Skip to content
Back to skills

Bootstrap Repo Analysis

ASecurity

First-time analysis of a repository with no prior reviewer outcomes. Crawl historical merged-PR review feedback with the gh CLI (plus any preloaded samples), extract the team's review norms, and synthesize the initial per-repo review-style prompt. Use this for a cold-start repo; use continual-learning instead once the reviewer has accumulated finding outcomes.

  • 10,810 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added September 1, 2026
ai-agentsrustapi

Works with

  • cli
  • api

Security analysis

A100/100

Scanned September 1, 2026

npx -y skills add langchain-ai/open-swe --skill bootstrap-repo-analysis --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Bootstrap Repo Analysis?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Bootstrap Repo Analysis
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/langchain-ai-bootstrap-repo-analysis/badge)](https://www.skillsdirectory.com/skills/langchain-ai-bootstrap-repo-analysis)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: bootstrap-repo-analysis
description: First-time analysis of a repository with no prior reviewer outcomes. Crawl historical merged-PR review feedback with the gh CLI (plus any preloaded samples), extract the team's review norms, and synthesize the initial per-repo review-style prompt. Use this for a cold-start repo; use continual-learning instead once the reviewer has accumulated finding outcomes.
---

# Bootstrap repo analysis

You are writing the **first** review-style prompt for the repository named in the
system prompt. There is no outcomes history yet, so your signal comes entirely from
the repo's own historical PR review feedback. Do not call `read_finding_outcomes` in
this mode — it will be empty.

`gh` is already authenticated by the sandbox proxy — never run `gh auth login`.

## 1. Research (required)

Browse historical **merged** PR review feedback until you have catalogued at least
**8 substantive human** review comments (skip `[bot]` accounts and obvious automation
like codecov / dependabot). Useful commands:

```
gh pr list --repo <owner>/<repo> --state merged --limit 30
gh api repos/<owner>/<repo>/pulls/<PR_NUMBER>/reviews
gh api repos/<owner>/<repo>/pulls/<PR_NUMBER>/comments
gh api repos/<owner>/<repo>/issues/<PR_NUMBER>/comments
```

If the first batch is sparse, raise `--limit` or walk older PR numbers. The user
message may include **preloaded samples** — verify and extend them with `gh`, don't
just trust them.

Identify the top ~5 human reviewers by volume and note their phrasing, what severity
they assign, and what they routinely ignore.

## 2. Extract concrete, repo-specific patterns

The highest-value content is a **bug taxonomy tied to this repo's stack** — concrete
"hunt for X" rules a maintainer would catch on first read — plus a calibrated "do not
flag" list. Pair each pattern with the failure mode and, where you saw it, the kind of
diff that triggered it. Avoid generic advice that would apply to any repo.

Cover:
- What the team routinely flags vs. skips (paraphrased patterns, not invented quotes)
- Severity calibration tied to user-visible / runtime consequence
- Tone and test expectations
- Repo-specific conventions (frameworks, repository/data-access boundaries, naming)
- Anti-patterns the reviewers here deliberately avoid

Stay aligned with the reviewer-agent themes in the system prompt (high-signal,
diff-anchored defects — not nits).

## 3. Save

Only after real research, call `save_review_style_prompt` once with:
- `custom_prompt`: 400–1200 words teaching the reviewer this repo's norms.
- `analysis_summary`: 2–4 sentences for the dashboard.
- `top_reviewers` (comma-separated logins), `prs_sampled`, `reviews_sampled`.

Do **not** save a generic guide after one or two commands. Only after ~25+ merged PRs
with zero human feedback may you save a short, conservative guide — and say so in
`analysis_summary`.

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.