helpers/skills/adr-review/SKILL.md
Review an Architectural Decision Record (ADR) using a team of six specialist reviewer subagents and produce a consolidated report as both PDF and PPTX slide deck. Use this skill whenever the user asks to review, critique, audit, or get feedback on an ADR, architecture decision, design doc, or RFC — whether the input is a Markdown file, a .docx document, or pasted text. Trigger even if the user does not explicitly say "ADR"; phrases like "review this architecture decision", "critique this design doc", or "run the reviewer panel on this" should also invoke this skill.
npx skillsauth add opendatahub-io/ai-helpers adr-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
This skill runs a panel of specialist reviewer subagents over an Architectural Decision Record (ADR) and produces a consolidated report in two formats: a PDF document and a PPTX slide deck.
Architecture reviews benefit from multiple independent perspectives. A single reviewer tends to anchor on whichever concern they noticed first and under-weight the others. By running specialists in parallel, each focused on one dimension, we get broader, less-biased coverage — and the synthesis step surfaces tensions between perspectives (e.g. "the cheapest option is also the least reversible") that a single reviewer might flatten.
Always ask the user where the ADR is, even if there's a plausible file in context. Accepted inputs:
.md, .markdown).docx)If the user provides a .docx, extract the text first using the document-skills:docx skill or python-docx. If they provide Markdown, read it directly.
Use the AskUserQuestion tool to gather any clarifying context the reviewers will need. Ask in a single AskUserQuestion call with multiple questions rather than one-at-a-time. Tailor the questions to what is actually unclear after a quick skim of the ADR — don't ask boilerplate. Typical useful questions:
Pass the answers into each reviewer subagent's prompt as a "Review context from the user" block so every reviewer sees the same framing.
Read the file and extract the key sections (context, decision, alternatives considered, consequences). ADRs vary in format (MADR, Nygard, custom) — don't require a specific structure, just pull out what's there. If a section is missing, note it; that absence is itself a finding the reviewers should know about.
Spawn six reviewer subagents in parallel using the Agent tool. Each gets the full ADR text plus its role-specific prompt from references/reviewer_prompts.md. Launch all six in a single message — do not serialize them.
The six reviewers are:
Each reviewer must return a structured finding in this shape:
## [Reviewer Name]
**Overall assessment:** [Strong / Acceptable / Concerns / Blocking]
**Strengths:** [bullets]
**Concerns:** [bullets, each with the structure below]
**Open questions:** [bullets]
**Recommendations:** [bullets]
Each concern must include enough detail for an architect unfamiliar with the review to understand the issue and act on it. Use this structure per concern:
- **[severity: low / med / high] [Short title]**
_What:_ One or two sentences describing the specific gap or problem found in the ADR.
_So what:_ Why this matters — the concrete consequence if the ADR is accepted without addressing it (e.g., implementer confusion, production risk, blocked downstream ADR).
_Suggested fix:_ What the author should add, change, or clarify in the document to resolve it. Be specific enough that the author can act without re-reading the full review.
This level of detail applies to both the PDF report and Step 3.5 (human-in-the-loop review). The user needs the full What / So what / Suggested fix context to make informed agree/disagree decisions. Only the PPTX should use short-form bullets (title + severity) to stay scannable for meetings.
Before synthesizing or generating any report, walk the user through the reviewers' findings and let them correct the record. This step exists because the reviewers are operating with limited context — the user often knows things (prior decisions, team dynamics, constraints that didn't make it into the doc) that would change whether a finding is valid.
Present the findings grouped by reviewer. For each reviewer, show:
Then use the AskUserQuestion tool to collect the user's agree/disagree judgment. Batch the questions — don't spam one call per concern. A reasonable approach:
Apply the user's corrections to the findings before synthesis:
The corrected findings — not the raw ones — are what feed into synthesis.
Once all six reviewers return, synthesize their findings into an overall report. The synthesis is not just concatenation — look for:
Create a adr-review/ subdirectory next to the input ADR file. Write outputs there:
adr-review/<adr-name>-review.pdfadr-review/<adr-name>-review.pptxPDF structure — use the document-skills:pdf skill (or reportlab directly if the skill isn't available):
The PDF is the detailed, self-contained artifact. Err on the side of too much context per concern rather than too little — the reader may not have been in the review conversation.
PPTX structure — use the document-skills:pptx skill (or python-pptx directly if the skill isn't available). Follow the styling rules in references/report_templates.md (color palette, typography, slide layout) to produce a clean, professional deck — not plain white slides with default fonts:
Keep slides scannable — bullets, not paragraphs. The PDF is the detailed artifact; the deck is for a 10-minute review meeting.
Tell the user where the outputs landed and give a brief summary (overall recommendation + top risks) inline so they don't have to open the files to get the gist.
references/reviewer_prompts.md — The full role prompt for each of the six reviewer subagents. Read this when dispatching the panel.references/report_templates.md — PDF and PPTX structure templates with example content.tools
Use this skill to filter a pre-fetched set of Hacker News stories down to those that report supply-chain security threats relevant to software developers — including malicious packages on npm or PyPI, compromised developer tooling, and attacks targeting source code repositories or CI/CD infrastructure. Reads stories from stories.json in the workspace, performs semantic analysis (fetching HN threads when the title alone is ambiguous), and writes the stories worth alerting on to findings.json.
development
Run hexora static analysis on a Python package repository to detect suspicious code patterns, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.
development
Inspect recent git history of a Python package repository for suspicious commits touching supply-chain-sensitive files, then triage findings with AI reasoning to produce a structured risk report section.
development
Scan a Python package repository for compiled/binary files using Fromager-style detection and malcontent YARA analysis, then triage findings with deterministic rules and AI reasoning to produce a structured risk report section.