ferueda/review-spec
skills/review-spec/SKILL.md
Review a spec document against codebase reality, identifying gaps and ensuring sound, robust implementations.
$ install --global
skillsauthnpx skillsauth add ferueda/agent-skills review-specInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: May 29, 2026, 3:00 AM39.0s1 file scanned
SKILL.md
- name:
- review-spec
- description:
- Review a spec document against codebase reality, identifying gaps and ensuring sound, robust implementations.
Review the given spec document by analyzing both the spec AND the referenced codebase.
Process
- Read the spec - Understand goals, phases, and proposed changes
- Explore the codebase - Read files and code mentioned in the spec
- Analyze patterns - Identify existing patterns, conventions, and architecture
- Validate the plan - Ensure proposals align with codebase reality
- Identify issues - Find gaps, risks, and improvement opportunities
Review Dimensions
Evaluate across these areas (focus on what's relevant):
- Architecture: Component boundaries, data flow, API contracts, separation of concerns
- Feasibility: Implementation complexity, technology trade-offs, effort estimation
- Reliability: Error handling, retries, idempotency, graceful degradation
- Performance: Bottlenecks, caching, query patterns, scaling approach
- Security: Auth, data protection, input validation, audit logging
- Edge Cases: Null handling, limits, timeouts, race conditions, partial failures
- Testing: Testability, integration strategy, rollback considerations
Output Format
For each finding:
### [Finding Title]
**Category**: Architecture | Feasibility | Reliability | Performance | Security | Edge Case | Testing
**Severity**: Critical | High | Medium | Low
**Section**: [Spec section or phase]
**Issue**: [Clear problem description]
**Recommendation**: [Specific, actionable change]
**Rationale**: [Technical justification]
Guidelines
- Verify against code - Don't trust the spec blindly; check actual implementations
- Follow existing patterns - Recommendations should align with codebase conventions
- Be specific - Reference exact files, functions, and line numbers
- Prioritize - Order findings by severity and impact
- Challenge assumptions - Question decisions that lack justification
Related Skills
ferueda/react-to-review
tools
VerifiedTrustedCommunity
Evaluate, analyze, and systematically react to an adversarial code review report. Decide on the action for each finding (Implement, Adapt, Decline), provide clear justifications, and define the plan to implement the accepted changes.
1SKILL.mdUpdated Jun 1, 2026
ferueda/theory-building
development
VerifiedTrustedCommunity
Manually invoked point-of-work workflow for applying Peter Naur's "programming as theory building" during active software work. Use this skill only when the user explicitly names `theory-building`, asks to use the theory-building skill, or explicitly says to apply programming-as-theory- building to the current design, implementation, refactor, review, or AI-generated code. Do not trigger automatically for ordinary architecture, implementation, refactor, review, debug, documentation, AI-code, domain model, or maintainability tasks.
1SKILL.mdUpdated May 29, 2026
ferueda/theory-building-review
development
VerifiedTrustedCommunity
Manually triggered weekly or post-change repository audit based on Peter Naur's "Programming as Theory Building." Use this skill only when the user explicitly names `theory-building-review`, asks to run the theory-building review skill, or says to run the weekly/post-change theory-building review. Do not trigger automatically just because the conversation mentions Naur, domain modeling, refactoring, architecture, craft, or code review. When explicitly invoked, inspect recent diffs or scoped repository areas, reconstruct the system theory, find places where code and domain language diverge, and return actionable refactor, test, documentation, and modeling improvements. For active design, implementation, refactor, review, or AI-code acceptance on a specific change, use `theory-building` instead when explicitly invoked.
1SKILL.mdUpdated May 29, 2026
ferueda/summarize-work
documentation
VerifiedTrustedCommunity
Summarize work done in a spec/plan document.
1SKILL.mdUpdated May 29, 2026