Most "use AI to review your PR" content tells you to paste the diff into ChatGPT and ask for feedback. That works for tiny PRs and produces generic prose for anything larger. Real review needs structure.
The pattern below is what I use daily. It runs the same way every time because it's a Claude Code skill — not a freehand prompt.
A useful PR review isn't one pass. It's seven passes, in order, each with a specific question:
- Intent drift. Does the diff match the PR description? For every changed file, ask: is this file's change explainable by the stated goal? Flag files that seem unrelated.
- Logic correctness. Walk every non-trivial branch. For each conditional, what input reaches the other branch? For each loop, what terminates it? For each error path, what state is left behind?
- Test gaps. For every added/changed public function, is there a test? For every new error path, is it triggered by a test?
- Security. OWASP top-10 class scan — unescaped user input, missing authz on new endpoints, secrets in code, permissive CORS, SSRF, insecure deserialization.
- Performance. N+1 queries, blocking sync work on request path, unbounded accumulators, regex compile in hot loops.
- API surface. Is this a breaking change? Does the deprecation path exist?
- Rollback safety. Can this PR be reverted cleanly? Migrations with no down step? Feature flags without a kill switch?
The problem isn't Claude vs GPT. The problem is: a one-shot prompt drifts. You paste "review this PR for me," the model does a surface pass, maybe hits three of the seven lenses, produces prose you skim. You have no way to know what got skipped.
A review skill with ordered lens definitions can't skip a lens silently. Each lens has explicit "refuses to" constraints — approve without citing 3+ verified items, ship generic "looks good to me" output, speculate about files outside the diff. The enforcement is in the skill definition, not your willpower.
Every finding looks like:
- [severity] file:line — one-sentence finding + suggested action
Severities: blocker, major, minor, nit. End with a verdict line: APPROVE, APPROVE with comments, REQUEST CHANGES, or BLOCK.
Structured output is what makes the review greppable. You can pipe it into a CI comment, auto-file issues for each finding, track which types of findings your team hits most. Free-text review is a dead-end artifact; structured review is data.
I've open-sourced 3 skills in a public repo: septimlabs-code/septim-drills-samples. It includes the PR review skill's simpler cousins (readme-sync, commit-quality, launch-post-hn). Install:
git clone https://github.com/septimlabs-code/septim-drills-samples.git
cp -r septim-drills-samples/skills/* ~/.claude/skills/The comprehensive PR review skill (pr-review-comprehensive) is in the full pack alongside 24 other production skills — test-gaps, migration-safety, security-triage, performance-smell, refactor-extract, type-tighten, env-audit, changelog-bot, postmortem-draft, and more. Five skills per lane across Review / Refactor / Documentation / Ops / Launch.
$29 lifetime at septimlabs.vercel.app/drills. Private repo, updates forever.
Tonight only: Bundle with Vault (browser-based dev-secret vault) for $39 — saves $19 vs separate — septimlabs.vercel.app/tonight. Expires midnight ET.
Shared by Septim Labs — April 20, 2026