Home
cd ../playbooks
Developer ToolsIntermediate

PR Reviewer

Senior engineer PR review system - structured feedback on correctness, security, tests, and maintainability with actionable diffs.

5 minutes
By andreolfSource
#code-review#pull-request#engineering#testing#security

Your PR has been waiting for review for two days because the senior engineer is in meetings. When feedback finally comes, it's 'LGTM' on the easy PRs and silence on the complex ones. You need a consistent, thorough first pass that catches real issues — not a rubber stamp.

Who it's for: developers wanting instant thorough feedback on their PRs, engineering teams with review bottlenecks, solo developers without a senior engineer to review their code, tech leads wanting consistent review quality across the team, open-source maintainers handling high PR volumes

Example

"Review my PR before I ask the team" → Structured review covering correctness (2 logic issues), security (1 SQL injection risk), test coverage (3 untested edge cases), maintainability (4 suggestions), and actionable diffs for each finding

CLAUDE.md Template

New here? 3-minute setup guide → | Already set up? Copy the template below.

SYSTEM
You are a senior engineer doing PR reviews. You are strict, helpful, and precise.

CONTEXT
Repo: {{repo}}
PR title: {{title}}
Risk tolerance: {{risk}}
Date: {{date}} (UTC {{time_utc}})

INPUT
{{input}}

TASK
Review the changes and propose improvements.

RULES
- If information is missing or unknown, state "Unknown" explicitly
- State all assumptions clearly
- Do not fabricate or hallucinate facts
- Be deterministic: same input should produce consistent output structure
- If input is missing, ask at most 3 questions, then proceed
- Focus on correctness, security, tests, and maintainability
- Provide actionable diffs or pseudo diffs when possible

OUTPUT SCHEMA
1) Summary (3 bullets)

2) High risk issues
- Issue:
  - Why:
  - Fix:

3) Medium risk issues
- Issue:
  - Why:
  - Fix:

4) Low risk improvements
- Improvement:
  - Why:
  - Suggestion:

5) Test plan
- Unit:
- Integration:
- Edge cases:

6) Suggested follow ups (5 bullets)

Get new playbooks like this one

One email a week with new Claude Code workflows. Free, like everything here.

No spam. Unsubscribe anytime.

README.md

What This Does

Acts as a strict, precise senior engineer reviewing your pull requests. Provides structured feedback organized by risk level, with actionable fixes and a test plan covering unit, integration, and edge cases.


Quick Start

Step 1: Download the Template

Click Download above to get the CLAUDE.md file.

Step 2: Provide PR Context

Fill in the repo name, PR title, and risk tolerance level.

Step 3: Run the Review

claude

Say: "Review this PR" and paste the diff or PR link.


Review Focus Areas

Area What's Checked
Correctness Logic errors, edge cases, off-by-ones
Security Injection, auth issues, data exposure
Tests Coverage gaps, missing edge cases
Maintainability Readability, naming, complexity

Example Output

## Summary
- Adds rate limiting middleware to API endpoints
- Refactors auth token validation into shared util
- Missing error handling for Redis connection failures

## High Risk Issues
- Issue: Redis connection failure crashes server
  - Why: No try/catch around Redis calls in rate limiter
  - Fix: Add fallback to allow requests when Redis is down

## Medium Risk Issues
- Issue: Rate limit key doesn't include API version
  - Why: v1 and v2 share limits, could block v2 users
  - Fix: Include version prefix in Redis key

## Test Plan
- Unit: Rate limiter returns 429 after threshold
- Integration: Middleware integrates with Express pipeline
- Edge cases: Redis down, concurrent requests, key expiry

Tips

  • Set risk tolerance: "Low" for production-critical code, "High" for internal tools
  • Provide full diff: More context = better review
  • Iterate on findings: Ask follow-up questions about specific issues
  • Pair with CI: Run before merge to catch issues early

Commands

"Review this PR for security issues"
"Focus on the test coverage gaps"
"What are the high-risk changes?"
"Suggest a test plan for this PR"
"Give me actionable diffs for the fixes"

$Related Playbooks

Developer Tools

Simplicity First Code Gate

A hard correctness gate against over-complex or oversized code — one ordering principle (human readability first, agent traceability second), five enforceable rules, and a pre-finish checklist that treats unnecessary complexity as a bug, not a style opinion.

2 minutes
Beginner
Developer Tools

Slidev Presentation Builder

Build developer-focused presentations with Slidev — Markdown-driven slides with live code, syntax highlighting, Monaco editor embeds, Mermaid/PlantUML diagrams, LaTeX math, click-based animations, and presenter notes, plus a quick-reference table for the exact syntax each feature needs.

5 minutes
Beginner
Developer Tools

Technical Writing Style Guide

Write docstrings, READMEs, commit messages, and PR descriptions that read like human technical documentation instead of LLM output — six concrete 'tells' with before/after rewrites, a smoothness diagnostic for prose that sounds authoritative while stating one fact three times, and industry-metaphor substitution tables ('surfaces' to 'raises/returns/logs', 'wired through' to 'passed as a parameter').

5 minutes
Intermediate
Developer Tools

Secret Scan and Rotation

Find committed credentials in a repository's working tree and full history, triage real secrets from test fixtures, and drive rotation-first remediation — with an absolute rule against ever printing a secret's actual value, even during the scan itself.

5 minutes
Intermediate
Developer Tools

Self-Improvement Loop Design

Design systems where the harness itself is the optimization target — an optimization ladder from prompt to context to workflow to harness code, a two-split empirical acceptance gate, an outside-the-loop invariant for the evaluator, and a catalog of documented reward-hacking and collapse failure modes.

10 minutes
Advanced
Developer Tools

Skill Security Inspector

Review an AI agent skill before installing it using two independent lines — static scanner evidence plus source-aware semantic judgment — checking purpose fit, permission fit, sensitive access, external transmission, execution risk, and persistence, down to a clear APPROVE, CAUTION, or REJECT verdict.

10 minutes
Intermediate
Developer Tools

Semantic Prompt Compression

Re-encode verbose system prompts, tool descriptions, and skill bodies into a dense telegraphic register — punctuation as connectives, label frames, verbless assertions — via re-encoding, not word deletion, with a density gate and a declared-loss verification pass.

5 minutes
Advanced
Developer Tools

Simplified Technical English for Docs

Write or rewrite technical documentation with the ASD-STE100 Simplified Technical English discipline — the aerospace maintenance-manual standard adapted for READMEs, runbooks, error messages, incident reports, and agent instructions.

10 minutes
Intermediate
Developer Tools

Subagent-Driven Development

Execute an implementation plan by dispatching a fresh subagent per task with a spec-and-quality review after each, a ledger that survives compaction, and a 'rulings not stalls' policy that keeps a running plan from waiting on a human at every fork.

10 minutes
Advanced
Developer Tools

Secure Coding Practices

A threat-model-first secure coding reference — trust-boundary mapping, a STRIDE quick-pass, a three-tier always/ask-first/never boundary system, and copy-paste prevention patterns for injection, XSS, broken access control, and SSRF.

10 minutes
Intermediate
Developer Tools

Security Guidance Review

Three-layer continuous security review for AI-generated code — instant regex warnings on edit, an LLM diff review at end of turn, and an agentic commit-time reviewer that traces data flow across files.

10 minutes
Advanced
Developer Tools

Shannon: Autonomous Pentesting for Your Own Apps

An operating guide for driving Keygraph's Shannon CLI: scope a white-box pentest against an app you own, run it, and turn the proven findings into fix tasks

15 minutes
Advanced

Browse all Developer Tools playbooks →