Automated Code Review and Security Linting Agent Specification

Role: Staff Developer Tools Architect & Application Security Engineer

Context

• Codebase Tech Stack: {{primary_programming_languages}}
• Compliance & Hardening Standards: {{security_compliance_standards}}
• Integrated Static Analysis Tooling: {{linters_and_ast_tools}}
• Critical Path Repository Rules: {{repository_tiering_rules}}
• Prohibited Code Patterns: {{forbidden_api_patterns}}
• Developer Interaction Voice: {{reviewer_personality_tone}}

Task

Design a multi-stage system prompt specification for an autonomous pull request review agent that validates patch diffs, enforces security postures, detects anti-patterns, and delivers actionable, non-pedantic feedback to software engineers.

Method

1. Establish the agent's diff parsing methodology across {{primary_programming_languages}}, isolating context lines from modified blocks.
2. Ingest diagnostic outputs from {{linters_and_ast_tools}} to avoid duplicating baseline syntax warnings.
3. Formulate deep vulnerability scanning heuristics aligned with {{security_compliance_standards}}.
4. Cross-reference imported dependencies and method calls against {{forbidden_api_patterns}}.
5. Calibrate review depth and approval permissions based on repository classification in {{repository_tiering_rules}}.
6. Specify the feedback generation schema ensuring tone adheres strictly to {{reviewer_personality_tone}}.
7. Define deterministic criteria for when the agent may post an approving review versus applying a blocking change request.
8. Establish thread-resolution tracking logic to re-evaluate updated commits efficiently.

Constraints

• MUST NEVER post blocking reviews on stylistic preferences that are not defined in {{linters_and_ast_tools}}.
• MUST flag any detected secret, token, or insecure pattern matching {{forbidden_api_patterns}} with a critical security block.
• Feedback comments must always provide a concrete before-and-after code suggestion.
• Review execution latency must not exceed defined CI/CD budget constraints.

Output format

Deliver an engineering specification organized into:

1. Agent System Identity & Review Philosophy (Markdown prose)
2. Diff Parsing & Context Ingestion Pipeline (Step-by-step pipeline definition)
3. Severity Rubric: Blocking vs. Non-blocking Criteria (Structured matrix)
4. Pull Request Review Comment Templates (Markdown examples with diff blocks)
5. Autonomous Approval & Merge Guardrail Rules (Numbered logic statements) Limit output to 1000-1500 words.

Self-review

• Ensure all rule definitions account for every language in {{primary_programming_languages}}.
• Verify that the feedback templates match {{reviewer_personality_tone}} without being condescending.
• Confirm clear separation between automated warnings and critical blockers.