pr-review-canvas
An agent skill by cursor, from cursor/plugins. Tags: code-review, github, review, ui, visualization.
What it does
Generate an interactive PR review walkthrough as an HTML page. Fetches PR data via gh API, categorizes files into core vs mechanical changes, adds reviewer annotations, and renders diffs with moved-code detection. Use when the user pastes a GitHub PR URL and asks for a review, walkthrough, or summary, or says "review this PR".
Install
With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:
npx skills add cursor/plugins --skill pr-review-canvasOr copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):
git clone --depth 1 https://github.com/cursor/plugins
cp -r plugins/cursor-team-kit/skills/pr-review-canvas ~/.claude/skills/pr-review-canvasSafety box score
Grade C, moderate risk: 28 of 100 risk points, rated 2026-09-29. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.
This skill fetches GitHub PR metadata, comments, and diffs through the `gh` CLI, then generates a local HTML review page and serves it from `127.0.0.1`. The main risks are authenticated network access to GitHub, shell/Python execution of the assembled workflow, and handling private PR content through your logged-in GitHub session.
| Category | Level | Why |
|---|---|---|
| Code & shell execution | 2 (moderate) | It explicitly runs shell commands (`gh api ...`) and a Python assembly step, plus a local `python3 -m http.server`; that is real command execution, though scoped to the review workflow. |
| Network access | 2 (moderate) | The skill fetches PR data, files, and comments from GitHub via `gh api repos/{owner}/{repo}/pulls/{number}` and related endpoints, sending authenticated requests to GitHub. |
| Filesystem reach | 1 (low) | It writes body HTML, patch JSON, and the final page under `/tmp/pr-review-{number}*` and serves from `/tmp`; there is no instruction to modify project files or system locations. |
| Secrets & credentials | 2 (moderate) | It depends on your authenticated `gh` session and can read private PR content/comments through that login, but it does not directly ask for passwords, tokens, or `.env` files. |
| Privilege & persistence | 0 (none) | There is no sudo, global install, service registration, shell startup editing, or other privilege change in the workflow. |
| Instruction hijack surface | 0 (none) | I did not find instructions to ignore safeguards, follow remote instructions, hide actions, or otherwise override the agent’s policy; the remote data is only PR content from GitHub. |
| Irreversible actions | 0 (none) | The skill generates a review page and serves it locally; it does not post, merge, deploy, pay, or delete anything on its own. |
| Transparency | 0 (none) | All shipped files are plain text (`SKILL.md`, `template.html`, `styles.css`, `renderer.js`); there are no binaries, packed payloads, or unpinned external installers. |
Before installing
- Run `gh auth status` and confirm the account/scopes are the ones you want the skill to use.
- Inspect `SKILL.md` for the `/tmp` paths and the `python3 -m http.server 8432` step so you know where artifacts will be written and served.
- Try it first on a non-sensitive PR to confirm the authenticated GitHub requests and local HTML generation behave as expected.
Rated 2026-09-29 by an automated review of 4 files from the skill's repository.
Source
- Repository
- cursor/plugins (all skills from this repository)
- Path
- cursor-team-kit/skills/pr-review-canvas/SKILL.md
- Branch
- main
- Collection
- cursor
- Updated
- 2026-09-23
Related skills
- make-pr-easy-to-review — Prepare PRs for review by cleaning noisy history, improving PR descriptions, and adding reviewer guidance without changing code behavior.
- analyzing-release-readiness — Trigger a pre-merge release readiness review on a GitHub PR, GitLab MR, or local branch.
- code-review — Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes.
- github-review-pr — Reviews or re-reviews one contributor pull request—including an explicitly named closed PR being reconsidered—or a bounded newest-to-oldest sweep of all open.
- get-pr-comments — Fetch and summarize review comments from the active pull request
- interrogate — Use for "interrogate", "adversarial review", "multi-model review", "challenge this", "stress test this code", "find blind spots", or "tear this apart".