ss-sdd-receiving-review-findings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ss-sdd-receiving-review-findings (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Review feedback is input to evaluate, not orders to follow. The coordinator's job is to read the findings carefully, verify they're real, fix what's real, push back on what isn't, and surface to the user anything that needs human judgment.
Core principle: Verify before fixing. No performative agreement. Technical correctness over social comfort.
Announce at start: "I'm using the ss-sdd-receiving-review-findings skill to process the reviewer's findings."
The coordinator loads this skill inline whenever the spec-review subagent returns output:
This skill does NOT cover the final implementation review — ss-sdd-implementing-plans handles that with its own re-dispatch-implementer loop. That review delegates fixes to a fresh implementer; this skill is about the coordinator directly handling the spec artifact.
.sublime-skills/state.json. It is permanently gitignored. Do NOT bypass via git add -f, --force, git update-index, or any other mechanism. See state-schema.md "Git policy" for the full list.Read the entire findings report end-to-end before opening any file to edit. Why: findings can be related; partial reading leads to fix-then-undo cycles.
The reviewer skill puts findings in CRITICAL / HIGH / MEDIUM / LOW buckets. Treat them as:
| Severity | Treatment |
|---|---|
| CRITICAL | Must be addressed. Verify, then fix or push back. Block stage advance until resolved. |
| HIGH | Must be addressed. Same as CRITICAL. |
| MEDIUM | Advisory. Fix if trivial. Otherwise add to spec/plan Open Questions section or accept and document. |
| LOW | Note. Usually skip. Fix only if it's a one-character correction. |
If the reviewer mis-categorized something obviously (e.g., a typo flagged as CRITICAL), don't escalate it back to them — just treat it at the right level. Reviewers can be miscalibrated; you're the next reader.
For each CRITICAL or HIGH finding:
Forbidden response patterns:
If you're fixing a finding:
.tmp, then mv) for any artifact edit.Push back when:
How to push back:
{
"reviewer_pushbacks": [
{
"stage": "spec_auto_review",
"finding": "<short identifier>",
"reason": "<your technical reasoning>"
}
]
}If you applied fixes to address CRITICAL or HIGH findings, re-dispatch the same reviewer (per the stage's protocol — typically capped at 2 fix iterations before escalating to user).
If you only made MEDIUM/LOW changes (or only pushed back), no re-dispatch is needed; proceed to next stage.
Some findings require the user, not the coordinator. Surface them when:
Format:
"The reviewer found <N> CRITICAL/HIGH issues I can't resolve without your input:
>
1. <Finding summary>: <Why it needs your input> 2. ...
>
Options: - Address them now (tell me what to do for each) - Return to the spec stage and revise — I'll re-run discovery if needed - Override the reviewer (you'll need to give a reason; it goes in reviewer_pushbacks)"Wait for the user's direction.
The spec/plan review fix-loop is capped at 2 iterations (a hard ceiling — not config-overridable). At cap hit, you have:
At this point, do NOT iterate further. The pattern of unresolved findings says one of:
Surface to user explicitly with the full history. Format:
"Spec review hit its fix-loop cap (2 iterations) with unresolved findings.
>
Fix history: - Iteration 1: reviewer flagged [N] CRITICAL/HIGH. Coordinator applied: [brief summary]. Re-review: [N] new/remaining issues. - Iteration 2: applied [brief summary]. Re-review: [N] still flagged.
>
Currently unresolved (CRITICAL/HIGH only): 1. <Finding summary> — <last attempted fix and why it didn't satisfy the reviewer> 2. ...
>
Options: 1. Iterate with my guidance — you tell me exactly how to address each finding; I apply your edits literally (no further evaluation), commit, and we move on without another auto-review 2. Override the reviewer — you say why each finding doesn't actually apply; I record each push-back inreviewer_pushbacks(with your reason) and we advance to the next stage 3. Accept the current state — proceed despite unresolved findings; I record them inreviewer_pushbacksas 'accepted with known issues' and advance 4. Abort the stage — pause the SDD run; you investigate manually and tell me to continue when ready"
Wait for user's selection. Whatever they choose:
.sublime-skills/state.json: {
"spec_auto_review_iterations": 2,
"reviewer_pushbacks": [
{ "stage": "spec_auto_review", "finding": "<id>", "reason": "<user-provided or 'cap-hit-iterate-with-guidance'>" }
]
}After processing, update the state file (atomic write) with any tracked information:
{
"<stage>_review_iterations": <N>,
"reviewer_pushbacks": [...],
"updated_at": "<ISO-8601 timestamp>"
}Do NOT commit. .sublime-skills/state.json is permanently gitignored and NEVER committed at any stage — not at Stage 7, not at Stage 8, not ever. Atomic writes update the file in place; do not git add -f or otherwise bypass the ignore.
| Mistake | Fix |
|---|---|
| Performative agreement ("great point!") | State the fix or push back; no agreement theater |
| Reading findings and immediately editing without verification | Always verify against artifact + project context first |
| Fixing CRITICAL while ignoring HIGH because "I'll batch the HIGHs" | Each CRITICAL/HIGH gets per-item evaluation; no batching to defer real work |
| Treating LOW findings as required | LOW is "could fix"; usually skip |
| Re-dispatching reviewer after every minor change | Only re-dispatch if material changes (CRITICAL/HIGH fixes); MEDIUM/LOW alone don't warrant re-review |
| Silently dismissing a finding without documenting why | Push-backs go in reviewer_pushbacks in state file; never silent |
| Looping more than the stage's cap without escalating | Each stage has a cap (typically 2-3); escalate to user when hit |
Force-adding state.json with git add -f | NEVER. Zero exceptions. |
Editing .sublime-skills/.gitignore mid-pipeline | NEVER. The ignore is permanent. |
git add -f .sublime-skills/state.json → STOP.sublime-skills/.gitignore → STOP~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.