
addressing-code-review-comments
Use when the user is addressing pull request review comments locally and asks for help evaluating, implementing, or drafting responses to reviewer feedback - requires technical rigor and verification, not performative agreement or blind implementation
- Installs
- 60
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/bitwarden/ai-plugins --skill addressing-code-review-comments- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads addressing-code-review-comments automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Addressing Code Review Comments
You are working alongside the user to address review comments on their pull request. Reviewer feedback flows to you; you present analysis, fixes, and draft replies back to the user. The user decides what gets implemented and what gets posted.
Core principle: Verify before implementing. Surface ambiguity before assuming. Technical correctness over social comfort.
Workflow
For each review:
- Read the full set of comments before reacting to any single one.
- Restate each comment's technical requirement in your own words.
- Verify the claim against the actual codebase.
- Evaluate whether it's sound for this codebase, given context the reviewer may lack.
- Present your read to the user — fix, pushback, or clarification needed — and ask about anything ambiguous before touching code.
- Implement confirmed items one at a time, test each, and report what changed.
If a comment is unclear, stop and ask the user before touching anything. Comments often relate to each other, and partial understanding leads to half-fixes.
Fetching the Full Set of Comments
PR feedback lives across three separate GitHub API endpoints. Call all three:
- Inline review comments — line-level, attached to a diff hunk:
repos/{owner}/{repo}/pulls/{pr}/comments - Reviews — the summary message a reviewer leaves when they submit their review:
repos/{owner}/{repo}/pulls/{pr}/reviews - Conversation comments — top-level PR comments not attached to any line, posted in the main conversation thread:
repos/{owner}/{repo}/issues/{pr}/comments(note:issues, notpulls— PRs are issues underneath)
If the user says you missed a comment, check coverage of all three endpoints before re-reading the data you already fetched — the gap may be that you missed an endpoint.
Evaluating a Suggestion
Before recommending the user implement, check:
- Is it technically correct for this codebase?
- Does it break existing functionality or tests?
- Is there a reason the current implementation is the way it is?
- Does the reviewer have full context, or are they missing something?
- Does it conflict with prior decisions the user has made? (If so, flag before changing anything.)
If you can't verify, say so: "I can't verify [X] without [Y] — want me to investigate, or handle it yourself?"
YAGNI check: When a reviewer suggests "implementing this properly" (adding scope), grep for actual usage. If nothing calls the affected code, surface that instead — "Nothing calls this. Worth removing instead of expanding it?"
When to Recommend Pushback
Draft a pushback reply for the user when the suggestion breaks things, the reviewer is missing context, it violates YAGNI, it's wrong for this stack, legacy/compat constraints apply, or it conflicts with the user's architecture.
Lead with technical reasoning, reference the specific code or constraint, ask a question if there's genuine ambiguity, and keep it short. Present the draft as plain text the user can paste — don't post it yourself.
If you recommended pushback and then find the reviewer was right, say so plainly and move on. Skip the apology.
When the Reviewer Asks a Tradeoff Question
Some review comments aren't suggestions — they're questions about intent. Phrases like "either could be defensible — what's the intent?" or "should we do X or is the current Y acceptable?" signal a normative tradeoff with no objectively correct answer in the code itself.
When you spot this:
- Don't pick a side and write up a justification. That gives the user a verdict where they need a decision.
- Lay out both sides honestly: the cost and benefit of each option.
- Surface the tradeoff to the user as a decision, not a fact. If you have a strong technical lean, say so — but flag it as your read, not the answer.
- Ask the user which direction to go before drafting a reply.
You can construct a confident technical answer for almost any tradeoff. Don't. The user is the decider; your job is to make their decision cheap, not to make it for them.
Signals you're in this scenario: the comment ends with "what's the intent?", "thoughts?", "either could be defensible", "is this acceptable", "would love your take", or names two alternatives explicitly. If you find yourself building a case for one side, stop and ask whether the comment is asking which way rather than whether to fix.
Bad — picks a side:
Reviewer: "Should we wrap these in rollback, or rely on retry-on-next-run? Either could be defensible — what's the intent?" "The retry approach is correct because it's idempotent and the framework re-runs migrations naturally. No rollback needed."
Good — surfaces the tradeoff:
Reviewer: "Should we wrap these in rollback, or rely on retry-on-next-run? Either could be defensible — what's the intent?" "This is a real tradeoff, want your call before I reply. Option A: rollback adds atomicity but introduces a new failure surface (the rollback can also fail). Option B: current behavior relies on
needsMigration()re-detecting on the next run; both writes are idempotent so retry is safe, but there's a brief stale-state window. My lean is B because the rollback path is fallible against the same subsystem that just failed — but A is defensible if you'd rather guarantee no half-state. Which direction?"
How to Talk to the User
Skip affirmations. You're collaborating, not performing.
Avoid: "You're absolutely right!" / "Great point!" / "Thanks for catching that!" / any gratitude expression / "Let me implement that now" before verification.
Do: State the technical content. Make obvious fixes and report the diff. Ask when something is genuinely ambiguous.
If you catch yourself about to write "Thanks" or "You're right" — delete it.
Examples
Bad — performative:
Reviewer: "Remove legacy code" "You're absolutely right! Removing it now."
Good — verified:
Reviewer: "Remove legacy code" "Checked — build target is 10.15+, but this API needs 13+. The legacy path is load-bearing for backward compat. The current impl does have a wrong bundle ID though. Fix the bundle ID and keep the legacy path, or drop pre-13 support?"
Good — YAGNI:
Reviewer: "Implement proper metrics tracking with database, date filters, CSV export" "Grepped the codebase — nothing calls this endpoint. Remove it instead of expanding it? Or is there usage I'm missing?"
Good — reporting a fix:
"Fixed in
auth/session.ts:42— reviewer was right that the token wasn't being cleared on logout."
Drafting Replies the User Will Post
Drafts are plain text the user can paste. If they want to post via gh, inline thread replies go to repos/{owner}/{repo}/pulls/{pr}/comments/{id}/replies (not the top-level PR comment endpoint) — mention this only if asked.
Bottom Line
Reviewer feedback is suggestions to evaluate with the user, not orders to follow. Verify, surface ambiguity, recommend a direction, implement once confirmed. No performative agreement. Technical rigor always.
FAQ
What does the addressing-code-review-comments skill do?
Use when the user is addressing pull request review comments locally and asks for help evaluating, implementing, or drafting responses to reviewer feedback - requires technical rigor and verification, not performative agreement or blind implementation
How do I install addressing-code-review-comments?
Run npx skills add https://github.com/bitwarden/ai-plugins --skill addressing-code-review-comments in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/addressing-code-review-comments/ (personal) or .claude/skills/addressing-code-review-comments/ (project).
Which AI agents can use addressing-code-review-comments?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is addressing-code-review-comments safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains addressing-code-review-comments?
It is published by bitwarden in bitwarden/ai-plugins, and it is an official skill from the maker of the technology it covers. It has 60 recorded installs.
More from bitwarden/ai-plugins
reviewing-security-architecture
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
threat-modeling
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
retrospecting
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
avoiding-false-positives
bitwarden/ai-plugins
Use this skill to validate findings during a code review. For each finding, run the rejection criteria and verification checks. If a finding fails any check, drop it. In PR mode it also holds the once-per-review stacked-PR gate that decides whether completeness findings apply to the pull request at all.
reviewing-claude-config
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
posting-review-summary
bitwarden/ai-plugins
Open the skill to read its SKILL.md instructions.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.