All skills & plugins / Awesome Copilot plugins (GitHub)

pr-review

Review GitHub pull requests in a read-only canvas with AI-grouped changes, expandable diffs, and questions scoped to groups, files, or hunks.

Type: Plugin by Awesome Copilot Community
Catalog: Awesome Copilot plugins (GitHub)
Source: github/awesome-copilot/plugins/pr-review (13 files scanned)
Install and details: Agent Skills Index entry
License: MIT (manifest)
Signals: Bundled scriptsNetwork calls in codeReads credentialsSpawns processes

Pre-approved tools

No allowed-tools or tools list in its SKILL.md, command or agent files, so the agent asks before using tools as usual.

Hooks

No hooks.

MCP servers and apps

None.

Bundled code

7 code files (JavaScript):

Network calls

2 files with a network call pattern. First match per file:

extensions/pr-review/review.test.mjs:171

assert.equal((await fetch(endpoint.origin + "/state")).status, 404);

extensions/pr-review/client.js:74

const response = await fetch(route, options);

Starts other programs

3 files. First match per file:

extensions/pr-review/review.mjs:32

const match = /^\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/([1-9][0-9]*)(?:\/(?:files|commits|checks))?\/?$/.exec(url.pathname);

extensions/pr-review/github.mjs:1

import { execFile } from "node:child_process";

extensions/pr-review/client.js:259

const match = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(lines[0]);

Credentials referenced

GH_TOKENGITHUB_TOKEN

Static scan of commit d75b418 on 2026-10-27. Signals are patterns found in the files, not a verdict: a network call can be the whole point of a skill. Read the linked lines before you decide. How the scan works.