adonis0123/staged-review-validator
skills/staged-review-validator/SKILL.md
Validate staged-changes-review findings with evidence-based verdicts and minimal-fix guidance. Use when you need to confirm whether each reported issue is valid and actionable.
$ install --global
skillsauthnpx skillsauth add adonis0123/adonis-skills staged-review-validatorInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 30, 2026, 6:19 PM52.8s3 files scanned
SKILL.md
- name:
- staged-review-validator
- description:
- Validate staged-changes-review findings with evidence-based verdicts and minimal-fix guidance. Use when you need to confirm whether each reported issue is valid and actionable.
- author:
- adonis
Staged Review Validator
用于对已有审查报告做二次验证，不负责重新发起完整扫描。
何时使用
- 用户已经有一份
staged-changes-review结果，想确认每条问题是否真实成立 - 用户问“这个问题到底要不要改”
- 用户希望获得“逐条裁决 + 证据 + 修改建议”
输入契约
必需输入
- 用户提供一段
staged-changes-review文本（至少包含问题描述）
推荐输入
- 文件路径
- 行号
- 风险级别
- 置信度
- 原始建议
缺失输入处理
如果用户没有粘贴审查结果：
- 明确提示“请先粘贴 staged-changes-review 结果”
- 提供一个最小输入模板（见
references/output-template.md） - 不自动改为扫描
git diff --cached
核验流程
1. 解析问题清单
从用户提供的报告提取每条问题：
- 标题
- 文件与行号
- 原风险级别
- 原置信度
- 原建议
2. 逐条证据核验
对每条问题进行核验：
- 文件/行号是否存在
- 代码上下文是否匹配问题描述
- 该问题是否已经在当前变更中修复
- 是否存在上下文导致“看似问题但实际合理”
可使用但不限于以下命令：
git diff --cached
rg -n "关键符号" <path>
sed -n '<start>,<end>p' <path>
git show HEAD:<path>
3. 给出裁决
每条问题只能输出以下三种之一：
成立：证据直接支持问题描述不成立：证据与描述冲突，或问题已修复待确认：证据不足（路径/行号缺失、上下文不完整等）
4. 推导“是否需要修改”
成立且风险为中/高：需要修改成立且风险低：建议修改不成立：不需要修改待确认：暂不修改，先补充信息
输出要求（固定）
先给总览，再给逐条裁决。
总览
- 问题总数
- 成立数
- 不成立数
- 待确认数
- 建议修改数
逐条裁决块（每条必含）
- 问题标题
- 文件位置
- 风险级别
- 置信度
- 裁决（成立/不成立/待确认）
- 是否需要修改（是/否/待补充）
- 证据（命令结果或代码定位）
- 最小改动建议
结尾给出编号式“可执行下一步”。
与 staged-changes-review 的关系
staged-changes-review：发现候选问题staged-review-validator：验证候选问题是否真实成立
串联时，后者不重复完整扫描逻辑，重点做证据核验与裁决。
参考文档
references/verification-rubric.md：裁决标准、证据优先级、置信度映射references/output-template.md：固定输出模板与示例
Related Skills
adonis0123/goal-gate
development
VerifiedTrustedCommunity
Use this skill when the user wants to set, write, or use a goal or /goal that makes a coding agent keep working until a verifiable done condition is met. This skill configures the autonomy and stopping contract for Codex, Claude Code, or portable agent prompts; it does not perform the underlying task. Trigger on requests like 'should I set a goal?', 'set up a durable goal', 'give me a /goal prompt', 'keep refactoring until tests pass', 'I am stepping away, have the agent finish this', or goal prompts for migrations, refactors, ports, spec implementations, eval loops, backlog cleanup, or multi-checkpoint work. Do not use for single quick edits, running tests once, OKR/scrum goal questions, recurring reminders, or token-budget settings.
2SKILL.mdUpdated Jun 12, 2026
adonis0123/branch-creator
testing
VerifiedTrustedCommunity
Create safe Git feature or hotfix branches with concise names. Use this whenever the user asks to create a branch, start work on a new feature or fix, wants a `feat/...` or `hotfix/...` branch name, asks for a short branch slug from a task description, or wants help before beginning local Git work. Default to recommending the branch name and command first, then create only after user confirmation. Do not push, commit, rebase, or create PRs.
2SKILL.mdUpdated Jun 12, 2026
adonis0123/code-plugin-architecture
tools
VerifiedTrustedCommunity
Use when the user's pain is "adding/removing one more X means editing N files" and X is a recurring variant kind: popup, banner, modal, ad slot, payment method, AI model/tool, form field type, connector, sub-site, command, menu item, agent, extension point, or data source. Use when they want to design, refactor, review, name, or explain a pluggable mechanism using registry, interface/trait contract, runtime core, and convention folders; mention pluginize, pluggable, plugin architecture, extension point, registry pattern, or extensibility. Use when explaining the first-principles rationale, DDD/SOLID/OCP mapping, or industry analogies behind that structure. Use for cross-stack mapping to VSCode contributes, Webpack/Vite plugins, Rust/Tauri connectors, Python entry_points, or cargo features. Skip one variant's internals/styles/hooks/copy/bugs, and skip register/registry meaning DI container, user signup, or package registry.
2SKILL.mdUpdated May 30, 2026
adonis0123/workflow-gate
development
VerifiedTrustedCommunity
Use BEFORE heavier workflow skills when route choice matters. Route creative work without a design doc/spec to Brainstorm; destructive or hard-to-reverse work to Discuss; unresolved decisions, Plan/Full fan-out, ship checks, unclear bugs, and fresh-eyes fix-then-re-review need this gate. Skip single-line read-only lookups, pure typo/formatting edits, trivial safe one-line fixes, and clearly safe named-skill requests. Outputs Route, Runtime skill, Fallback alias, and Execution path.
2SKILL.mdUpdated May 17, 2026