# Nemoclaw Maintainer Security Code Review

Perform a requested security review of a NemoClaw PR or a PR linked to an issue.

- Repository: https://github.com/NVIDIA/NemoClaw (22910 stars)
- Category: Security
- License: Apache-2.0
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add NVIDIA/NemoClaw --skill nemoclaw-maintainer-security-code-review -g -a claude-code -y`
Codex: `npx skills add NVIDIA/NemoClaw --skill nemoclaw-maintainer-security-code-review -g -a codex -y`
Cursor: `npx skills add NVIDIA/NemoClaw --skill nemoclaw-maintainer-security-code-review -g -a cursor -y`
Gemini CLI: `npx skills add NVIDIA/NemoClaw --skill nemoclaw-maintainer-security-code-review -g -a gemini-cli -y`

## Description

Perform a requested security review of a NemoClaw PR or a PR linked to an issue. Use for vulnerability or trust-boundary assessment.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

<!-- SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved. -->
<!-- SPDX-License-Identifier: Apache-2.0 -->

# Security Code Review

Review the changes in a GitHub PR for security. An issue input must identify one open linked PR.
Report a verdict for each category.

## Prerequisites

- `gh` (GitHub CLI) must be installed and authenticated.
- `git` must be available.
- Network access to clone repositories and fetch PR metadata.

## Step 1: Parse the GitHub URL

If the user gives a PR or issue URL, extract the owner, repository, and number.
Otherwise, ask for the URL.

Supported URL formats:

- `https://github.com/OWNER/REPO/pull/NUMBER`
- `https://github.com/OWNER/REPO/issues/NUMBER`

For a PR URL, verify the number before Step 2:

```bash
gh pr view <number> --repo OWNER/REPO --json number,url
```

For an issue URL, list its open closing PRs:

```bash
gh issue view <number> --repo OWNER/REPO --json closedByPullRequestsReferences \
  --jq '.closedByPullRequestsReferences | map(select(.state == "OPEN")) | .[].number'
```

Continue only when this returns one PR number, and verify that number with `gh pr view`.
If it returns zero or more than one, stop and ask for the PR URL.
Use the verified PR number in each later command.

## Step 2: Check Out the Code

Compare `gh repo view --json nameWithOwner -q .nameWithOwner` with the URL.
If the repositories match, check out the verified PR:

```bash
gh pr checkout <number>
```

If the repositories do not match, clone the target to a temporary directory:

```bash
REVIEW_DIR=$(mktemp -d)
gh repo clone OWNER/REPO "$REVIEW_DIR"
cd "$REVIEW_DIR"
gh pr checkout <number>
```

## Step 3: Identify Changed Files

List all files changed from the base branch:

```bash
git diff main...HEAD --name-status
```

If the PR targets another branch, use that branch as the base. Check it with:

```bash
gh pr view <number> --json baseRefName -q .baseRefName
```

## Step 4: Read Each Changed File and Diff

The rest: https://github.com/NVIDIA/NemoClaw/blob/HEAD/.agents/skills/nemoclaw-maintainer-security-code-review/SKILL.md