mikeparcewski/wicked-garden-agentic-review-methodology
skills/agentic/review-methodology/SKILL.md
Use when reviewing an agentic codebase for issues, risks, and maturity gaps — covers the four-phase review process (Detect → Analyze → Prioritize → Report) and the five-level maturity model (Prototype → Functional → Reliable → Production → Optimized) for assessing production readiness. NOT for architecture design (use agentic-patterns) or live agentic review with a subagent (use agentic:review command).
$ install --global
skillsauthnpx skillsauth add mikeparcewski/wicked-garden wicked-garden-agentic-review-methodologyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 12, 2026, 7:04 AM39.2s4 files scanned
SKILL.md
- name:
- wicked-garden-agentic-review-methodology
- description:
- |
- NOT for architecture design (use agentic-patterns) or live agentic review with a subagent (use agentic:
- review command).
- portability:
- portable
- phase_relevance:
- ["design", "review"]
- archetype_relevance:
- ["*"]
Agentic Review Methodology
Systematic approach to reviewing agentic systems and codebases for issues, risks, and improvement opportunities.
Four-Phase Review Process
Phase 1: Detect (Discovery)
Goal: Identify all potential issues
Activities:
- Code analysis (static analysis, anti-patterns)
- Configuration review (prompts, secrets, limits)
- Runtime analysis (logs, traces, metrics)
- Documentation review
Tools:
- Static analyzers (pylint, mypy, eslint)
- Custom grep patterns for agentic anti-patterns
- Log aggregation tools
Deliverable: Raw issue inventory
Phase 2: Analyze (Assessment)
Goal: Understand each issue's impact and root cause
For Each Issue:
- Classify type (see
refs/issue-taxonomy-reliability-safety.mdandrefs/issue-taxonomy-quality-testing.md) - Determine severity (Critical/High/Medium/Low)
- Assess impact (Reliability/Security/Cost/Performance)
- Identify root cause
- Estimate fix effort
Analysis Framework:
- What is the issue?
- Why is it a problem?
- What are the consequences?
- What is the root cause?
- How should it be fixed?
Deliverable: Analyzed issue list with severity and impact
Phase 3: Score (Prioritization)
Goal: Prioritize issues for remediation
Severity Levels:
Critical (P0): Security vulnerabilities, data loss risks, system crashes, compliance violations. Fix immediately.
High (P1): Reliability issues, performance problems, cost inefficiencies, safety gaps. Fix within 1 week.
Medium (P2): Code quality issues, minor performance issues, missing observability. Fix within 1 month.
Low (P3): Style issues, optimization opportunities, nice-to-have features. Backlog.
Prioritization Matrix:
Impact vs Effort:
Low Effort High Effort
High Quick Wins Major Projects
Impact (Do First) (Plan)
Low Easy Wins Avoid
Impact (Do Later) (Skip)
Deliverable: Prioritized roadmap
Phase 4: Report (Communication)
Goal: Communicate findings effectively to stakeholders
Report Components:
- Executive Summary (1 page) - Overall assessment and top recommendations
- Issue Inventory (Detailed) - All issues with severity and recommendations
- Remediation Roadmap - Phased approach with quick wins
- Metrics Dashboard - Issue counts and maturity score
Deliverable: Comprehensive review report
See refs/deliverable-templates.md for complete templates.
Issue Severity Classification
Determining Severity
- Can it cause data loss? → Critical
- Can it cause security breach? → Critical
- Does it crash the system? → Critical/High
- Does it violate compliance? → Critical
- Does it affect reliability? → High/Medium
- Does it waste money? → High/Medium
- Is it a code quality issue? → Medium/Low
Examples by Severity
Critical:
- No input validation (SQL injection risk)
- Credentials in code
- No error handling (system crashes)
- Production deletes without approval
- Missing audit logs for compliance
High:
- No circuit breakers (cascading failures)
- Missing observability (can't debug)
- No resource limits (runaway costs)
- Hardcoded prompts (can't iterate)
- No testing (high bug risk)
Medium:
- Inefficient token usage
- Missing documentation
- No caching (higher costs)
- Verbose logging
- Code duplication
Low:
- Style inconsistencies
- Missing type hints
- Suboptimal variable names
- Minor optimizations
See refs/issue-taxonomy-reliability-safety.md and refs/issue-taxonomy-quality-testing.md for complete classification guide.
Finding Documentation Template
For each issue, document:
## Issue: [Short Title]
**ID:** ISSUE-001
**Severity:** Critical | High | Medium | Low
**Category:** Reliability | Security | Safety | Cost | Performance | Quality
**Component:** [Which agent/module]
### Description
[What is the issue?]
### Evidence
[Code snippets, logs, metrics]
### Impact
[What are the consequences?]
### Root Cause
[Why does this exist?]
### Recommendation
[How to fix it?]
### Effort Estimate
[Hours/Days/Weeks]
### Priority
[P0/P1/P2/P3]
Tips for Effective Reviews
- Be Systematic: Follow all four phases
- Be Objective: Focus on facts, not opinions
- Be Specific: Provide code examples and evidence
- Be Constructive: Suggest solutions, not just problems
- Be Prioritized: Don't overwhelm with low-priority issues
- Be Clear: Use simple language in reports
References
refs/issue-taxonomy-reliability-safety.mdandrefs/issue-taxonomy-quality-testing.md- Complete issue category reference and anti-pattern detectionrefs/deliverable-templates.md- Detailed report templates and review checklist
Related Skills
mikeparcewski/wicked-garden-engineering-conformance-reviewer
development
VerifiedTrustedCommunity
Pattern-conformance agent-half: evaluates a produced artifact or diff against a set of architectural/design pattern rules from the conformance-rule store (wicked_governance schema). Returns structured findings with rule ID, severity, and rationale — the deterministic half (mechanical rule recall) is done by the guard pipeline; this is the semantic evaluation step. Triggered by: the guard_pipeline `outgov_pattern` check (session-close), or explicitly by an engineering review when WICKED_OUTGOV_RULES_DIR is populated. NOT a replacement for the full `engineering` review skill — focuses only on conformance to stored Pattern rules; architecture and code-quality checks live in the `engineering` skill. Semantic evaluation reuses `wicked-garden-qe-semantic-reviewer` as the designated agent-half evaluator (per garden#983 spec). This skill is the orchestrating wrapper that loads applicable Pattern rules and delegates the per-rule semantic judgment to qe-semantic-reviewer.
8SKILL.mdUpdated Jul 22, 2026
mikeparcewski/wicked-garden-domain
tools
VerifiedTrustedCommunity
The FOUNDATIONAL domain-model capability: extract a codebase's domain — testable business rules (with confidence + provenance), entities, requirements — as a schema-conformant model on the estate graph. The workers annotate the store; wicked-core reads it and builds the requirements graph, coverage-gating fail-closed. Steers three fork workers. A shared substrate, not a modernization tool. The `modernize` archetype DERIVES from it; build / migrate / review / specify / explore consume the SAME domain model — none OWN it. Understanding a codebase's domain is upstream of almost everything else garden does. Use when: "extract the business rules / domain model from this codebase", "build a requirements graph from the code", "what does this system actually require", "reverse-engineer the domain before we build/port/migrate". Works on ANY codebase (modern or legacy) — the value is the domain model, not the porting. NOT the code transform itself (that is the archetype consuming this model). This skill produces the DOMAIN MODEL, not new code.
8SKILL.mdUpdated Jul 15, 2026
mikeparcewski/wicked-garden-domain-modeler
development
VerifiedTrustedCommunity
Domain-graph fork worker for the modernize archetype. Groups the estate's Louvain communities into business domains, attaches each requirement to its cluster (advisory cluster_id provenance), and invokes wicked-core's domain-graph build (which reads the annotated estate store, recomputes coverage fail-closed, and builds the requirements graph) — then validates core's output against the vendored schema. Use when: dispatched by wicked-garden-domain after rule extraction to turn a flat rule set into cluster-keyed domains; "group these into domains", "build the requirements graph", "translate clusters into a domain model". NOT for mining the rules themselves (that is domain-extractor) or threat-modeling (that is domain-coverage).
8SKILL.mdUpdated Jul 15, 2026
mikeparcewski/wicked-garden-domain-extractor
tools
VerifiedTrustedCommunity
Rule-extraction fork worker for the FOUNDATIONAL domain-model capability. Mines testable business rules from a codebase — each with a numeric confidence and a provenance{source, ref, source_kinds} — and annotates them into the estate store so wicked-core can build the domain-model requirements graph (coverage-gated). This is a substrate, not a modernization tool: the `modernize` archetype DERIVES from it, and build / migrate / review / specify / explore can consume the same domain model — none OWN it. Use when: dispatched by wicked-garden-domain to mine the business_rules of a codebase (or a module); "extract the domain rules", "what does this system require", building the requirements half of a domain model. NOT for grouping into domains (that is domain-modeler) or judging coverage (that is domain-coverage — a seat-distinct evaluator).
8SKILL.mdUpdated Jul 15, 2026