Feature/4 implement skill pr review

.github/copilot-instructions.md

@@ -4,14 +4,3 @@
 
 When reviewing a pull request, load and apply:
 https://github.com/AbsaOSS/agentic-toolkit/blob/master/skills/pr-review/SKILL.md
-
-### Skill-specific checks — apply when any `SKILL.md` is modified
-
-For every modified `SKILL.md`, also verify:
-- `name` is kebab-case, matches the directory name, and is ≤ 64 chars
-- `description` covers both "what it does" AND "when to trigger" with explicit trigger keywords
-- `description` is ≤ 1024 chars and not padded with filler
-- SKILL.md body is < 500 lines, or uses progressive disclosure via `references/`
-- No hardcoded credentials, secrets, or absolute internal paths in skill body or scripts
-- Any bundled script in `scripts/` is referenced from SKILL.md with clear usage guidance
-- The new or modified skill's description does not conflict with or shadow existing skills

README.md

@@ -77,6 +77,7 @@ its purpose, trigger phrases, and full instructions.
 
 | Skill                                                | Description                                                                                                                         |
 |------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------|
+| **[pr-review](./skills/pr-review/)**                 | Pull request code review — reviews diffs for risk, security issues, API contract changes, dependency bumps, CI/CD and infrastructure changes. Produces concise Blocker / Important / Nit comments. |
 | **[token-saving](./skills/token-saving/)**           | Always-active response discipline — enforces brevity, no filler openers or closers, structured output, and a What/Why/How footer on code responses. Suspends on explicit "full detail" requests. |
 
 ## Finding More Skills

docs/README.md

@@ -4,17 +4,18 @@ Navigation hub for all guides in this repository. Browse by category below.
 
 ## Setup & Repository Guides
 
-| Guide                                   | Description                                                                         |
-|-----------------------------------------|-------------------------------------------------------------------------------------|
-| [Getting Started](./getting-started.md) | What skills are, how to install them, Copilot CLI usage                             |
+| Guide | Description |
+|----|----|
+| [Getting Started](./getting-started.md) | What skills are, how to install them, Copilot CLI usage |
 | [Contributing](../CONTRIBUTING.md)  | Skill folder layout, frontmatter, description writing, body guidelines, PR process |
-| [Skill Testing](./skill-testing.md) | Eval creation, fixtures, regression loops, trigger and description optimization    |
-| [Troubleshooting](./troubleshooting.md) | Setup fixes for install, activation, and proxy issues                               |
+| [Skill Testing](./skill-testing.md) | Eval creation, fixtures, regression loops, trigger and description optimization |
+| [Troubleshooting](./troubleshooting.md) | Setup fixes for install, activation, and proxy issues |
 
 ## Skill Guides
 
-| Guide                               | Description                                                                        |
-|-------------------------------------|------------------------------------------------------------------------------------|
+| Guide | Description |
+|----|----|
+| [PR Review](./pr-review.md)             | How the PR review skill works, what sections it applies, and how to trigger it     |
 | [Token Saving](./token-saving.md)       | Keeping AI responses concise — how the token-saving skill works and when it applies |
 
 > **Keep this index up to date.** When you add a new guide, add a row to the appropriate table above.

docs/getting-started.md

@@ -131,8 +131,7 @@ Project skills take precedence over global skills when both exist.
 
 ### Add project-specific skills
 
-For skills that only apply to a specific repository, place them in `.github/skills/` within that repo. These are loaded
-automatically when Copilot CLI is launched from that directory, layered on top of your global skills.
+For skills that only apply to a specific repository, place them in `.github/skills/` within that repo. These are loaded automatically when Copilot CLI is launched from that directory, layered on top of your global skills.
 
 ```
 your-project-repo/

docs/pr-review.md

@@ -0,0 +1,102 @@
+# PR Review Skill
+
+The `pr-review` skill performs structured, risk-aware code review on pull requests and diffs. It activates automatically when you ask for PR feedback, share a diff, or ask for a sanity check on changes.
+
+---
+
+## What it does
+
+The skill reads the list of files changed in a PR, selects the relevant review sections, and produces a concise review grouped by severity:
+
+| Severity | Meaning |
+|----------|---------|
+| **Blocker** | Must be fixed before merge — correctness bug, security vulnerability, broken contract, credentials in code, data loss risk |
+| **Important** | Should be fixed soon — increases risk, missing tests for changed logic, non-default that's hard to change later |
+| **Nit** | Minor polish — style, naming, optional improvement, non-urgent edge case |
+
+If a section has no findings, the skill writes `_None._` to show it was checked, not skipped.
+
+---
+
+## Sections
+
+The skill always applies **Standard review** and selects additional sections based on the files the PR touches:
+
+| Section | Triggers when PR touches |
+|---|---|
+| Standard | Always applied |
+| API contracts | Endpoints, DTOs, config keys, env vars, exit codes, output strings |
+| Dependency bumps | `pom.xml`, `requirements.txt`, `pyproject.toml`, `package.json`, `*.csproj`, `go.mod`, `build.sbt` |
+| CI/CD | `.github/workflows/`, `Jenkinsfile`, `Justfile`, `Makefile` (pipeline), deployment jobs |
+| Infrastructure | `*.tf`, `*.tfvars`, CloudFormation, Helm, Dockerfiles, `docker-compose.yml`, `iac/`, `infra/` |
+| DB migrations | `alembic/`, `flyway/`, `liquibase/`, `migrations/`, `*.sql`, `db/` |
+| Skill definitions | `skills/*/SKILL.md`, any `SKILL.md` |
+| Elevated risk | Overlay — applied on top when PR touches auth/security controls, secrets management, or infrastructure/external integrations |
+
+A file may match multiple sections — all matching sections are applied.
+
+---
+
+## How to trigger it
+
+Ask for a review naturally — the skill fires on intent, not exact wording:
+
+```
+review my PR
+any issues with these changes?
+LGTM?
+does this look right?
+check this diff for risks
+can you review this before I merge?
+```
+
+You can also share a GitHub PR link directly:
+
+```
+https://github.com/org/repo/pull/123 — does this look safe to merge?
+```
+
+> **Does NOT trigger** for generative tasks on a diff: "generate release notes from this diff", "summarise this diff". Those are documentation tasks.
+
+---
+
+## Helpers
+
+The skill ships two scripts to speed up data gathering:
+
+| Script | Purpose |
+|--------|---------|
+| `scripts/fetch_pr.sh <PR_NUMBER>` | Fetches the diff and file list via `gh` |
+| `scripts/classify_sections.py /tmp/pr_files.txt` | Prints which sections to apply given a file list |
+
+These require the [GitHub CLI](https://cli.github.com/) (`gh`) to be authenticated.
+
+---
+
+## Overriding or scoping the review
+
+You can narrow or redirect the review with natural language:
+
+```
+focus only on security issues
+skip the nits — just blockers and importants
+review only the migration files
+```
+
+---
+
+## Installation
+
+The skill is installed along with the rest of the toolkit:
+
+```bash
+npx skills add https://github.com/AbsaOSS/agentic-toolkit -g
+```
+
+To install only this skill:
+
+```bash
+npx skills add https://github.com/AbsaOSS/agentic-toolkit -g --skill pr-review
+```
+
+See [Getting Started](./getting-started.md) for the full install guide.