PR Lens

The README says the Action passes the key to the CLI through the environment, sends the diff to the selected model, and notes that someone with a GitLab private-project attachment link can access it; this supports a score of 2 for data-flow transparency. The Action example grants contents: write and pull-requests: write, and the GitLab and Bitbucket setups require write-capable tokens, but the materials do not narrow these permissions or explain revocation, so least privilege scores 1. There is no general per-run confirmation or rollback guidance for posting or editing comments, so user confirmation scores 1, external effects 1, and rollback 0. Key handling is described, but full sensitive-data retention or hosted-service handling details are absent; there is also no dependency audit or mitigation evidence, so sensitive-data handling and dependency security each score 1. SECURITY.md provides a contact route, but the supplied materials do not verify publisher identity or external claim sources, so source attribution scores 1.

The README describes the App, Action, CLI, and configuration paths; the supplied Action test source also checks consistency among inputs, scripts, CLI versions, and comment ownership, supporting a self-consistency score of 2. Test source provides evidence about intended behavior, but the materials do not establish dependency availability or locking sufficiently, so that criterion scores 1. Action tests require publish-script retries and check that failure to look up the PR head produces a clear error; these are source-level failure-handling indicators, so failure messages score 2.

The README covers reviewers, coding agents, CI users, multiple forges, and workflows before and after a PR, so audience and scenarios score 3. Differences among the CLI, Action, and hosted service are described, including unavailable Action comment checkboxes, Bitbucket fork PR behavior, and GitLab private-attachment access limits, so capability boundaries score 2. Trigger examples are reasonably specific, including pull_request and GitLab merge-request rules, but the App's full event scope is not in the supplied materials, so trigger precision scores 2. Node requirements, platform setup, and provider choices are documented, so environment fit scores 3.

The README is organized by features, configuration, and operating modes and links to package documentation, but the supplied text ends at the package table, so information architecture scores 2. Setup steps, configuration examples, required keys, and permissions are detailed, so install notes score 3. Package names and commands are broadly consistent, but multiple packages and version labels appear without a complete release policy, so naming stability scores 2. The README gives practical examples and several common limitations, but no complete FAQ is visible, so examples and FAQ score 2. It explicitly documents fork, attachment-access, and platform limitations, earning 3 for known limitations. The MIT LICENSE file is complete, earning 3 for license. The root package is version 0.0.0 and examples use v0 and 0.1.0, but no changelog is supplied, so versioning and changelog score 1. SECURITY.md gives a vulnerability-report email and response commitment, but no maintainer roster or release-ownership process, so maintenance responsibility scores 2.

The README shows diagrams in comments, layered views, an interactive canvas, and guided walkthroughs; the CLI also offers validation and export flows, supporting an output-usability score of 3. Visualizing PR changes may reduce comprehension effort and examples cover large changes, but the evidence is mainly project-authored claims and showcase images, so marginal value scores 2. Free open-source use and multiple operating modes help users manage cost, while model calls, key management, and CI write permissions add practical cost or overhead, so cost-benefit scores 2.

The README maps feature descriptions to package docs, configuration references, and forge-specific examples, making some claims traceable; the linked files themselves are not included, so claim traceability scores 2. README claims are partly corroborated by Action, comment-script, and skill-mirror test source; cross-source corroboration scores 2. These tests are reviewed only as source evidence, with no claim that they were run. Descriptions, showcase images, and product-effect claims do not consistently distinguish implemented behavior from promotional inference, so fact-inference separation scores 1.