skills/team/jira-review/SKILL.md
Automatically review Jira issues for implementation readiness. Detects complexity signals, parses acceptance criteria, and recommends clarification or planning mode when needed. Use when asked to review a Jira issue for readiness, check if a ticket has enough detail to implement, assess acceptance criteria completeness, or evaluate a story before sprint planning. Do NOT use when implementation is already complete — this skill reviews for readiness, not post-implementation accuracy; Do NOT use when the issue tracker is not Jira.
npx skillsauth add michaelalber/ai-toolkit jira-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"Unclear requirements are the root cause of most project failures. Questions asked now prevent misunderstandings later."
Before writing a single line of code, we must understand what we're building and why. This skill systematically reviews Jira issues before implementation to prevent wasted effort (catch ambiguity early), surface hidden complexity (identify technical risk before it blocks), ensure testability (clear AC enable TDD), and align expectations. Readiness is assessed from measurable signals, not intuition — complexity is scored, gaps are named, and the recommendation follows deterministically.
Non-Negotiable Constraints:
Full principle table, extraction algorithm, scoring, signal detection, discipline rules, and worked
examples live in references/conventions.md.
TRIGGER Auto-activate on jira_get_issue / jira_get_issue_with_docs. Review before any impl work.
EXTRACT Parse the description for AC, DoD, user story, technical requirements (algorithm + patterns
in conventions.md / description-patterns.md). Flag unstructured descriptions.
SCORE Apply the 5-dimension weighted complexity score (conventions.md / complexity-scoring.md).
Detect RED/YELLOW/GREEN signals. Record the signals behind the score.
RECOMMEND Decide deterministically:
complexity < 40% AND ac_complete AND dod_present → READY TO IMPLEMENT (→ /tdd-cycle)
complexity > 70% OR critical_info_missing → NEEDS PLANNING MODE (→ plan mode)
otherwise → NEEDS CLARIFICATION
(≤ 5 questions, clarifying-questions.md)
REPORT Emit the structured review (output-templates.md) with the recommendation, named gaps,
and the handoff snippet for the chosen path.
Exit criteria: AC/DoD extracted (or their absence flagged), complexity scored with named signals, a single deterministic recommendation issued, and — when NEEDS CLARIFICATION — specific, prioritized questions provided.
<jira-review-state>
phase: TRIGGER | EXTRACT | SCORE | RECOMMEND | REPORT | COMPLETE
issue_key: [KEY-123]
issue_type: story | bug | task | epic
ac_found: yes | no | partial
dod_found: yes | no | partial
complexity_pct: [number or "unable to assess"]
critical_info_missing: true | false
recommendation: ready | needs-clarification | needs-planning | pending
open_questions: [count]
last_action: [description]
next_action: [description]
</jira-review-state>
references/output-templates.md.references/complexity-scoring.md.references/description-patterns.md.references/clarifying-questions.md.references/conventions.md.| Skill | Relationship |
|-------|-------------|
| tdd-cycle | The handoff for READY TO IMPLEMENT — write tests from the AC, implement, refactor. |
| task-decomposition | For NEEDS PLANNING MODE on high-complexity issues — break the issue into implementable sub-tasks. |
| triage-issue / to-issues | Upstream issue intake; this skill assesses readiness once an issue exists. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".