Blame · Line-by-line history
SKILL.md
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 43095dc | 1 | --- |
| 2 | name: gluecron-review | |
| 3 | description: Act as a secondary AI code reviewer on a Gluecron-hosted pull request. Use this skill when the user asks Claude to "review PR #N", "give a second-opinion review", or "leave inline comments" on a Gluecron pull request. Complements Gluecron's built-in AI review. | |
| 4 | tools: | |
| 5 | - gluecron_get_pr | |
| 6 | - gluecron_list_prs | |
| 7 | - gluecron_comment_pr | |
| 8 | - Bash | |
| 9 | --- | |
| 10 | ||
| 11 | # Skill: gluecron-review | |
| 12 | ||
| 13 | You are a secondary reviewer on top of Gluecron's built-in AI review. | |
| 14 | Gluecron already runs its own pass (see `src/lib/ai-review.ts` — | |
| 15 | `AI_REVIEW_MARKER = "<!-- gluecron-ai-review:summary -->"`). Your job is to | |
| 16 | add depth, catch what it missed, and post clear inline-style review comments | |
| 17 | via the K1 MCP write surface. | |
| 18 | ||
| 19 | ## When to use this skill | |
| 20 | ||
| 21 | Trigger when ALL of these are true: | |
| 22 | ||
| 23 | 1. The user is on a Gluecron-hosted repo (origin URL contains | |
| 24 | `gluecron.com`, matches `$GLUECRON_HOST`, or they say "Gluecron"). | |
| 25 | 2. The user asks for a code review, second opinion, "review PR N", "look | |
| 26 | over PR N", or "leave inline comments on PR N". | |
| 27 | ||
| 28 | ## Required setup | |
| 29 | ||
| 30 | ```bash | |
| 31 | git config --get remote.origin.url # extract owner / repo | |
| 32 | ``` | |
| 33 | ||
| 34 | Strip `.git`. The tools take `owner` and `repo` as separate arguments. | |
| 35 | ||
| 36 | ## Review workflow | |
| 37 | ||
| 38 | 1. **Fetch the PR record.** Call `gluecron_get_pr` with | |
| 39 | `{ owner, repo, number: N }`. From the response read `baseBranch` and | |
| 40 | `headBranch`. | |
| 41 | ||
| 42 | 2. **Fetch the diff locally.** | |
| 43 | ||
| 44 | ```bash | |
| 45 | git fetch origin <baseBranch> <headBranch> | |
| 46 | git diff origin/<baseBranch>...origin/<headBranch> | |
| 47 | ``` | |
| 48 | ||
| 49 | If the head branch is not on origin (PR from a fork — note that forks | |
| 50 | in Gluecron also push to a branch on the source repo), fall back to | |
| 51 | reviewing the description-level changes only and tell the user the | |
| 52 | head ref was not fetchable. | |
| 53 | ||
| 54 | 3. **Identify real issues.** Look for: | |
| 55 | - Bugs, logic errors, off-by-ones | |
| 56 | - Security: injection, XSS, auth bypass, secrets in code | |
| 57 | - Performance: N+1 queries, blocking I/O, unbounded allocations | |
| 58 | - Missing error handling at system boundaries | |
| 59 | - Breaking changes / API-contract violations | |
| 60 | ||
| 61 | Do NOT flag: style, formatting, naming, missing docs, minor nits. | |
| 62 | ||
| 63 | 4. **Post one comment per finding** via `gluecron_comment_pr`. Format each | |
| 64 | body as: | |
| 65 | ||
| 66 | ``` | |
| 67 | **<short headline>** — `<filepath>:<line>` | |
| 68 | ||
| 69 | <2-4 sentence explanation> | |
| 70 | ||
| 71 | ```suggestion | |
| 72 | <proposed code, if applicable> | |
| 73 | ``` | |
| 74 | ``` | |
| 75 | ||
| 76 | 5. **Post a summary comment LAST** via `gluecron_comment_pr`. The body | |
| 77 | MUST start with the marker convention used by Gluecron so future tools | |
| 78 | can recognise it as an AI summary. Use this exact prefix: | |
| 79 | ||
| 80 | ``` | |
| 81 | <!-- claude-secondary-review:summary --> | |
| 82 | ## Claude secondary review | |
| 83 | ``` | |
| 84 | ||
| 85 | Then a verdict line: | |
| 86 | ||
| 87 | ``` | |
| 88 | **Verdict:** approved (or: **Verdict:** changes requested) | |
| 89 | ``` | |
| 90 | ||
| 91 | Then a 1–3 sentence overall assessment, and a bullet list of the | |
| 92 | findings you posted above. | |
| 93 | ||
| 94 | The marker is intentionally distinct from `<!-- gluecron-ai-review:summary -->` | |
| 95 | (defined in `src/lib/ai-review.ts`) so Gluecron's own review and this | |
| 96 | secondary review do not clobber each other. | |
| 97 | ||
| 98 | ## Approval vs changes-requested | |
| 99 | ||
| 100 | - **Approve** (verdict line `**Verdict:** approved`) when: | |
| 101 | - You found no blocking issues. | |
| 102 | - All inline comments are nits or optional cleanups. | |
| 103 | ||
| 104 | - **Request changes** (verdict line `**Verdict:** changes requested`) | |
| 105 | when: | |
| 106 | - You found at least one bug, security issue, or contract violation. | |
| 107 | ||
| 108 | The Gluecron merge gate looks for "**Approved**", "approved: true", or | |
| 109 | "lgtm" in `isAiReview=true` comments. Your comments are posted as a | |
| 110 | normal user (the MCP write tools do NOT set `isAiReview`), so they will | |
| 111 | not auto-unblock the merge gate. That's intentional — a human reviewer | |
| 112 | should still gate the merge. | |
| 113 | ||
| 114 | ## Example user prompts | |
| 115 | ||
| 116 | - "Give PR 42 a second-opinion review." | |
| 117 | - "Leave inline comments on PR 42." | |
| 118 | - "Review the diff in PR 42 — focus on security." | |
| 119 | ||
| 120 | ## Don'ts | |
| 121 | ||
| 122 | - Do NOT call `gluecron_merge_pr` from this skill. Reviewing is not | |
| 123 | merging. If the user asks to merge after reviewing, hand off to the | |
| 124 | `gluecron-pr` skill. | |
| 125 | - Do NOT spam more than ~10 inline comments. Pick the most important | |
| 126 | findings and combine related ones. | |
| 127 | - Do NOT post a finding without a code reference (file + line). | |
| 128 | - Do NOT use the `<!-- gluecron-ai-review:summary -->` marker — that is | |
| 129 | reserved for Gluecron's built-in review pass. |