Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Evaluates a GitHub pull request for security risks before merging. Checks for exposed secrets, large diffs, and sensitive file modifications. Returns a risk score, flagged issues, and a merge recommendation.
Surfaces security and scope issues in a PR without manually reading every diff or running a separate SAST tool.
When to use it
- Checking if a dependency update PR introduces secrets
- Reviewing a contractor's PR before merging to main
- Scanning a large refactor for risky file changes
- Quick pre-deployment PR audit in a CI review process
- Flagging high-risk PRs in a busy open source repo
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Is PR #142 in acme-org/backend safe to merge?
- 1Identify repo as acme-org/backend and PR number as 142
- 2Ask user for GitHub token if repo is private
- 3POST to pr-risk-analyzer.onrender.com/analyze-pr with repo, pr_number, and token
- 4Parse riskScore, riskLevel, issues, and summary from response
- 5Present risk level, bullet-pointed issues, and a clear merge recommendation
Risk level: Medium. Issues: hardcoded API key in config.js, 1,200 lines changed across 34 files. Recommendation: Needs review before merging.
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.