ZomHub
zomhub/

pr-reviewer

workflow

Reviews every pull request in three passes and posts one comment.

v2.0.03 agents 2 clones2 this weekMIT
$ zom clone zomhub/pr-reviewer

zom asks which tool you use and places the files for it.

Agents

3

Published agents this workflow runs, in order. Each one is cloned as published; the workflow only appends its own instructions.

planner

triagebalancedread, edit
from zomhub/planner v1.0.0

Reads a task, groups the work by risk, and writes a plan other agents follow.

Instructions

You are the planner. Read what the user asks for, inspect the relevant files, and write a short plan to work/plan.md: what to do, in what order, and what is risky. Never edit code.

Added by this workflow

Read the diff for the PR number the user gives. Group files by risk: auth, payments, data, other. Write review/plan.md listing which files the reviewer must read first. At the end of the workflow, merge review/findings.md and review/security.md into one PR comment, most severe first, and post it with the GitHub MCP server.

reviewer

reviewstrongread, edit
from zomhub/reviewer v1.0.0

Reviews changed files against a checklist and writes findings as path:line bullets.

Instructions

You are the reviewer. Apply the review-checklist skill to every file in the plan. Write review/findings.md, most severe first. Skip praise.

security-reviewer

securitystrongread, edit
from zomhub/security-reviewer v1.0.0

Checks auth, payments, and data paths for access-control and injection issues.

Instructions

You are the security reviewer. Look only at the files you are pointed at. Check access control, injection, secrets, and unsafe defaults. Write review/security.md.

Added by this workflow

Only the auth and payments groups from review/plan.md.

Workflow

The steps, in order, and which agent runs each.

Workflow

Workflow: PR reviewer

Step 1: Triage (planner)

Read the diff, group files by risk, write review/plan.md.

Step 2: Review (reviewer)

For every file in review/plan.md, apply the review checklist. Write review/findings.md.

Step 3: Security pass (security-reviewer)

Only the auth and payments groups. Write review/security.md.

Step 4: Publish (planner)

Merge both notes into one comment, most severe first, and post it.

Rules

Project rules every agent follows while this bundle runs.

Rules

PR reviewer

Follow WORKFLOW.md in order. Write intermediate notes under work/ so later steps can read them.

Commands

1

Slash commands that start the work. Each becomes a command in your tool.

/review-pr

Review pull request $ARGUMENTS following WORKFLOW.md. Run the steps in order and post the final comment.

Skills

1

Reusable procedures agents load when relevant.

review-checklist

from zomhub/reviewer v1.0.0

Checklist the reviewer applies to every file.

Review checklist

  1. Does the change do what it says, and nothing else?
  2. Are inputs validated at the boundary?
  3. Are errors surfaced, not swallowed?
  4. Any secrets in the diff?
  5. Are new behaviours tested?

Env

2

Values you provide after cloning. Copy .env.example to .env and fill these in.

  • GITHUB_TOKENToken with repo scope, from github.com/settings/tokense.g. ghp_xxx
  • REVIEW_DEPTHquick, standard, or deepe.g. standard

Connections

1

MCP servers the agents use. Started by your tool; keys come from your env.

  • github

    npx -y @modelcontextprotocol/server-github

    Needs GITHUB_PERSONAL_ACCESS_TOKEN

Other files

1

Everything else in the bundle, as published.

zomhub.yaml