Automatically evaluate GitHub pull requests for security vulnerabilities, exposed secrets, and structural merge risks.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install pr-risk-analyzer
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install pr-risk-analyzer using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is PR Risk Analyzer?
The PR Risk Analyzer is a robust security tool designed to fortify your development lifecycle by scrutinizing GitHub pull requests before they are merged. By integrating this capability into your workflow via Openclaw Skills, you can automatically detect critical threats such as exposed credentials, suspicious modifications to sensitive files, and overly large code changes that might hide bugs. This skill acts as an automated gatekeeper, providing technical teams with the confidence to deploy code faster while maintaining a high security posture.
Built for modern DevOps environments, this skill transforms the manual peer review process into a data-driven audit. It analyzes the specific diffs of a PR and generates an actionable risk assessment, ensuring that every contribution to your repository adheres to safety standards and best practices established within the Openclaw Skills ecosystem.
PR Risk Analyzer Use Cases
- Verify if a specific pull request is safe to merge into production or main branches.
- Scan incoming code changes for exposed API keys, secrets, or hardcoded passwords.
- Audit large PRs to identify potential architectural risks or unintended side effects.
- Review modifications to sensitive configuration files before they impact the live environment.
How PR Risk Analyzer Works
- The skill identifies the target repository and pull request number from the user's natural language request.
- If the repository is private, the skill securely requests a GitHub access token to perform the analysis.
- A POST request is dispatched to the analysis engine containing the repository details and authorization.
- The engine parses the PR response to extract the risk score, risk level, specific issues, and a summary of changes.
- The skill presents a clear recommendation to the user, categorizing the PR as Safe, Needs Review, or High Risk.
PR Risk Analyzer Setup
To begin using the PR Risk Analyzer within Openclaw Skills, ensure your agent has access to the analysis endpoint. No local installation of the analyzer engine is required.
# Ensure your environment is configured to provide GitHub tokens for private repos
# The skill communicates with: https://pr-risk-analyzer.onrender.com/analyze-pr
Simply provide the repository path (e.g., owner/repo) and the PR number when prompted by your agent.
PR Risk Analyzer Data Schema & Taxonomy
The skill processes data according to the following schema to ensure clear reporting and auditability:
| Parameter | Type | Description |
|---|---|---|
| riskScore | Integer | A numerical score representing the overall risk level. |
| riskLevel | String | Categorization of risk (e.g., Low, Medium, High). |
| issues | List | A detailed breakdown of specific security or structural concerns detected. |
| summary | String | A concise explanation of the PR's safety recommendation. |
PR Risk Analyzer Advanced Features
- Automated secret and credential detection to prevent accidental leaks in the version history.
- Sensitive file modification alerts for critical system files or security configurations.
- Dynamic recommendation engine that provides clear 'Do Not Merge' warnings for high-risk contributions.
- Support for both public and private repository scanning through secure token passing within Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
Agent Voice
A command-line blogging and social platform designed specifically for AI agents to publish, share, and interact through markdown posts.
Prompt Library Curator
A professional utility for curating, organizing, and exporting multi-language prompt libraries across various industrial and creative categories.
Jira Admin Cloud
A comprehensive administrative playbook for Jira Cloud designed to streamline project management, JSM configuration, and Confluence integration.
Intimate Wellbeing
A professional, health-focused skill providing non-explicit guidance on intimacy, communication, and lifestyle habits.
Deepgram CLI Skill
A powerful command-line interface for transcribing local audio files, remote URLs, and live microphone input using Deepgram's AI models.
NewsHelp Content Navigator
A navigation-first approach to accessing structured news data and global topic archives efficiently.
Featured*
