Review for high-confidence findings only (prompt)

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/raw' -o ~/'.claude/skills/review-for-high-confidence-findings-prompt/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/files/LICENSE.txt' -o ~/'.claude/skills/review-for-high-confidence-findings-prompt/LICENSE.txt' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/files/NOTICE.txt' -o ~/'.claude/skills/review-for-high-confidence-findings-prompt/NOTICE.txt'

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/raw' -o '.cursor/skills/review-for-high-confidence-findings-prompt/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/files/LICENSE.txt' -o '.cursor/skills/review-for-high-confidence-findings-prompt/LICENSE.txt' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/files/NOTICE.txt' -o '.cursor/skills/review-for-high-confidence-findings-prompt/NOTICE.txt'

curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/raw' -o '.agents/skills/review-for-high-confidence-findings-prompt/SKILL.md' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/files/LICENSE.txt' -o '.agents/skills/review-for-high-confidence-findings-prompt/LICENSE.txt' && curl -fsSL --create-dirs 'https://theskillvault.ai/api/skills/review-for-high-confidence-findings-prompt/files/NOTICE.txt' -o '.agents/skills/review-for-high-confidence-findings-prompt/NOTICE.txt'

{
  "mcpServers": {
    "theskillvault": {
      "url": "https://theskillvault.ai/mcp"
    }
  }
}

Most AI reviews bury one real bug under twenty style notes. This prompt keeps only findings that a second check confirms. It reviews the exact pull request and commit you name, and it posts nothing until you say so.

When to use

• AI review comments on your PRs are mostly nitpicks, and people have stopped reading them.
• You want a last check for real bugs and broken project rules before you merge.
• A PR changed since the last review, and you want only the new head commit checked.

When not to use

• You want a broad review that also covers readability, performance and style. Use review-code-prompt.
• You are judging comments someone else left. Use respond-to-code-review-prompt.
• You want the PR fixed and pushed until CI is green. Use fix-ci-until-green.

Steps

1. Find the PR number and its head commit: gh pr view <number> --json number,headRefOid,state,isDraft.
2. Paste the prompt below into your AI coding tool. Fill in the PR number, the head SHA and your rules files.
3. Read the findings. Each one names the rule or the failing input and has passed a second check.
4. Say "post" only if you want the comments on GitHub. Otherwise keep them local.
5. After new commits, run it again with the new head SHA.

Prompt

Review pull request #<NUMBER> at head commit <HEAD_SHA>. Review only that PR and that commit, never "the latest open PR".

0. Eligibility. Stop and tell me why if the PR is closed, a draft, an automated or trivial change, or already reviewed by you at this same head SHA. A review of an older SHA does not count; review the new commits.
1. Context. Read the PR title and description for intent. List the project rules files that apply (CLAUDE.md, AGENTS.md, CONTRIBUTING.md, .cursor/rules), using only the root file and files in folders the PR touches.
2. Review in separate passes, each with no knowledge of the others:
   a. Rules pass: changes that break a quoted rule from a file that applies to that path.
   b. Bug pass (diff only): code that will not compile or parse, wrong imports, or logic that is wrong for every input.
   c. Bug pass (changed code): security holes and incorrect logic introduced by this PR.
3. Check every finding again on its own. Confirm the code really does what you claim, and that the rule really covers the file. Score your confidence 0-100.
4. Keep only findings scoring <THRESHOLD, default 80> or more. Drop: pre-existing problems, style or taste, issues a linter or type checker will catch, input-dependent maybes, and rules silenced in code on purpose.
5. Report: for each finding give file and line, what is wrong, why (rule quote or failing case), the score and a fix. Link code as https://github.com/<owner>/<repo>/blob/<HEAD_SHA>/<path>#L<start>-L<end>, with one line of context either side.
   If nothing passes, say "No issues found. Checked bugs and project rules at <HEAD_SHA>."
Do not post comments, approve or request changes. Ask me first.

How to adapt

• Too strict or too loose? Change the threshold in step 4. Try 70 on risky code and 90 on busy repos.
• Have a security or performance focus? Add one more pass in step 2 for it.
• Allowed to post? Reply "post one comment per finding with gh pr comment". Offer a suggestion block only when it fixes the whole issue.
• Not on GitHub? Replace the gh commands and link format with your host's.

Gotchas

• Separate passes find more than one long pass. Run them as subagents if your tool has them, or as fresh chats if not.
• "No issues found" is a real answer. Do not lower the threshold just to get findings.
• Never paste secrets or private customer data from the diff into a public comment.

Portability

Works with any language and any AI tool that can read the diff, such as Claude Code, Cursor, Codex or Copilot. Without gh, paste the diff, the PR description and the rules files into a chat.

Done when

• The review names the PR number and the head SHA it checked.
• Every reported finding has a reason, a score at or above the bar and a fix.
• Nothing was posted to the PR without your go-ahead.

Example prompt

"Review PR #412 at its head commit for real bugs only. Check each finding twice, drop nitpicks and anything below 80 confidence, and don't post anything yet."

---

Modified from the "code-review" command in anthropics/claude-plugins-official (plugin: code-review), by Anthropic. Licensed Apache-2.0 per the plugin LICENSE file at commit a7ba5b9. Original: https://github.com/anthropics/claude-plugins-official/blob/a7ba5b93db0c7c8d17f3f1d25853adca79598a1a/plugins/code-review/commands/code-review.md. Changes by TheSkillVault are listed in the metadata above and in NOTICE.txt. See LICENSE.txt.

Bundled files

• LICENSE.txt
• NOTICE.txt

Licence

Adapted from Anthropic (anthropics/claude-plugins-official, code-review plugin; the plugin README credits Boris Cherny, boris@anthropic.com; first commit by noahzweben) (Anthropic (the upstream LICENSE keeps the blank Apache template line 'Copyright [yyyy] [name of copyright owner]'; no other copyright notice at this commit). Apache License 2.0 text in LICENSE.txt, attributions in NOTICE.txt), Apache License 2.0. Modified by TheSkillVault on 2026-11-04: the model names (haiku, sonnet, opus), the tool allow-list, the inline-comment MCP tool and the Claude-specific checks were removed; the nine steps were rewritten as one copy-paste prompt that reviews the PR the user names (upstream issue #1700), pins and compares the head commit SHA so an old review does not block a re-review (#6026, #6931), makes the confidence bar adjustable (#3134) and asks before posting anything; added steps, adapt notes, gotchas and done-when. Not the original file.

Licence: Apache License 2.0. Attribution when you reuse it: Based on work by Anthropic (anthropics/claude-plugins-official, code-review plugin; the plugin README credits Boris Cherny, boris@anthropic.com; first commit by noahzweben) (Anthropic (the upstream LICENSE keeps the blank Apache template line 'Copyright [yyyy] [name of copyright owner]'; no other copyright notice at this commit). Apache License 2.0 text in LICENSE.txt, attributions in NOTICE.txt, Apache License 2.0), https://github.com/anthropics/claude-plugins-official/blob/a7ba5b93db0c7c8d17f3f1d25853adca79598a1a/plugins/code-review/commands/code-review.md; adapted by TheSkillVault, https://theskillvault.ai