feat: Add AI PR Code Reviewer Kit #313
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # AI PR Code Reviewer & Security Auditor | ||
|
|
||
| An agentic workflow built on **Lamatic.ai AgentKit** designed to automate Pull Request reviews. This agent acts as a first line of defense in CI/CD pipelines by analyzing code snippets or git diffs for security vulnerabilities and performance improvements. | ||
|
|
||
| ## The Problem | ||
| Manual code reviews are time-consuming, and senior engineers often waste hours pointing out basic linting errors or missing security checks. | ||
|
|
||
| ## The Solution (This Agent) | ||
| By integrating this AgentKit flow into a webhook or CI pipeline, development teams get instant, structured feedback on their code before a human ever looks at it. | ||
|
|
||
| ## Features | ||
| - **Security Audit:** Flags OWASP top 10 vulnerabilities (e.g., SQL injection, hardcoded secrets). | ||
| - **Code Optimization:** Suggests specific refactors for time/space complexity. | ||
| - **Structured JSON Output:** Returns actionable data that can be parsed directly into GitHub PR comments. | ||
|
|
||
| ## Workflow Structure | ||
| 1. **Trigger:** Receives raw code or a git diff. | ||
| 2. **Review Node (LLM):** A highly constrained prompt evaluates the code against strict engineering standards. | ||
| 3. **Formatting Node:** Outputs a structured JSON payload with `vulnerabilities`, `refactor_suggestions`, and a `pass_fail` boolean. | ||
|
Comment on lines
+3
to
+19
Contributor
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win Mission requirement: add a human-readable setup guide. This README describes the purpose and workflow but does not explain how to install, register, configure, invoke, or consume the kit. Add a As per coding guidelines, each 🧰 Tools🪛 markdownlint-cli2 (0.23.1)[warning] 5-5: Headings should be surrounded by blank lines (MD022, blanks-around-headings) [warning] 8-8: Headings should be surrounded by blank lines (MD022, blanks-around-headings) [warning] 11-11: Headings should be surrounded by blank lines (MD022, blanks-around-headings) [warning] 16-16: Headings should be surrounded by blank lines (MD022, blanks-around-headings) 🤖 Prompt for AI AgentsSource: Coding guidelines |
||
| Original file line number | Diff line number | Diff line change | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,2 @@ | ||||||||||||
| # AI PR Code Reviewer | ||||||||||||
| This agent automatically reviews code for security vulnerabilities and performance bottlenecks, acting as a first line of defense in your CI/CD pipeline. | ||||||||||||
|
Comment on lines
+1
to
+2
Contributor
There was a problem hiding this comment. 📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win Mission requirement: add the missing blank line. Insert one blank line after the Proposed fix # AI PR Code Reviewer
+
This agent automatically reviews code for security vulnerabilities and performance bottlenecks, acting as a first line of defense in your CI/CD pipeline.📝 Committable suggestion
Suggested change
🧰 Tools🪛 markdownlint-cli2 (0.23.1)[warning] 1-1: Headings should be surrounded by blank lines (MD022, blanks-around-headings) 🤖 Prompt for AI AgentsSource: Linters/SAST tools
Contributor
There was a problem hiding this comment. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '%s\n' '--- changed files ---'
git diff --name-status "$(git merge-base HEAD origin/main)" HEAD 2>/dev/null || git diff --name-status HEAD~1 HEAD
printf '%s\n' '--- kit file structure ---'
fd . kits/ai-pr-reviewer --type f 2>/dev/null | sort
printf '%s\n' '--- agent.md with line numbers ---'
nl -ba kits/ai-pr-reviewer/agent.md
printf '%s\n' '--- configuration and flow ---'
for f in kits/ai-pr-reviewer/lamatic.config.ts kits/ai-pr-reviewer/flows/code-review.json kits/ai-pr-reviewer/README.md kits/ai-pr-reviewer/constitutions/default.md; do
if [ -f "$f" ]; then
echo "### $f"
nl -ba "$f"
fi
done
printf '%s\n' '--- markdownlint configuration ---'
fd -HI 'markdownlint*' . --max-depth 3 --type f -x sh -c 'echo "### $1"; cat "$1"' sh {} \;Length of output: 1603 🏁 Script executed: #!/bin/bash
set -euo pipefail
print_file() {
file="$1"
if [ -f "$file" ]; then
printf '\n### %s\n' "$file"
awk '{ printf "%6d %s\n", NR, $0 }' "$file"
fi
}
print_file kits/ai-pr-reviewer/agent.md
print_file kits/ai-pr-reviewer/lamatic.config.ts
print_file kits/ai-pr-reviewer/flows/code-review.ts
print_file kits/ai-pr-reviewer/README.md
print_file kits/ai-pr-reviewer/constitutions/default.md
printf '\n--- relevant repository examples ---\n'
find kits -path '*/flows/*.ts' -type f -print | head -20 | while IFS= read -r file; do
printf '\n### %s\n' "$file"
sed -n '1,160p' "$file"
done
printf '\n--- Markdown lint configuration ---\n'
find . -maxdepth 3 -type f \( -iname '*markdownlint*' -o -name '.remarkrc*' \) -print | while IFS= read -r file; do
printf '\n### %s\n' "$file"
sed -n '1,200p' "$file"
doneLength of output: 161730
Findings
You are interacting with an AI system. |
||||||||||||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| # Default Constitution | ||
| 1. Always prioritize identifying security vulnerabilities. | ||
| 2. Provide specific, actionable refactoring suggestions. | ||
| 3. Be polite and concise in GitHub PR comments. |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| export default { | ||
| "name": "Automated Code Review Flow", | ||
| "description": "Analyzes input code snippets for security vulnerabilities and optimization opportunities.", | ||
| "nodes": [ | ||
|
Comment on lines
+1
to
+4
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Mission requirement: add the required self-contained flow sections. The export defines As per coding guidelines, each 🤖 Prompt for AI AgentsSource: Coding guidelines |
||
| { | ||
| "id": "input_code", | ||
| "type": "trigger", | ||
| "label": "Code Snippet Input", | ||
| "config": { | ||
| "inputType": "text", | ||
| "placeholder": "Paste your code snippet or git diff here..." | ||
| } | ||
| }, | ||
| { | ||
| "id": "llm_auditor", | ||
| "type": "llm", | ||
| "label": "DevSecOps LLM", | ||
| "config": { | ||
| "model": "gpt-4o", | ||
| "temperature": 0.1, | ||
| "systemPrompt": "You are a Principal Security Engineer and strict code reviewer. Analyze the provided code. Output a JSON object containing: 1) 'pass_fail' (boolean), 2) 'vulnerabilities' (array of strings, empty if none), 3) 'optimizations' (array of specific refactoring suggestions), and 4) 'pr_comment' (a polite markdown summary of your review ready for GitHub)." | ||
|
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Align the flow fields with the documented response contract. The Based on the supplied flow and README, the response field names are inconsistent. 🤖 Prompt for AI Agents🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win Keep one response schema across the flow and README. The flow and README define different JSON keys for the same response contract. The flow requires
Based on the supplied flow and README, the response contract must be identical at both sites. 📍 Affects 2 files
🤖 Prompt for AI Agents🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== locate flow file =="
fd -a 'code-review\.json$' . || true
echo "== inspect target file =="
if [ -f kits/ai-pr-reviewer/flows/code-review.json ]; then
cat -n kits/ai-pr-reviewer/flows/code-review.json
fi
echo "== search for code-review pass_fail usage =="
rg -n "code-review|pass_fail|vulnerabilities|strict code reviewer|systemPrompt" . || true
echo "== inspect kit package metadata =="
fd -a . kits/ai-pr-reviewer | head -50
[ -f kits/ai-pr-reviewer/package.json ] && cat -n kits/ai-pr-reviewer/package.json
[ -f kits/ai-pr-reviewer/README.md ] && cat -n kits/ai-pr-reviewer/README.mdRepository: Lamatic/AgentKit Length of output: 35442 Define the The LLM is asked for a 🤖 Prompt for AI Agents |
||
| } | ||
| }, | ||
| { | ||
| "id": "output_report", | ||
| "type": "response", | ||
| "label": "CI/CD JSON Response", | ||
| "config": { | ||
| "format": "json" | ||
| } | ||
|
Comment on lines
+25
to
+30
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
rg -n -C 10 '"type": "(llm|response)"|format": "json"|schema|response_format|structured' kits --glob '*.json'Repository: Lamatic/AgentKit Length of output: 50373 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== target file =="
wc -l kits/ai-pr-reviewer/flows/code-review.json
cat -n kits/ai-pr-reviewer/flows/code-review.json | sed -n '1,80p'
echo
echo "== focused response/json/schema occurrences in kits/ai-pr-reviewer =="
rg -n -C 6 '"id": "output_report"|"type": "response"|"format": "json"|schema|jsonOutput|parse_json|json' kits/ai-pr-reviewer --glob '*.json' --glob '*.ts' --glob '*.js' || true
echo
echo "== candidates for response node implementation =="
rg -n 'registerNode|type.*response|format[": ]+.json|json-format|parse.*json|response_format|structured' kits/ai-pr-reviewer packages core src --glob '*.ts' --glob '*.js' --glob '*.tsx' --glob '*.jsx' || trueRepository: Lamatic/AgentKit Length of output: 3505 🌐 Web query:
💡 Result: In the Lamatic ecosystem, there is no single monolithic "response node schema validation" format. Instead, validation is handled through specific nodes and configuration practices depending on whether you are working with flow-level response definitions or agent-level structured data generation [1][2]. 1. Flow Response Node: The responseNode in a flow configuration does not typically enforce a strict JSON schema validation at the node level itself [1]. Instead, it uses an outputMapping block within the node configuration to aggregate data from previous nodes [1]. This mapping uses a dictionary of key-value pairs where you can structure your final response by referencing outputs from earlier nodes (e.g., "{{LLMNode_187.output.generatedResponse}}") [1]. 2. Structured Data Generation: If you require strict JSON schema validation, you should use the Generate JSON Node [2][3]. This node is specifically designed to enforce a fixed output shape [3]. It allows you to define an Output Schema using Zod JSON, which the AI model then uses to generate structured JSON data that conforms to your specified rules [2]. 3. AgentKit Validation: If you are referring to validating AgentKit contributions or configurations, this is handled by external tools rather than a runtime response node [4]. The Citations:
Mission requirement: enforce the CI JSON shape before emitting output.
🤖 Prompt for AI Agents |
||
| } | ||
| ], | ||
| "edges": [ | ||
| { "source": "input_code", "target": "llm_auditor" }, | ||
| { "source": "llm_auditor", "target": "output_report" } | ||
| ] | ||
| }; | ||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,12 @@ | ||
| export default { | ||
| id: "ai-pr-reviewer", | ||
| name: "AI PR Code Reviewer & Security Auditor", | ||
| description: "An automated agent that analyzes git diffs or code snippets for security vulnerabilities, performance bottlenecks, and clean-code refactoring.", | ||
| type: "template", | ||
| author: "Sushobhita Majhi", | ||
| category: "Developer Tools / CI-CD", | ||
| tags: ["LLM", "Code Review", "DevSecOps", "Agentic Workflow"], | ||
| links: { | ||
| github: "kits/ai-pr-reviewer" | ||
| } | ||
| }; | ||
|
Comment on lines
+1
to
+12
Contributor
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== locate configs =="
git ls-files 'kits/*/lamatic.config.ts' | sed -n '1,80p'
echo
echo "== targeted configs =="
for f in kits/ai-pr-reviewer/lamatic.config.ts kits/sentinel-iq/lamatic.config.ts; do
if [ -f "$f" ]; then
echo "--- $f ---"
cat -n "$f"
fi
done
echo
echo "== files in ai-pr-reviewer =="
git ls-files kits/ai-pr-reviewer | sed -n '1,120p'
echo
echo "== schema/metadata references for kit config fields =="
rg -n "lamatic\.config|type: \"template\"|type: \"kit\"|author|steps|links" -S --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' . | sed -n '1,220p'Repository: Lamatic/AgentKit Length of output: 15738 🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== flow id =="
python3 - <<'PY'
import json
from pathlib import Path
p = Path('kits/ai-pr-reviewer/flows/code-review.json')
if p.exists():
data = json.loads(p.read_text())
print("file:", p)
for key in ["name", "id", "type", "title", "steps"]:
print(f"{key}:", repr(data.get(key)))
PY
echo
echo "== lamatic.config metadata docs =="
sed -n '85,125p' CLAUDE.md
echo
echo "== registry entries for ai-pr-reviewer =="
python3 - <<'PY'
import json
from pathlib import Path
p = Path('registry.json')
if p.exists():
data = json.loads(p.read_text())
if isinstance(data, list):
entries = [e for e in data if e.get('id') == 'ai-pr-reviewer' or e.get('name') == 'AI PR Code Reviewer & Security Auditor']
else:
entries = []
print("match_count:", len(entries))
for e in entries[:5]:
print(json.dumps({k:e.get(k) for k in sorted(e.keys()) if k in {'id','name','type','author','steps','links'}}, indent=2))
PY
echo
echo "== occurrences of ai-pr-reviewer =="
rg -n "ai-pr-reviewer|AI PR Code Reviewer" -S --glob '!node_modules/**' --glob '!dist/**' --glob '!build/**' . | sed -n '1,120p'Repository: Lamatic/AgentKit Length of output: 1880 Mission: register the code-review flow in kit metadata.
🤖 Prompt for AI AgentsSource: Coding guidelines |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Fix the Markdown heading spacing.
Insert one blank line after the headings at Line 5, Line 8, Line 11, and Line 16.
markdownlint-cli2reports MD022 for each location, which can fail documentation checks.Based on the supplied static-analysis report, these four MD022 violations require correction.
Also applies to: 8-9, 11-12, 16-17
🧰 Tools
🪛 markdownlint-cli2 (0.23.1)
[warning] 5-5: Headings should be surrounded by blank lines
Expected: 1; Actual: 0; Below
(MD022, blanks-around-headings)
🤖 Prompt for AI Agents
Source: Linters/SAST tools