raisedadead/review
plugins/dp-cto/skills/review/SKILL.md
Use when code changes are ready for quality review, after implementation completes, or before committing — 'review this', 'check quality', 'what needs fixing'.
$ install --global
skillsauthnpx skillsauth add raisedadead/dotplugins reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 26, 2026, 10:34 AM39.7s5 files scanned
SKILL.md
- name:
- review
- description:
- Use when code changes are ready for quality review, after implementation completes, or before committing — 'review this', 'check quality', 'what needs fixing'.
- user-invocable:
- true
CTO Review
<!-- Two-layer deep-reasoning signal: reviewer.md frontmatter `effort: high` sets agent-scope depth; this keyword sets skill-scope depth when the skill body is loaded without agent dispatch. Both are intentional. -->Use ultrathink when reviewing — false positives waste cycles, missed findings ship bugs.
Current Stage
!"${CLAUDE_PLUGIN_ROOT}/bin/dp-engine" state 2>/dev/null || printf '{"stage":"idle","epic_id":""}'
Mode Detection
Detect the current dp-cto stage to infer the appropriate review mode (use the stage from the preprocessing output above):
"${CLAUDE_PLUGIN_ROOT}/bin/dp-engine" state 2>/dev/null
Returns JSON {"stage":"X","epic_id":"Y"}. If it fails or returns empty, treat as idle.
Stage → mode mapping:
| Stage | Mode | Rationale |
| ------------------------------ | -------- | ---------------------------------- |
| planned | pushback | Plan just completed — challenge it |
| running or reviewing | full | Code changes to review |
| complete | sweep | Final cleanup pass |
| idle / suspended / unknown | — | Present menu (see below) |
When stage is ambiguous or idle, use AskUserQuestion with options: Quick / Full / Sweep / Pushback.
When args are non-empty (internal invocation from orchestrator), use the args as the mode hint directly (e.g., args pushback → pushback mode).
Preflight Health Probes
Surface tracker doctor + rules audit before review begins. Non-blocking advisory — review proceeds regardless of findings. Treat output as context, not gate.
!"${CLAUDE_PLUGIN_ROOT}/bin/dp-engine" doctor-agent --json 2>&1 | head -40
!"${CLAUDE_PLUGIN_ROOT}/bin/dp-engine" rules-audit --json 2>&1 | head -40
Load Shared Constraints
Read ${CLAUDE_PLUGIN_ROOT}/shared/cto-boundaries.md
Read ${CLAUDE_PLUGIN_ROOT}/shared/evidence-grounding.md
Load Mode-Specific Reference
Based on the selected mode, load the corresponding reference file:
- quick: Read
${CLAUDE_SKILL_DIR}/references/review-quick.md - full: Read
${CLAUDE_SKILL_DIR}/references/review-full.md - sweep: Read
${CLAUDE_SKILL_DIR}/references/review-sweep.md - pushback: Read
${CLAUDE_SKILL_DIR}/references/review-pushback.md
Follow the protocol described in the loaded reference file.
Mode Summary
Quick -- Single-lens focused review. Pick one lens (security, simplification, test gaps, linting, performance, or docs). Run one reviewer, collect findings, triage, and present.
Full -- Multi-perspective review across 2-3 parallel lenses (primary + adversarial). Collect findings from both, deduplicate by file:line, consolidate into a single report, and run fix rounds for CRITICAL and WARNING items.
Sweep -- Entropy management scan. Detect drift across dead code, inconsistent patterns, stale comments, and naming violations. Fix CRITICAL and WARNING drift; report SUGGESTION items.
Pushback -- Adversarial challenge of proposals, plans, or recommendations. Assess scope validity, feasibility risks, and evidence gaps. Verify claims before accepting.
NEVER
- NEVER review or fix code in the main thread -- always use specialist reviewers
- NEVER skip the quality gate after applying fixes
- NEVER auto-invoke follow-up skills -- present results and let the user decide
- NEVER combine multiple modes in a single invocation -- run one mode at a time
- NEVER inflate severity -- ground findings in evidence per shared constraints
Related Skills
raisedadead/self-develop
development
VerifiedTrustedCommunity
Use when the user shares a URL, names a resource from SOURCES.md, shares operational feedback, says 'adopt', 'learn from', 'what can we steal from', 'compare with', 'self-develop', or 'how do we get better'.
4SKILL.mdUpdated Apr 18, 2026
raisedadead/setup
tools
VerifiedTrustedCommunity
Use when you need to set up or rebuild the dp-lsp Docker image after installing the plugin — 'set up LSP', 'build the image', 'install language servers'.
4SKILL.mdUpdated Apr 18, 2026
raisedadead/tdd
development
VerifiedTrustedCommunity
Use when you want to write tests first, enforce test-driven development, or add test coverage — 'write tests for this', 'TDD this feature', 'add test coverage'. Strict RED-GREEN-REFACTOR discipline.
4SKILL.mdUpdated Apr 18, 2026
raisedadead/spec
testing
VerifiedTrustedCommunity
Use when starting major work that needs formal design review — cross-team changes, architectural decisions, or complex features where requirements need discovery before implementation.
4SKILL.mdUpdated Apr 18, 2026