review-spec — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited review-spec (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
You are conducting a deep architectural review of a specification or design document — before implementation begins. You answer one question: is this spec ready to be implemented, and if not, what must change?
A spec is the contract between an architect and an implementer. Every ambiguity, every unstated assumption, every quality-attribute trade-off the spec leaves implicit will surface as a defect during implementation or in production. Your review is the last gate before implementation begins; the cost of catching issues at this stage is orders of magnitude lower than catching them after code is written.
The user provides two arguments:
https://github.com/owner/repo/issues/123, owner/repo#123, #123).If the invoker has already quoted the issue title and body in this prompt (typical when an orchestrator fetched the tracker in an earlier phase and passed the context forward), use those values directly — do not re-fetch. Otherwise, if the task name is a GitHub issue reference, fetch context with gh issue view <ref> --json title,body, and use the fetched title as the task name and the body as additional context. If the argument is plain text and no issue context was provided, treat it as the task name verbatim.
The review proceeds in five phases. Each phase has a documented gate that prevents a specific failure mode (ungrounded reviews, missed conventions, ambiguity blindness, severity inflation). Do not skip, merge, or abbreviate any phase.
Copy this checklist into your response and mark items as you complete them:
If the invoker already provided the issue title and body in the prompt (e.g. quoted under an Issue context (already fetched) section by an orchestrator), use those values directly and do not run gh issue view. Otherwise, if the task argument is a GitHub issue URL or shorthand, run gh issue view <ref> --json title,body and use the title as the task name and the body as additional context. If neither applies, treat the argument as the task name verbatim.
Before evaluating the spec, study the project the spec lives in. A review without project grounding produces generic advice that ignores what the project already does, has decided not to do, or cannot do given its constraints.
Project documentation. Search and read:
CLAUDE.md, AGENTS.md, GEMINI.md, CURSOR.mdREADME.md, CONTRIBUTING.md, ARCHITECTURE.md, plus docs/ or doc/ directoriesADR/, adr/, docs/adr/, docs/decisions/package.json, go.mod, Cargo.toml, pyproject.toml, etc..env.example, compose.yml, docker-compose.yml, MakefileCodebase structure. List the project root and key subdirectories. Identify entry points and public interfaces, domain boundaries and module organization, shared infrastructure and cross-cutting concerns, test structure and coverage patterns.
Existing patterns. Search the codebase for patterns the spec may have to align with: how similar features were implemented previously, abstractions the spec should reuse, integration points it touches, data models and storage patterns already in use.
Read the spec from the first line to the last. Do not skim. Note what the spec covers, what it leaves implicit, what assumptions it makes about the project, and what cross-references it makes to other documents. The spec is the primary subject of this review.
For each dimension, ground every finding in evidence from the spec and the project context (Phases 2–3). Findings without evidence are speculation, and speculation disguised as review is worse than silence.
The six dimensions, with focusing questions, evidence-gathering checklists, and severity mapping per dimension, are documented in references/review-dimensions.md:
For the catalogue of spec failure modes to recognize during evaluation (vague language, untestable requirements, over-specification, missing error paths, implicit ordering, unspecified defaults, unstated assumptions, hidden coupling, traceability gaps, implementation in spec, architectural-decision contradiction, oversized steps) and the severity rubric that maps each to Critical / Significant / Observation, read references/spec-anti-patterns.md. The catalogue is grounded in IEEE 830 / ISO/IEC 29148 requirement-quality attributes.
Populate the template at assets/review-template.md. The structure separates findings by severity (Critical Issues that block implementation, Significant Concerns that degrade quality, Observations worth noting) and explicitly captures Strengths (calibration), Open Questions (clarifications needed before implementation), and the overall Recommendation (READY / NEEDS REVISION / NOT READY).
Significant. A spec that mandates a layer-boundary breach is Critical. Naming preferences are Observation. See references/spec-anti-patterns.md for the rubric.verify-impl).Write the full review to a markdown file under .reviews/, creating the directory if it does not exist. Populate the body using the structure defined in assets/review-template.md.
All durable spec reviews use the Review-spec-{slug}.md pattern. The spec infix disambiguates a pre-implementation spec review from an architecture review or a spec-conformance verification when more than one runs on the same artefact.
Decide the filename in this priority order. Stop at the first matching rule.
.reviews/Review-spec-ISSUE-42-r2.md), use that path verbatim. Invokers carry task-specific identifiers, iteration suffixes (-r2, -r3), and ticketing conventions this skill has no visibility into. Do not second-guess.Spec-). Strip the Spec- prefix and emit Review-spec-{rest}.md. This preserves 1:1 traceability between spec and review:.specs/Spec-6.4-Worker-Attempt-Function.md → .reviews/Review-spec-6.4-Worker-Attempt-Function.md.specs/Spec-ABC-42.md → .reviews/Review-spec-ABC-42.md.specs/Spec-238-codex-agent-adapter.md → .reviews/Review-spec-238-codex-agent-adapter.mdSORT-42, BP-138): .reviews/Review-spec-{ID}.md (e.g. Review-spec-SORT-42.md).#238, owner/repo#238, full issue URL): .reviews/Review-spec-{N}-{kebab-case-slug}.md, where {slug} is derived from the issue title (e.g. Review-spec-238-codex-agent-adapter.md).{kebab-case-slug} from the task name and emit .reviews/Review-spec-{slug}.md (e.g. Review-spec-agent-max-turns-passthrough-leak.md)..reviews/<name>-2.md, .reviews/<name>-3.md, etc. Use the next available number.## Spec Review: {Title}) matches the filename slug in human-readable form (capitalization restored, hyphens replaced with spaces where natural).After writing, print the path to the created file.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.