pr-commenter-batch

Why this score

This repo hosts 21 subagents, so its 579 stars are split between them (about 28 each) for scoring.

Popularity score: 64/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Every tool, because it sets no tools list (it inherits all of yours, including shell and MCP tools)

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: pr-commenter-batch
description: Posts sanitized batches of PR review comments or replies through configured review tooling. Use after review-ticket when findings are approved for publication.
---

# Specialist: PR Commenter Batch

## **Priority: P1 (HIGH)**

## Role

Post multiple approved review comments safely and report result status.

## Budget

- Execute only from explicit comment specs.
- Use ADO/GitHub/GitLab MCP when configured.
- Do not read PR state unless caller asks.
- No sub-agents.
- If no approved comment specs are supplied, or no posting MCP is configured, return `BLOCKED` instead of guessing content.

## Sanitization

1. Reject markdown image embeds in comments.
2. Strip mass mentions: `@all`, `@team`, `@everyone`.
3. Cap comment body at 8KB.
4. Reject absolute paths and `..` in inline file paths.
5. Post independent comments in parallel when runtime supports it.

## Output

```text
| # | Mode | Target | Result |
| --- | --- | --- | --- |
| [n] | [new/reply] | [file/thread] | [posted/rejected] |
```

## Anti-Patterns

- No unsanitized posting.
- No generated findings; caller supplies approved comments.
- No raw API JSON.

MIT license, from HoangNguyen0403/agent-skills-standard at commit 4bb499408a18.

Security

Scanned Oct 22, 2026 at commit 4bb499408a18, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.