- [ ] All taggable resources have required tags
- [ ] Tag values match allowed values (if enforced)
- [ ] `default_tags` block in provider to avoid repetition

### Provider Configuration
- [ ] Provider version pinned with `~> X.Y` (not exact or unbounded)
- [ ] `required_version` set for Terraform itself
- [ ] `allowed_account_ids` set to prevent accidental cross-account applies

### State Management
- [ ] Remote backend configured (S3, GCS, Azure Blob, etc.)
- [ ] State encryption enabled
- [ ] State key is unique — no collision with other modules
- [ ] State locking configured (DynamoDB for S3, etc.)

### Security
- [ ] No hardcoded secrets, account IDs, or API keys
- [ ] IAM policies follow least privilege — no `*` on actions or resources
- [ ] No IAM users — use roles (if policy requires)
- [ ] Secrets stored in Secrets Manager / Parameter Store, not variables
- [ ] Security groups are not open to `0.0.0.0/0` unless explicitly justified

### Region / Network
- [ ] Resources deployed to allowed regions only
- [ ] No VPC creation if shared VPCs are required
- [ ] Subnet and AZ selection is correct

### Structure
- [ ] `moved` blocks used for renames (not destroy/recreate)
- [ ] `for_each` preferred over `count` for collections that may change
- [ ] Variables have `description` and `type`
- [ ] Outputs have `description`
- [ ] HCL data sources preferred over `jsonencode` (e.g., `aws_iam_policy_document` over inline JSON)
  - `jsonencode` should be a last resort when no native data source exists
  - Native data sources validate at plan time, are easier to read, and are composable

### Naming
- [ ] Resource names follow team conventions
- [ ] S3 buckets follow naming prefix requirements (if any)
- [ ] Module names match the resource they manage

## CloudFormation

- [ ] Parameters have `AllowedValues` where applicable
- [ ] No hardcoded AMI IDs — use SSM parameters or mappings
- [ ] DeletionPolicy set on stateful resources (RDS, S3, DynamoDB)
- [ ] Stack tags applied
- [ ] Outputs exported only when needed (avoid namespace collisions)

## Azure (ARM / Bicep)

- [ ] Required tags on all resources (resource group tags don't auto-inherit)
- [ ] Resource locks on stateful resources (storage accounts, databases)
- [ ] NSG rules follow least-privilege — no `*` on source/destination
- [ ] Managed identities preferred over service principals with secrets
- [ ] Key Vault used for secrets, not parameters or variables
- [ ] Resource names follow naming convention (`<prefix>-<app>-<env>-<resource>`)
- [ ] Correct subscription and resource group targeting
- [ ] API versions pinned (not `latest`)

## GCP (Terraform / Deployment Manager)

- [ ] Labels applied to all resources (

Github ReposUpdated 15h agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.