Pre-Merge Code Review and PR Description
Severity-ranked review of a branch or diff with file:line findings, breaking-change and rollback checks, and a ready-to-post PR description.
Before & after
Same prompt, same agent — the only difference is the skill.
I'll review your PR for you. Let me look at the code changes and check if they follow your coding standards. I can provide feedback on the structure and suggest improvements. It's good to check for common issues like error handling, edge cases, and performance problems. I'll look at the tests to make sure they cover the new functionality. I should also check if the PR description clearly explains what changed and why. Let me know if you have any specific areas you want me to focus on. I can write up a summary of findings when I'm done. Would you like me to focus on anything specific, or should I do a comprehensive review?
CODE REVIEW REPORT: PR 847
CRITICAL ISSUES (Block merge)
1. Memory leak in useEffect hook (auth.tsx, line 42)
Finding: clearInterval not called on unmount
Impact: Browser memory grows 2.3 MB per login cycle in long-lived sessions
Fix: Add cleanup: return () => clearInterval(pollTimer)
Confidence: 100%
2. Missing authentication on /admin endpoint (api/admin.ts, line 18)
Finding: POST /api/admin/update-user accepts any request without admin role check
Impact: CRITICAL — any user can promote themselves to admin
Fix: Add auth middleware: export const handler = withAdminAuth(updateUser)
Confidence: 100%
WARNINGS (Fix before merge)
3. Unhandled promise rejection (stripe.ts, line 105)
Risk: Stripe API failures silently swallowed
Fix: Add .catch() or wrap in try/catch
Confidence: 95%
4. Missing TypeScript type for user_id (queries.sql, line 22)
Type assumes string, callers pass number
Fix: Change signature: sql\`SELECT * FROM users WHERE id = NUMBER(userId)\`
Confidence: 90%
ARCHITECTURE CONCERNS
Pattern: 4 new database queries in single handler (payment-webhook.ts)
Issue: N+1 query problem emerging. Current: 15 queries per webhook event.
Recommendation: Batch into 1-2 calls using JOIN or prefetch
Impact if ignored: Performance degrades with volume (50 webhooks/min, scales to 500+)
STANDARDS COMPLIANCE
Coding: 9/10 (minor userId vs user_id inconsistency)
Test coverage: 7/10 (missing tests for Stripe failure paths)
PR description: 8/10 (clear what changed, missing why on one decision)
GENERATED PR DESCRIPTION
Title: Fix auth bypass and memory leak in payment flow
Summary:
- Adds auth gate to /admin endpoint (security fix)
- Fixes useEffect cleanup to prevent browser memory leak
- Refactors stripe webhook to batch database queries
Risk level: Low (fixes localized, comprehensive tests)
Deploy: Safe for next release
Monitor: Watch admin endpoint access logs for abnormal activity
STATUS: BLOCKED — Fix critical issues 1-2 first. Re-request review after fixes.About this skill
Your PR gets bounced for a breaking change you never saw, or the AI review you ran came back as twenty nitpicks and missed the missing auth check. This skill reviews the change the way a strong senior reviewer does. It reads whole files, traces who calls what you changed, and asks whether the change survives a rolling deploy and a rollback. Then it writes the PR description for you.
What it does
- Hunts for the bugs diff readers miss: deleted guards, changed defaults, object-level authorization gaps, non-idempotent retries, and unbounded queries
- Traces call sites for every changed signature, default, config key, column, and event payload, and flags consumers outside the repo
- Checks migrations and code for deploy ordering, old and new code running side by side, and rollback safety
- Ranks findings as Blocking, Should-fix, or Nit, each with file:line, the concrete trigger scenario, a fix, and whether it was traced or is only suspected
- Flags architecture drift, such as new cross-module dependencies, layering violations, and a second way of doing something the codebase already does
- Writes a PR description covering why, behavior changes, risk and rollout, and a reviewer guide, and it never claims testing that did not happen
What you get
A verdict line, a severity-ranked findings list you can act on line by line, and a paste-ready PR description. Quick questions get quick answers instead of the full report.
Best for
Solo developers and small teams without a second reviewer, authors who want to self-review before requesting review, and anyone shipping AI-written code who needs a real check before merge.
SKILL.md preview
---
name: pre-merge-code-review-and-pr-description
description: Reviews a code change before it merges - reads full changed files, traces call sites of every changed interface, checks deploy and rollback safety, ranks findings Blocking / Should-fix / Nit with file:line and a concrete trigger scenario, flags architecture drift, and writes a PR description that only claims testing that actually happened. Use when the user says "review my branch", "review this diff before I open the PR", "write the PR description", "is this safe to merge", "what did I break", "my PRs keep getting bounced in review", "AI reviews just give me nitpicks", or "check this refactor for breaking changes".
---
… (sign up to view the full skill)More development skills
View all Development skills →Performance Bottleneck Profiling: Node, Python, Go
Classifies a slowdown, gives exact profiler commands, reads the output, and proves the fix with same-conditions p95/p99 numbers.
Feature Scaffolding with Working Tests
Turn a short feature spec into code, runnable tests, and integration wiring that match your existing project.
Feature Flag Rollouts and Kill Switches
Design staged flag rollouts, verify rollback paths, and audit flag debt with explicit defaults, gates, and retirement plans.
Microcontroller Firmware and RTOS Engineering
Build and debug MCU firmware with bounded ISR/RTOS timing, safe DMA ownership, and measured power budgets.