devex-review — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited devex-review (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use when asked to "test the DX", "DX audit", "developer experience test", or "try the onboarding".
Proactively suggest after shipping a developer-facing feature.
Voice triggers (speech-to-text aliases): "dx audit", "test the developer experience", "try the onboarding", "developer experience test".
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)" 2>/dev/null || SLUG="unknown"
_LEARN_FILE="${VIBESTACK_HOME:-$HOME/.vibestack}/projects/${SLUG:-unknown}/learnings.jsonl"
if [ -f "$_LEARN_FILE" ]; then
_LEARN_COUNT=$(wc -l < "$_LEARN_FILE" 2>/dev/null | tr -d ' ')
echo "LEARNINGS: $_LEARN_COUNT entries loaded"
if [ "$_LEARN_COUNT" -gt 5 ] 2>/dev/null; then
~/.vibestack/bin/vibe-learnings-search --limit 5 2>/dev/null || true
fi
else
echo "LEARNINGS: none yet"
fi{{include lib/snippets/session-host.md}}
{{include lib/snippets/decision-brief.md}}
{{include lib/snippets/working-protocols.md}}
{{include lib/snippets/state-protocols.md}}
First, detect the git hosting platform from the remote URL:
git remote get-url origin 2>/dev/nullgh auth status 2>/dev/null succeeds → platform is GitHub (covers GitHub Enterprise)glab auth status 2>/dev/null succeeds → platform is GitLab (covers self-hosted)Determine which branch this PR/MR targets, or the repo's default branch if no PR/MR exists. Use the result as "the base branch" in all subsequent steps.
If GitHub:
gh pr view --json baseRefName -q .baseRefName — if succeeds, use itgh repo view --json defaultBranchRef -q .defaultBranchRef.name — if succeeds, use itIf GitLab:
glab mr view -F json 2>/dev/null and extract the target_branch field — if succeeds, use itglab repo view -F json 2>/dev/null and extract the default_branch field — if succeeds, use itGit-native fallback (if unknown platform, or CLI commands fail):
git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's|refs/remotes/origin/||'git rev-parse --verify origin/main 2>/dev/null → use maingit rev-parse --verify origin/master 2>/dev/null → use masterIf all fail, fall back to main.
Print the detected base branch name. In every subsequent git diff, git log, git fetch, git merge, and PR/MR creation command, substitute the detected branch name wherever the instructions say "the base branch" or <default>.
# vibestack does not include a browse daemon.
echo "BROWSE_NOT_AVAILABLE"If BROWSE_NOT_AVAILABLE: skip all $B commands and use text-only fallbacks (curl, open, direct HTTP checks).
These are the laws. Every recommendation traces back to one of these.
| # | Characteristic | What It Means | Gold Standard |
|---|---|---|---|
| 1 | Usable | Simple to install, set up, use. Intuitive APIs. Fast feedback. | Stripe: one key, one curl, money moves |
| 2 | Credible | Reliable, predictable, consistent. Clear deprecation. Secure. | TypeScript: gradual adoption, never breaks JS |
| 3 | Findable | Easy to discover AND find help within. Strong community. Good search. | React: every question answered on SO |
| 4 | Useful | Solves real problems. Features match actual use cases. Scales. | Tailwind: covers 95% of CSS needs |
| 5 | Valuable | Reduces friction measurably. Saves time. Worth the dependency. | Next.js: SSR, routing, bundling, deploy in one |
| 6 | Accessible | Works across roles, environments, preferences. CLI + GUI. | VS Code: works for junior to principal |
| 7 | Desirable | Best-in-class tech. Reasonable pricing. Community momentum. | Vercel: devs WANT to use it, not tolerate it |
Internalize these; don't enumerate them.
Button("Save") { save() }\ → full customization, same API.| Score | Meaning |
|---|---|
| 9-10 | Best-in-class. Stripe/Vercel tier. Developers rave about it. |
| 7-8 | Good. Developers can use it without frustration. Minor gaps. |
| 5-6 | Acceptable. Works but with friction. Developers tolerate it. |
| 3-4 | Poor. Developers complain. Adoption suffers. |
| 1-2 | Broken. Developers abandon after first attempt. |
| 0 | Not addressed. No thought given to this dimension. |
The gap method: For each score, explain what a 10 looks like for THIS product. Then fix toward 10.
| Tier | Time | Adoption Impact |
|---|---|---|
| Champion | < 2 min | 3-4x higher adoption |
| Competitive | 2-5 min | Baseline |
| Needs Work | 5-10 min | Significant drop-off |
| Red Flag | > 10 min | 50-70% abandon |
During each review pass, load the relevant section from: \~/.claude/skills/plan-devex-review/dx-hall-of-fame.md\
Read ONLY the section for the current pass (e.g., "## Pass 1" for Getting Started). Do NOT read the entire file at once. This keeps context focused.
Browse can test web-accessible surfaces: docs pages, API playgrounds, web dashboards, signup flows, interactive tutorials, error pages.
Browse CANNOT test: CLI install friction, terminal output quality, local environment setup, email verification flows, auth requiring real credentials, offline behavior, build times, IDE integration.
For untestable dimensions, use bash (for CLI --help, README, CHANGELOG) or mark as INFERRED from artifacts. Never guess. State your evidence source for every score.
If URLs are missing, AskUserQuestion: "What's the URL for the docs/product I should test?"
Check for prior /plan-devex-review scores:
eval "$(~/.vibestack/bin/vibe-slug 2>/dev/null)"
true # vibe-review-read 2>/dev/null | grep plan-devex-review || echo "NO_PRIOR_PLAN_REVIEW"If prior scores exist, display them. These are your baseline for the boomerang comparison.
Navigate to the docs/landing page via browse. Screenshot it.
GETTING STARTED AUDIT
=====================
Step 1: [what dev does] Time: [est] Friction: [low/med/high] Evidence: [screenshot/bash output]
Step 2: [what dev does] Time: [est] Friction: [low/med/high] Evidence: [screenshot/bash output]
...
TOTAL: [N steps, M minutes]Score 0-10. Load "## Pass 1" from dx-hall-of-fame.md for calibration.
Test what you can:
--help via bash. Evaluate output quality, flag design, discoverability.Score 0-10. Load "## Pass 2" from dx-hall-of-fame.md for calibration.
Trigger common error scenarios:
Screenshot each error. Score against the Elm/Rust/Stripe three-tier model.
Score 0-10. Load "## Pass 3" from dx-hall-of-fame.md for calibration.
Navigate the docs structure via browse:
Screenshot key findings. Score 0-10. Load "## Pass 4" from dx-hall-of-fame.md.
Read via bash:
Score 0-10. Evidence: INFERRED from files. Load "## Pass 5" from dx-hall-of-fame.md.
Read via bash:
Score 0-10. Evidence: INFERRED from files. Load "## Pass 6" from dx-hall-of-fame.md.
Browse:
Score 0-10. Evidence: TESTED where web-accessible, INFERRED otherwise.
Check for feedback mechanisms:
Score 0-10. Evidence: INFERRED from files/pages.
+====================================================================+
| DX LIVE AUDIT — SCORECARD |
+====================================================================+
| Dimension | Score | Evidence | Method |
|----------------------|--------|----------|----------|
| Getting Started | __/10 | [screenshots] | TESTED |
| API/CLI/SDK | __/10 | [screenshots] | PARTIAL |
| Error Messages | __/10 | [screenshots] | PARTIAL |
| Documentation | __/10 | [screenshots] | TESTED |
| Upgrade Path | __/10 | [file refs] | INFERRED |
| Dev Environment | __/10 | [file refs] | INFERRED |
| Community | __/10 | [screenshots] | TESTED |
| DX Measurement | __/10 | [file refs] | INFERRED |
+--------------------------------------------------------------------+
| TTHW (measured) | __ min | [step count] | TESTED |
| Overall DX | __/10 | | |
+====================================================================+If /plan-devex-review scores exist from the baseline check:
PLAN vs REALITY
================
| Dimension | Plan Score | Live Score | Delta | Alert |
|------------------|-----------|-----------|-------|-------|
| Getting Started | __/10 | __/10 | __ | ⚠/✓ |
| API/CLI/SDK | __/10 | __/10 | __ | ⚠/✓ |
| Error Messages | __/10 | __/10 | __ | ⚠/✓ |
| Documentation | __/10 | __/10 | __ | ⚠/✓ |
| Upgrade Path | __/10 | __/10 | __ | ⚠/✓ |
| Dev Environment | __/10 | __/10 | __ | ⚠/✓ |
| Community | __/10 | __/10 | __ | ⚠/✓ |
| DX Measurement | __/10 | __/10 | __ | ⚠/✓ |
| TTHW | __ min | __ min | __ min| ⚠/✓ |Flag any dimension where live score < plan score - 2 (reality fell short of plan).
PLAN MODE EXCEPTION — ALWAYS RUN:
true # vibe-review-log '{"skill":"devex-review","timestamp":"TIMESTAMP","status":"STATUS","overall_score":N,"product_type":"TYPE","tthw_measured":"TTHW","dimensions_tested":N,"dimensions_inferred":N,"boomerang":"YES_OR_NO","commit":"COMMIT"}'{{include lib/snippets/review-readiness-dashboard.md}}
After displaying the Review Readiness Dashboard in conversation output, also update the plan file itself so review status is visible to anyone reading the plan.
paths in system messages — look for plan file references in the conversation context).
Read the review log output you already have from the Review Readiness Dashboard step above. Parse each JSONL entry. Each skill logs different fields:
status\, \unresolved\, \critical_gaps\, \mode\, \scope_proposed\, \scope_accepted\, \scope_deferred\, \commit\→ Findings: "{scope_proposed} proposals, {scope_accepted} accepted, {scope_deferred} deferred" → If scope fields are 0 or missing (HOLD/REDUCTION mode): "mode: {mode}, {critical_gaps} critical gaps"
status\, \unresolved\, \critical_gaps\, \issues_found\, \mode\, \commit\→ Findings: "{issues_found} issues, {critical_gaps} critical gaps"
status\, \initial_score\, \overall_score\, \unresolved\, \decisions_made\, \commit\→ Findings: "score: {initial_score}/10 → {overall_score}/10, {decisions_made} decisions"
status\, \initial_score\, \overall_score\, \product_type\, \tthw_current\, \tthw_target\, \mode\, \persona\, \competitive_tier\, \unresolved\, \commit\→ Findings: "score: {initial_score}/10 → {overall_score}/10, TTHW: {tthw_current} → {tthw_target}"
status\, \overall_score\, \product_type\, \tthw_measured\, \dimensions_tested\, \dimensions_inferred\, \boomerang\, \commit\→ Findings: "score: {overall_score}/10, TTHW: {tthw_measured}, {dimensions_tested} tested/{dimensions_inferred} inferred"
status\, \gate\, \findings\, \findings_fixed\→ Findings: "{findings} findings, {findings_fixed}/{findings} fixed"
All fields needed for the Findings column are now present in the JSONL entries. For the review you just completed, you may use richer details from your own Completion Summary. For prior reviews, use the JSONL fields directly — they contain all required data.
Produce this markdown table:
\\\`markdown
| Review | Trigger | Why | Runs | Status | Findings |
|---|---|---|---|---|---|
| CEO Review | \/plan-ceo-review\ | Scope & strategy | {runs} | {status} | {findings} |
| Codex Review | \/codex review\ | Independent 2nd opinion | {runs} | {status} | {findings} |
| Eng Review | \/plan-eng-review\ | Architecture & tests (required) | {runs} | {status} | {findings} |
| Design Review | \/plan-design-review\ | UI/UX gaps | {runs} | {status} | {findings} |
| DX Review | \/plan-devex-review\ | Developer experience gaps | {runs} | {status} | {findings} |
\\\`
Below the table, add these lines:
If Eng Review is not CLEAR and not skipped globally, append "eng review required".
{{include lib/snippets/unresolved-decisions-status.md}}
PLAN MODE EXCEPTION — ALWAYS RUN: This writes to the plan file, which is the one file you are allowed to edit in plan mode. The plan file review report is part of the plan's living status.
## VIBESTACK REVIEW REPORT\ section anywhere in the file(not just at the end — content may have been added after it).
## VIBESTACK REVIEW REPORT\through either the next \## \ heading or end of file, whichever comes first. This ensures content added after the report section is preserved, not eaten. If the Edit fails (e.g., concurrent edit changed the content), re-read the plan file and retry once.
move it: delete the old location and append at the end.
{{include lib/snippets/capture-learnings.md}}
After the audit, recommend:
{{include lib/snippets/exit-plan-mode-gate.md}}
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.