feat(skills): add project-agnostic review pipeline skills

[breadoncee]

Summary

• Adds create-handoff skill: generates structured handoff docs summarizing implementation work, with auto-detected build system checks (Node, Rust, Go, Python, Make)
• Adds create-review skill: bootstraps a local AI review pipeline (scripts + templates) and generates paste-ready review prompts for any provider (Codex, Gemini, GPT, Claude, or custom)
• Adds fix-review skill: fetches GitHub PR review comments via gh CLI and applies fixes with severity-based prioritization

Test plan

• Run scripts/validate-skills.sh — all 10 skills pass
• Verify frontmatter compliance for all three new skills
• Test create-handoff in a sample project with uncommitted changes
• Test create-review bootstrap (first run) and re-run (script refresh, template preservation)
• Test create-review codex and create-review gemini for provider-specific prompts
• Test fix-review on a PR with bot review comments

🤖 Generated with Claude Code

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the project's review capabilities by introducing three new, project-agnostic skills. These additions automate key stages of the development and review process, from generating comprehensive handoff documentation and setting up AI-powered code review prompts to intelligently applying fixes based on GitHub PR feedback. The overall aim is to streamline the review workflow, improve consistency, and reduce manual effort for developers.

Highlights

• Handoff Document Generation: Introduced the "create-handoff" skill, which automates the creation of structured handoff documents summarizing implementation work, including auto-detection and execution of build system checks for Node, Rust, Go, Python, and Make projects.
• AI Review Pipeline Setup: Added the "create-review" skill, designed to bootstrap a local AI review pipeline by generating necessary scripts and templates, and producing paste-ready review prompts compatible with various AI providers like Codex, Gemini, GPT, and Claude.
• Automated PR Comment Fixing: Implemented the "fix-review" skill, which fetches GitHub PR review comments using the "gh" CLI and intelligently applies fixes to the local codebase, prioritizing comments based on severity markers.

Changelog

• skills/create-handoff/SKILL.md
  • Added the documentation and definition for the "create-handoff" skill.
• skills/create-review/SKILL.md
  • Added the documentation and definition for the "create-review" skill, including scripts and templates for AI review prompts.
• skills/fix-review/SKILL.md
  • Added the documentation and definition for the "fix-review" skill, detailing how to fetch and apply GitHub PR comments.
• skills/skills-index.yaml
  • Registered the new "create-handoff", "create-review", and "fix-review" skills in the main skills index.

Activity

• The pull request was generated using Claude Code, indicating an automated initial draft or significant assistance from an AI tool.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces three new skills: create-handoff, create-review, and fix-review, which together build a project-agnostic review pipeline. While the overall design is sound, there are significant security concerns. The create-review skill lacks sanitization for the reviewer name, potentially leading to path traversal or command injection. More critically, the fix-review skill is vulnerable to indirect prompt injection, as it automatically applies code fixes based on external GitHub review comments without mandatory user confirmation. Additionally, in create-handoff, there's an issue with using a kebab-case name as a shell variable, and in create-review, a minor change to git commands is suggested for better clarity and consistency. Addressing the security vulnerabilities by adding sanitization and requiring user approval for automated fixes is essential.