Xpersona
H

Huo15 Openclaw Code Review

CLAWHUB · Unverified

对 GitHub / cnb.cool PR 做综合代码评审（设计 / 实现 / 测试 / 安全 / 可维护五维），借 gh CLI 拉 diff，产出可粘贴到 PR 的评论 markdown。触发词：评审 PR、code review、审一下这个 PR、帮我 review、看看这个合并请求。 Skill: Huo15 Openclaw Code Review Owner: zhaobod1 Summary: 对 GitHub / cnb.cool PR 做综合代码评审（设计 / 实现 / 测试 / 安全 / 可维护五维），借 gh CLI 拉 diff，产出可粘贴到 PR 的评论 markdown。触发词：评审 PR、code review、审一下这个 PR、帮我 review、看看这个合并请求。 Tags: latest:1.0.0 Version history: v1.0.0 | 2026-04-24T14:34:50.573Z | user 首发 — PR 五维综合评审（设计/实现/测试/安全/可维护）+ 可粘贴 markdown 评论 Archive index: Archive v1.0.0: 3 files, 4209 bytes Files: skill-card.md (2219b), SKILL.

62
Rank
84
Safety
959
Downloads

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 959 downloads reported by the source. Last updated 10/12/2026.

Avoid when

  • Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Install and run

Setup complexity: low.

clawhub skill install s17f6q72skfgyjycm2frgdc8dn83v5mk:huo15-openclaw-code-review
  1. Setup complexity is LOW. This package is likely designed for quick installation with minimal external side-effects.
  2. Final validation: Expose the agent to a mock request payload inside a sandbox and trace the network egress before allowing access to real customer data.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-zhaobod1-huo15-openclaw-code-review/snapshot"

Run-check

$0.02 USD

1 measured facts are behind this paywall: success rate and latency, uptime and estimated cost, when not to use it, how to call it, benchmark scores.

Agents pay $0.02 in USDC. A card payment is $0.50, the smallest a card allows.

Documentation

CLAWHUB

5,963 characters of source documentation, loaded on request.

Extracted files

3 files captured from the source.

SKILL.md

---
name: huo15-openclaw-code-review
displayName: 火一五代码评审技能
description: 对 GitHub / cnb.cool PR 做综合代码评审（设计 / 实现 / 测试 / 安全 / 可维护五维），借 gh CLI 拉 diff，产出可粘贴到 PR 的评论 markdown。触发词：评审 PR、code review、审一下这个 PR、帮我 review、看看这个合并请求。
version: 1.0.0
aliases:
  - 火一五代码评审
  - 代码评审
  - code review
  - PR 评审
  - 审 PR
  - review PR
license: MIT
---

# 火一五代码评审技能 v1.0

> 五维 PR 评审 + 可粘贴评论 — 青岛火一五信息科技有限公司

---

## 一、触发场景

- "帮我 review PR #123"
- "审一下这个合并请求"
- "code review 一下我的 PR"
- 用户贴 PR URL：`https://github.com/xxx/yyy/pull/123` 或 `https://cnb.cool/.../merge_requests/45`

**产出**：五维清单 + 行内评论建议 + 总评（批准/请改/阻断）+ 一段可直接粘贴到 PR 的 markdown。

---

## 二、评审五维

| 维度 | 关注点 | 不关注 |
|------|-------|-------|
| **1. 设计（Design）** | 方案是否对问题对症 / 抽象是否合适 / 与现有架构一致 | 风格偏好 |
| **2. 实现（Implementation）** | 逻辑正确 / 边界处理 / 错误处理 / 资源回收 | 次要优化 |
| **3. 测试（Tests）** | 关键路径有单测 / 边界 case / 回归 | 100% 覆盖率 |
| **4. 安全（Security）** | 代理 `huo15-openclaw-security-review` 做六类扫描 | — |
| **5. 可维护（Maintainability）** | 命名 / 文档 / 可读性 / 变更局部性 | 代码风格（交给 linter）|

---

## 三、工作流（严格按序）

### Step 1：拉取 PR 元信息

```bash
# GitHub
gh pr view <number> --json title,body,author,baseRefName,headRefName,files,commits,additions,deletions

# cnb.cool（如有 API / CLI）
curl .../merge_requests/<id>
```

**不 exec** — 返回命令让用户粘贴结果，或若上下文里已有就用。

### Step 2：拉取 diff

```bash
gh pr diff <number>
# 或
git diff <base>...<head>
```

### Step 3：分段阅读 + Grep 关键字

- 每个文件至少过一遍
- Grep 高危模式（密钥 / SQL 拼接 / `dangerouslySetInnerHTML`）转交 security-review 思路
- 对新增函数：检查命名、参数、返回值、错误处理

### Step 4：五维评分

对 5 维每个给：
- ✅ Pass
- ⚠️ Minor（可合但建议改）
- ❌ Blocker（必须改）

### Step 5：生成行内评论

每条评论格式：
```
`path/to/file.ts:line` — <简短标题>

<问题描述>
<建议>
```

### Step 6：总评

- **Approve** — 全 ✅ 或只有 🟢 minor
- **Request changes** — 有任何 ⚠️ 影响核心
- **Block** — 有 ❌ 安全 / 数据丢失 / 不兼容风险

---

## 四、报告模板

```markdown
## 📋 Code Review — PR #123 "<title>"

**作者**：@xxx · **变更**：12 文件 +340 -120 · **评审耗时**：5 min

### 五维评分
- Design：✅
- Implementation：⚠️ 2 处
- Tests：⚠️ 缺边界测试
- Security：✅（无新增攻击面）
- Maintainability：✅

### 总评：🟡 Request Changes

必改后合并：1 处 Implementation blocker + 1 处测试缺失。

---

### 行内评论

**`src/api/user.ts:45`** — 边界未处理
当 `userId` 为 `undefined` 时 `db.user.findById(userId)` 会返回所有用户。
建议：函数入口加 `if (!userId) throw new Error(...)`。

**`src/api/user.ts:88`** — 错误吞掉
`catch(e) { return null }` 掩盖了数据库连接错误。
建议：区分「找不到」和「出错」，至少记日志。

**`tests/user.test.ts`** — 缺边界用例
新增的 `mergeProfile` 没测 `null` / `undefined` / `{}` 空对象三种输入。
建议：补 3 条测试用例。

### 其他观察（不阻塞合并）
- 命名 `data` → `userProfile` 可读性更好（src/utils.ts:12）
- 可用 `Pick<User, 'id'|'name'>` 替代手写接口（types.ts:33）

---

🤖 Reviewed by huo15-openclaw-code-review
```

---

## 五、硬红线（绝不触碰）

1. **不 `gh pr review --approve` / `--request-changes`** — 评审意见由人提交（避免 AI 自己批自己的 PR）
2. **不 `gh pr merge`** — 合并决策权归人
3. **不自动 `gh pr comment`** — 除非用户明确说"直接发到 PR 上"
4. **不跑测试 / build** — 除非用户要求
5. **禁 child_process** — `gh` 命令走 return-cliCmd

---

## 六、与相邻技能的边界

| 场景 | 用哪个 |
|------|--------|
| PR 综合评审 | **本技能** |
| 只看安全 | `huo15-openclaw-security-review` |
| 只看代码质量 | `huo15-opencla

_meta.json

{
  "ownerId": "kn7byevkn40d6z4p7ghdb097z983tj33",
  "slug": "huo15-openclaw-code-review",
  "version": "1.0.0",
  "publishedAt": 1777041290573
}

skill-card.md

## Description:

Reviews GitHub and cnb.cool pull requests across design, implementation, testing, security, and maintainability, then produces Markdown comments that a reviewer can paste into the PR.

This skill is ready for commercial/non-commercial use.

## Publisher:

[zhaobod1](https://clawhub.ai/user/zhaobod1)

### License/Terms of Use:

MIT-0

## Use Case:

Developers and engineering reviewers use this skill to review GitHub or cnb.cool pull requests, assess design, implementation, tests, security, and maintainability, and draft Markdown feedback for human submission.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: The skill may process PR metadata and diffs from GitHub or cnb.cool, including private repository content if the user provides it.

Mitigation: Use it only with repository content the reviewer is authorized to share with the agent, and avoid including secrets or unrelated sensitive context.

Risk: Generated review comments can be incorrect, incomplete, or misleading if the PR context is missing or the analysis is wrong.

Mitigation: Have a human reviewer inspect and edit the generated Markdown before posting it to a PR.

Risk: The report template includes a branded attribution line that may not be appropriate for every repository or organization.

Mitigation: Review the final Markdown and remove or revise attribution before posting when repository policy requires it.

## Reference(s):


## Skill Output:

**Output Type(s):** [text, markdown, shell commands, guidance]

**Output Format:** [Markdown review report with optional inline shell commands]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [Includes PR summary, five-dimension ratings, inline comment suggestions, and an overall review recommendation; generated comments require human review before posting.]

## Skill Version(s):

1.0.0 (source: server release evidence and SKILL.md frontmatter)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Sponsored

Ads related to Huo15 Openclaw Code Review and adjacent AI workflows.