skills/jira-review/SKILL.md
Automatically review Jira issues for implementation readiness. Detects complexity signals, parses acceptance criteria, and recommends clarification or planning mode when needed. Use when asked to review a Jira issue for readiness, check if a ticket has enough detail to implement, assess acceptance criteria completeness, or evaluate a story before sprint planning. Do NOT use when implementation is already complete — this skill reviews for readiness, not post-implementation accuracy; Do NOT use when the issue tracker is not Jira.
npx skillsauth add michaelalber/ai-toolkit jira-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Before writing a single line of code, we must understand what we're building and why. This skill embodies the principle that unclear requirements are the root cause of most project failures. By systematically reviewing Jira issues before implementation, we:
| # | Principle | Description | Applied As |
|---|-----------|-------------|------------|
| 1 | Completeness Before Clarity | A vague issue blocks implementation regardless of how well-written it is. Missing acceptance criteria is a harder blocker than unclear prose. | Flag missing acceptance criteria before assessing description quality. |
| 2 | Ambiguity Is Blocking | Ambiguous requirements produce wrong implementations. Any requirement that admits two interpretations will result in the wrong one being chosen. | Any requirement that admits two interpretations must be flagged as a blocker, not a suggestion. |
| 3 | Complexity Is Measurable | Implementation complexity can be estimated from signal density, not intuition. Signals include: new integrations, cross-service changes, undecided technical approaches, external dependencies. | Apply the complexity scoring formula from references/complexity-scoring.md. Do not guess complexity. |
| 4 | Testability Is a Gate | An issue without acceptance criteria cannot be verified as done. TDD cannot start without a testable criterion. If you cannot write the first test from the AC, the AC is not ready. | No issue passes review without at least one acceptance criterion that can be expressed as a test. |
| 5 | Size Predicts Risk | Large issues (high complexity score) correlate with planning failures, scope drift, and missed dependencies. High-complexity issues rarely survive implementation unchanged. | Flag issues scoring ≥ 8 for decomposition before sprint commitment. |
| 6 | Context Reduces Rework | Missing context forces implementers to make assumptions. Every assumption the implementer must make is a potential rework event. | Every gap in the issue that requires the implementer to assume something is a required clarification. |
| 7 | Dependencies Must Be Explicit | Undeclared dependencies cause cascading delays. A feature that cannot be completed until another team ships will slip; the earlier this is surfaced, the smaller the impact. | Flag any issue that implies another issue's completion or another team's delivery without linking it explicitly. |
| 8 | Reproducibility Is Non-Negotiable | A bug report that cannot be reproduced cannot be fixed. Developers who cannot reproduce a bug make changes that may not fix it and may introduce regressions. | Any bug issue missing reproduction steps fails review unconditionally. |
| 9 | UI Issues Require Visuals | Describing a visual problem in text produces ambiguous fixes. "The button looks wrong" is not actionable. A screenshot with markup is. | Flag any UI/UX issue lacking screenshots, annotated mockups, or Figma links. |
| 10 | Estimates Are Evidence-Based | Story point estimates without complexity signals are fiction. Accurate estimates require measurable inputs. | Require complexity scoring before accepting an estimate. Reject point assignments made without supporting signal evidence. |
This skill activates automatically when the following MCP tools are invoked:
jira_get_issue - Fetch a single Jira issuejira_get_issue_with_docs - Fetch issue with linked documentationUpon detecting these tool calls, immediately perform a comprehensive review of the returned issue data before proceeding with any implementation work.
Extract structured requirements from the Jira issue description using the patterns defined in references/description-patterns.md.
Primary extraction targets:
1. Scan for section headers (case-insensitive):
- "Acceptance Criteria", "AC:", "Criteria"
- "Definition of Done", "DoD:", "Done When"
2. Parse list items following headers:
- Numbered lists (1., 2., 3.)
- Bullet points (-, *, •)
- Checkboxes ([ ], [x], ☐, ☑)
3. Detect BDD patterns anywhere in description:
- Given [precondition]
- When [action]
- Then [expected result]
4. Flag unstructured descriptions for manual review
Use the 5-dimension weighted scoring system defined in references/complexity-scoring.md.
| Dimension | Weight | Description | |-----------|--------|-------------| | Scope Breadth | 1.5 | Number of components/systems affected | | Requirements Clarity | 1.5 | Specificity and completeness of AC/DoD | | Technical Uncertainty | 1.2 | New tech, integrations, unknowns | | Dependencies | 1.0 | External team/system dependencies | | Estimation Confidence | 1.0 | Presence of sizing/story points |
weighted_score = Σ(dimension_score × weight) / Σ(max_score × weight)
complexity_percentage = weighted_score × 100
Based on complexity assessment and requirements completeness:
IF complexity < 40% AND ac_complete AND dod_present:
-> READY TO IMPLEMENT
-> Suggest: "Consider using /tdd-cycle to begin implementation"
ELIF complexity > 70% OR critical_info_missing:
-> NEEDS PLANNING MODE
-> Suggest: "Use plan mode to break down this issue before implementation"
ELSE:
-> NEEDS CLARIFICATION
-> Generate specific questions using templates from references/clarifying-questions.md
The following trigger immediate "NEEDS CLARIFICATION" regardless of complexity:
When reviewing a Jira issue, produce the following structured output:
## Jira Issue Review
**Issue**: [KEY-123] Issue Title
**Type**: Story | Bug | Task | Epic
**Status**: To Do | In Progress | etc.
---
### Requirements Analysis
**Acceptance Criteria Found**: Yes | No | Partial
- [ ] Criterion 1 extracted from description
- [ ] Criterion 2 extracted from description
**Definition of Done Found**: Yes | No | Partial
- [ ] DoD item 1
- [ ] DoD item 2
**User Story**: [Extracted if present, or "Not specified"]
---
### Complexity Assessment
| Dimension | Score | Notes |
|-----------|-------|-------|
| Scope Breadth | X/5 | [specific components identified] |
| Requirements Clarity | X/5 | [what's clear vs unclear] |
| Technical Uncertainty | X/5 | [new tech or unknowns] |
| Dependencies | X/5 | [external dependencies] |
| Estimation Confidence | X/5 | [sizing info present?] |
**Overall Complexity**: Low (X%) | Medium (X%) | High (X%)
---
### Recommendation
**[READY TO IMPLEMENT]** | **[NEEDS CLARIFICATION]** | **[NEEDS PLANNING MODE]**
[Detailed explanation of the recommendation]
---
### Clarifying Questions
[Only include if recommendation is NEEDS CLARIFICATION]
1. [Specific question about ambiguous requirement]
2. [Question about missing information]
3. [Question about technical constraints]
---
### Suggested Next Steps
- [Actionable next step 1]
- [Actionable next step 2]
Look for these indicators that suggest high complexity:
Scope Indicators:
Uncertainty Keywords:
Vague Requirements:
Dependency Signals:
When gaps are identified, generate targeted questions using the templates in references/clarifying-questions.md.
Question Quality Guidelines:
A vague flag ("this issue is unclear") gives the product owner nothing actionable. A specific flag ("Missing: acceptance criteria — the description says 'fix the login page' but does not state what 'fixed' means") is actionable.
WRONG: "This issue is too vague to implement."
(Product owner does not know what to add)
RIGHT: "Missing: acceptance criteria.
The description says 'fix the login page' but does not state:
- What 'fixed' means (what is currently wrong?)
- Which users are affected (all? specific roles?)
- What the success condition looks like
Please add acceptance criteria before this issue is sprint-ready."
Recommending a complexity score without listing the signals that produced it is guesswork. The score must be derivable from the signals you name.
WRONG: "This issue has a complexity score of 8 — it looks quite large."
RIGHT: "Complexity score: 8 (HIGH). Signals detected:
- API changes: 2 endpoints modified (Scope Breadth: 3/5)
- New database table: 1 (Scope Breadth contribution)
- Auth change: session model affected (Technical Uncertainty: 4/5)
- External dependency: mobile team must ship push notification support first
(Dependencies: 5/5)
Recommend decomposition before sprint commitment."
When recommending "READY TO IMPLEMENT", suggest:
This issue appears ready for implementation. Consider using /tdd-cycle to:
1. Write tests based on the acceptance criteria
2. Implement the minimum code to pass tests
3. Refactor while maintaining green tests
When recommending "NEEDS PLANNING MODE", suggest:
This issue requires deeper analysis before implementation. Use plan mode to:
1. Break down into smaller, implementable tasks
2. Identify technical approach and alternatives
3. Create a step-by-step implementation plan
When recommending "NEEDS CLARIFICATION", provide:
Issue: [PROJ-123] Add logout button to header
Description:
As a logged-in user, I want to see a logout button in the header so that I can securely end my session.
Acceptance Criteria:
1. Logout button appears in header only when user is authenticated
2. Clicking logout clears the session token
3. User is redirected to login page after logout
4. Success toast notification displays "You have been logged out"
Definition of Done:
- Unit tests for logout functionality
- E2E test for logout flow
- Code reviewed and approved
Review Result: READY TO IMPLEMENT (Complexity: 25%)
Issue: [PROJ-456] Improve dashboard performance
Description:
The dashboard is slow. Make it faster.
Review Result: NEEDS CLARIFICATION (Complexity: Unable to assess)
Clarifying Questions:
Issue: [PROJ-789] Implement real-time notifications
Description:
Add real-time notification system. Should work across all platforms (web, mobile).
Need to research best approach - WebSockets vs SSE vs polling.
Must integrate with existing user preferences.
Coordinate with mobile team for push notification support.
AC:
- Users receive notifications in real-time
- Works on all platforms
Review Result: NEEDS PLANNING MODE (Complexity: 82%)
Reasons:
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".