grinrus/review-spec
skills/review-spec/SKILL.md
Reviews plan and PRD, then gates readiness for task derivation. Use when plan and PRD artifacts are ready for downstream planning readiness. Do not use when the request is plan authoring in `plan-new` or task derivation in `tasks-new`.
$ install --global
skillsauthnpx skillsauth add grinrus/ai_driven_dev review-specInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 19, 2026, 5:08 AM4.2s1 file scanned
SKILL.md
- name:
- review-spec
- description:
- Reviews plan and PRD, then gates readiness for task derivation. Use when plan and PRD artifacts are ready for downstream planning readiness. Do not use when the request is plan authoring in `plan-new` or task derivation in `tasks-new`.
- argument-hint:
- $1 [note...]
- lang:
- en
- prompt_version:
- 1.0.28
- source_version:
- 1.0.28
- model:
- inherit
- disable-model-invocation:
- true
- user-invocable:
- true
Follow feature-dev-aidd:aidd-core.
Steps
- Set active stage
review-plan, thenreview-prd; keep active feature in sync via canonical active-state runtime commands only. - Run plan readiness gate before verdict:
python3 ${CLAUDE_PLUGIN_ROOT}/skills/aidd-core/runtime/plan_review_gate.py --ticket <ticket>. - Canonical plan path for all checks and narrative is only
aidd/docs/plan/<ticket>.md; alias paths likeaidd/docs/plan/<ticket>.plan.mdare forbidden. - Run
python3 ${CLAUDE_PLUGIN_ROOT}/skills/aidd-core/runtime/prd_review.py --ticket <ticket>to refresh structured PRD report payload. - Gate PRD readiness with
python3 ${CLAUDE_PLUGIN_ROOT}/skills/aidd-flow-state/runtime/prd_check.py; block on failure. - Use the existing rolling context pack as review input; do not invoke standalone context-pack builder scripts from this stage.
- Run subagent
feature-dev-aidd:plan-reviewer. Treat its output as narrative review input only; if the plan gate already yields a terminal blocker, keep that blocker authoritative for the stage verdict. - Run subagent
feature-dev-aidd:prd-reviewerafter the plan-reviewer handoff whenever PRD artifacts remain readable; if the plan path is WARN-only, continue the PRD pass, but do not let narrative reviewers override gate/report payloads. - Persist PRD review report with
python3 ${CLAUDE_PLUGIN_ROOT}/skills/aidd-core/runtime/prd_review.py --ticket <ticket> --report aidd/reports/prd/<ticket>.json --require-readyfor READY-path validation. - Review-stage RLM policy: if RLM links are empty, the runtime performs bounded auto-heal (
rlm_links_build, then finalize probe) and returns WARN attribution with evidence instead of terminal block when review can continue. - Report payload (
aidd/reports/prd/<ticket>.json|.pack.json) is the source of truth for final verdict: READY is allowed only whenrecommended_status=ready; otherwise return WARN/BLOCKED with canonical next action on upstream PRD/plan fixes, then rerun/feature-dev-aidd:review-spec <ticket>. - If narrative text conflicts with gate/report payload, mark
WARN(review_spec_report_mismatch)and follow gate/report payload only. Proceed to implementationis forbidden whenrecommended_status != ready.- Runtime-path safety: execute only canonical runtime commands from this contract (
python3 ${CLAUDE_PLUGIN_ROOT}/skills/.../runtime/...). - Root-relative
/skills/...runtime paths are forbidden; use onlypython3 ${CLAUDE_PLUGIN_ROOT}/skills/.../runtime/....
Command contracts
python3 ${CLAUDE_PLUGIN_ROOT}/skills/aidd-core/runtime/prd_review.py
- When to run: as canonical review-spec stage entrypoint before PRD approval decisions.
- Inputs:
--ticket <ticket>plus active PRD/plan artifacts. - Outputs: normalized PRD review report payload; verdict decisions use report payload (
recommended_status) as source of truth. - Failure mode: non-zero exit when review inputs are incomplete or report validation fails; RLM links-empty path is handled as bounded auto-heal then WARN attribution.
- Next action: fix missing artifacts/review findings or unresolved RLM prerequisites and rerun the CLI.
python3 ${CLAUDE_PLUGIN_ROOT}/skills/aidd-core/runtime/plan_review_gate.py
- When to run: before the plan-reviewer narrative pass and before deciding whether the stage can continue on a WARN path.
- Inputs:
--ticket <ticket>and the canonical plan artifact. - Outputs: structured plan gate verdict used as an authoritative source for early-stop semantics.
- Failure mode: non-zero exit when the plan artifact is missing, invalid, or blocked by the gate contract.
- Next action: fix the plan blockers and rerun the gate before claiming review-spec readiness.
Notes
- Planning stage:
AIDD:ACTIONS_LOG: n/a.
Additional resources
- PRD review runtime: ../aidd-core/runtime/prd_review.py (when: review-spec gate behavior is unclear; why: confirm report contract and status mapping).
Related Skills
grinrus/tasks-new
tools
VerifiedTrustedCommunity
Derives or refines tasklist items from PRD and plan artifacts. Use when tasklist stage prepares implementation-ready work items. Do not use when the request is plan authoring in `plan-new` or loop execution in `implement`.
5SKILL.mdUpdated Apr 5, 2026
grinrus/status
testing
VerifiedTrustedCommunity
Generates consolidated ticket status summary and key artifact pointers. Use when checking current stage state or handoff readiness. Do not use when the request is diagnostics/inventory from `aidd-observability` or flow-state mutation via `aidd-flow-state`.
5SKILL.mdUpdated Apr 5, 2026
grinrus/spec-interview
testing
VerifiedTrustedCommunity
Collects missing spec inputs and synchronizes answers into `spec.yaml`. Use when review-spec leaves unresolved specification fields. Do not use when the request is readiness gating in `review-spec` or task derivation in `tasks-new`.
5SKILL.mdUpdated Apr 5, 2026
grinrus/review
testing
VerifiedTrustedCommunity
Runs review-stage validation for scope changes, findings, and follow-up task derivation. Use when review stage needs verdict and handoff tasks. Do not use when the request is direct implementation execution in `implement` or QA validation in `qa`.
5SKILL.mdUpdated Apr 5, 2026