# Review Evidence

> Use when a delivery run dispatches a verification-stretch evidence-judging action: test evidence (test_evidence_review, qa-engineer), security evidence (security_evidence_review, security-reviewer), runtime evidence (runtime_evidence_review, devops-ops), or documentation evidence (documentation_evidence_review, documentation-steward). One shared procedure — judge recorded evidence against what it claims, prove existing work without expanding scope, record residual findings explicitly even when empty — parameterized by the action id passed as the first skill argument and the persona dispatched. Replaces the retired test-evidence-review, security-evidence-review, runtime-evidence-review, and documentation-evidence-review skills.

- Skill: `bhangeef16/review-evidence` (Agent Skill)
- Install (CLI): `npx skillmds@latest add bhangeef16/review-evidence`
- Raw SKILL.md: https://api.skillmd.com/api/skills/bhangeef16/review-evidence/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: BhangeeF16 (https://skillmd.com/u/bhangeef16)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/bhangeef16/review-evidence

---


# Review Evidence — $action

One procedure for judging recorded evidence. You prove work that already exists — you never add new scope to prove a point, and an untested claim is not evidence regardless of the result field attached to it.

## Your contract

The dispatch prompt quotes this action's `required_inputs` and `required_outputs` verbatim from the action's own entry in the currently-injected `commands/<name>.process.yaml`. A dispatch that arrives without them is malformed — report `blocked` and name the missing contract rather than guessing at one.

## Procedure (every action)

1. Read the recorded evidence for `$target` and the claims it backs.
2. A claim with no evidence entry behind it is not passing-shaped — name it, do not argue it away.
3. Judge what the evidence actually exercised, not what its label says (a smoke that only proved container liveness did not prove the endpoint).
4. Record residual risks/gaps explicitly, even when the list is empty.
5. Do not expand scope beyond proving the existing work — this stretch's own purpose, not a generic reminder.

## Action-specific rules

- `test_evidence_review` — `db-administrator` is the supporting lens for schema/query evidence. A required test environment genuinely unavailable is recorded as not-run with the reason — never converted into an assumed pass.
- `security_evidence_review` — negative validation is mandatory for security-sensitive behavior: evidence of what happens when the check is violated (wrong user, wrong tenant, missing permission, invalid input), not only when it succeeds; its absence is itself a finding.
- `runtime_evidence_review` — anything the evidence shows is not actually ready is a blocker, stated as one, not a note.
- `documentation_evidence_review` — validate mechanically: front matter on every changed doc, no dangling or unrepaired references, index refresh ran for meaningful changes or the reason it could not is recorded.

## Result

Report each required output produced (with its location), the result (pass / pass_with_risks / blocked / failure), and blocking questions as an explicit list (empty list stated explicitly).