How do I install the Review skill?

Run npx skillmds@latest add cwijayasundara/review in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Review skill do?

Run evaluator and security reviewer concurrently for comprehensive quality gate. It is listed under Security on SkillMD.

Is Review safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Review?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Review free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Review?

cwijayasundara (@cwijayasundara) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Review by cwijayasundara — Agent Skill

Name: Review
Author: cwijayasundara

File contents

Review Skill

On-demand, pre-merge entry point to the harness's one quality gate: it spawns the same evaluator + security-reviewer agents that /evaluate (Layer 4) and /auto (Gate 7) run in-pipeline, with identical verdict semantics. This skill owns only the on-demand orchestration; the gate's definitions live in /evaluate.

Ultracode tip: Multi-dimension review with adversarial verification is a natural fan-out, so /effort ultracode pays off on this plain skill form.

Usage

/review            # reviews the current group in context
/review E3-S1      # reviews a specific story and its group

Execution

Step 1 — Spawn Both Agents Concurrently

Use the Agent tool to spawn both agents in a single call — concurrent execution is the point of this skill:

evaluator — runs all sprint contract checks (API, Playwright, architecture); writes specs/reviews/evaluator-report.md and updates features.json.
security-reviewer — scans the changed files; writes specs/reviews/security-review.md and the canonical specs/reviews/security-verdict.json.

Both agents get the same changed-file set and group context. Every changed file in the group is in scope for both — never pass a subset to avoid findings.

Step 2 — Apply the Canonical Gate Semantics

Severity levels (BLOCK/WARN/INFO), the BLOCK self-healing loop (generator fix → full re-run, max 3 cycles, then escalate), and the security verdict format are defined once in /evaluate (.claude/skills/evaluate/SKILL.md) — follow them exactly from there. Do not merge or mark a group complete while any BLOCK finding remains open, and always re-run the full review after fixes.

Output Files

specs/reviews/evaluator-report.md — PASS/FAIL with per-check detail
specs/reviews/security-review.md — BLOCK/WARN/INFO findings with file references
specs/reviews/security-verdict.json — the canonical machine-readable security verdict

All three must exist before the review is complete; a missing output is itself a BLOCK finding.

Canonical ownership (vs `/evaluate`)

There are two entry points to the same gate, not two gates:

/evaluate Layer 4 / /auto Gate 7 — the authoritative in-pipeline owner.
/review — the on-demand pre-merge entry point (this skill).

In /auto, Gate 7 already covers it — a separate /review is only needed for manual gating before a merge.

---name: reviewdescription: Run evaluator and security reviewer concurrently for comprehensive quality gate.---# Review SkillOn-demand, pre-merge entry point to the harness's **one** quality gate: it spawns the same `evaluator` + `security-reviewer` agents that `/evaluate` (Layer 4) and `/auto` (Gate 7) run in-pipeline, with identical verdict semantics. This skill owns only the on-demand orchestration; the gate's definitions live in `/evaluate`.> **Ultracode tip:** Multi-dimension review with adversarial verification is a natural fan-out, so `/effort ultracode` pays off on this plain skill form.## Usage```/review # reviews the current group in context/review E3-S1 # reviews a specific story and its group```## Execution### Step 1 — Spawn Both Agents ConcurrentlyUse the Agent tool to spawn both agents **in a single call** — concurrent execution is the point of this skill:- **evaluator** — runs all sprint contract checks (API, Playwright, architecture); writes `specs/reviews/evaluator-report.md` and updates `features.json`.- **security-reviewer** — scans the changed files; writes `specs/reviews/security-review.md` and the canonical `specs/reviews/security-verdict.json`.Both agents get the same changed-file set and group context. Every changed file in the group is in scope for both — never pass a subset to avoid findings.### Step 2 — Apply the Canonical Gate SemanticsSeverity levels (BLOCK/WARN/INFO), the BLOCK self-healing loop (generator fix → full re-run, max 3 cycles, then escalate), and the security verdict format are defined once in `/evaluate` (`.claude/skills/evaluate/SKILL.md`) — follow them exactly from there. Do not merge or mark a group complete while any BLOCK finding remains open, and always re-run the full review after fixes.## Output Files- `specs/reviews/evaluator-report.md` — PASS/FAIL with per-check detail- `specs/reviews/security-review.md` — BLOCK/WARN/INFO findings with file references- `specs/reviews/security-verdict.json` — the **canonical** machine-readable security verdictAll three must exist before the review is complete; a missing output is itself a BLOCK finding.## Canonical ownership (vs `/evaluate`)There are two entry points to the same gate, not two gates:- **`/evaluate` Layer 4 / `/auto` Gate 7** — the authoritative in-pipeline owner.- **`/review`** — the on-demand pre-merge entry point (this skill).In `/auto`, Gate 7 already covers it — a separate `/review` is only needed for manual gating before a merge.

Frequently asked questions

Review