adonis0123/staged-review-validator
.agents/skills/staged-review-validator/SKILL.md
Validate staged-changes-review findings with evidence-based verdicts and minimal-fix guidance. Use when you need to confirm whether each reported issue is valid and actionable.
$ install --global
skillsauthnpx skillsauth add adonis0123/adonis-skills staged-review-validatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 30, 2026, 6:12 PM46.9s3 files scanned
SKILL.md
- name:
- staged-review-validator
- description:
- Validate staged-changes-review findings with evidence-based verdicts and minimal-fix guidance. Use when you need to confirm whether each reported issue is valid and actionable.
Staged Review Validator
用于对已有审查报告做二次验证，不负责重新发起完整扫描。
何时使用
- 用户已经有一份
staged-changes-review结果，想确认每条问题是否真实成立 - 用户问“这个问题到底要不要改”
- 用户希望获得“逐条裁决 + 证据 + 修改建议”
输入契约
必需输入
- 用户提供一段
staged-changes-review文本（至少包含问题描述）
推荐输入
- 文件路径
- 行号
- 风险级别
- 置信度
- 原始建议
缺失输入处理
如果用户没有粘贴审查结果：
- 明确提示“请先粘贴 staged-changes-review 结果”
- 提供一个最小输入模板（见
references/output-template.md） - 不自动改为扫描
git diff --cached
核验流程
1. 解析问题清单
从用户提供的报告提取每条问题：
- 标题
- 文件与行号
- 原风险级别
- 原置信度
- 原建议
2. 逐条证据核验
对每条问题进行核验：
- 文件/行号是否存在
- 代码上下文是否匹配问题描述
- 该问题是否已经在当前变更中修复
- 是否存在上下文导致“看似问题但实际合理”
可使用但不限于以下命令：
git diff --cached
rg -n "关键符号" <path>
sed -n '<start>,<end>p' <path>
git show HEAD:<path>
3. 给出裁决
每条问题只能输出以下三种之一：
成立：证据直接支持问题描述不成立：证据与描述冲突，或问题已修复待确认：证据不足（路径/行号缺失、上下文不完整等）
4. 推导“是否需要修改”
成立且风险为中/高：需要修改成立且风险低：建议修改不成立：不需要修改待确认：暂不修改，先补充信息
输出要求（固定）
先给总览，再给逐条裁决。
总览
- 问题总数
- 成立数
- 不成立数
- 待确认数
- 建议修改数
逐条裁决块（每条必含）
- 问题标题
- 文件位置
- 风险级别
- 置信度
- 裁决（成立/不成立/待确认）
- 是否需要修改（是/否/待补充）
- 证据（命令结果或代码定位）
- 最小改动建议
结尾给出编号式“可执行下一步”。
与 staged-changes-review 的关系
staged-changes-review：发现候选问题staged-review-validator：验证候选问题是否真实成立
串联时，后者不重复完整扫描逻辑，重点做证据核验与裁决。
参考文档
references/verification-rubric.md：裁决标准、证据优先级、置信度映射references/output-template.md：固定输出模板与示例
Related Skills
adonis0123/code-plugin-architecture
tools
VerifiedTrustedCommunity
Use when the user's pain is "adding/removing one more X means editing N files" and X is a recurring variant kind: popup, banner, modal, ad slot, payment method, AI model/tool, form field type, connector, sub-site, command, menu item, agent, extension point, or data source. Use when they want to design, refactor, review, name, or explain a pluggable mechanism using registry, interface/trait contract, runtime core, and convention folders; mention pluginize, pluggable, plugin architecture, extension point, registry pattern, or extensibility. Use when explaining the first-principles rationale, DDD/SOLID/OCP mapping, or industry analogies behind that structure. Use for cross-stack mapping to VSCode contributes, Webpack/Vite plugins, Rust/Tauri connectors, Python entry_points, or cargo features. Skip one variant's internals/styles/hooks/copy/bugs, and skip register/registry meaning DI container, user signup, or package registry.
2SKILL.mdUpdated May 30, 2026
adonis0123/workflow-gate
development
VerifiedTrustedCommunity
Use BEFORE heavier workflow skills when route choice matters. Route creative work without a design doc/spec to Brainstorm; destructive or hard-to-reverse work to Discuss; unresolved decisions, Plan/Full fan-out, ship checks, unclear bugs, and fresh-eyes fix-then-re-review need this gate. Skip single-line read-only lookups, pure typo/formatting edits, trivial safe one-line fixes, and clearly safe named-skill requests. Outputs Route, Runtime skill, Fallback alias, and Execution path.
2SKILL.mdUpdated May 17, 2026
adonis0123/agentic-review-handoff
development
VerifiedTrustedCommunity
Cross-agent code review handoff and review-fix-re-review loop with persistent packet artifacts. Requires a git repo because packet addressing uses git rev-parse --show-toplevel. Use when the user asks for an independent, read-only second pair of eyes on a diff/branch/PR another agent or teammate implemented; asks to verify reviewer feedback before fixing; says a fix is done and wants scoped re-review; asks to continue the latest review packet; or asks for first-principles, DDD, high-cohesion/low-coupling review. Persists each loop under $repo_root/.review-handoff/active/ so agents can resume without copy-paste. Do NOT use for ordinary implementation, generic staged-change review, review-comment copy editing, non-git folders/zips/tarballs/temp dirs, or when the user names a different review skill.
2SKILL.mdUpdated May 16, 2026
adonis0123/discuss-before-plan
testing
VerifiedTrustedCommunity
Enforces 'decide then plan' discipline - the pre-planning decision gate. Use when the user asks for a plan or starts a change while key decisions are unresolved: architecture tradeoffs, data flow, public interfaces, unclear requirements, multi-module scope, or roughly 5+ files affected. Also triggers when the user explicitly wants to discuss, compare options, or review architecture before committing. Core job: reduce incorrect-execution cost by confirming decisions before producing executable plans.
2SKILL.mdUpdated Mar 27, 2026