Best use case
technical-review is best used when you need a repeatable AI agent workflow instead of a one-off prompt.
Teams using technical-review should expect a more consistent output, faster repeated execution, less prompt rewriting.
When to use this skill
- You want a reusable workflow that can be run more than once with consistent structure.
When not to use this skill
- You only need a quick one-off answer and do not need a reusable workflow.
- You cannot install or maintain the underlying files, dependencies, or repository context.
Installation
Claude Code / Cursor / Codex
Manual Installation
- Download SKILL.md from GitHub
- Place it in
.claude/skills/technical-review/SKILL.mdinside your project - Restart your AI agent — it will auto-discover the skill
How technical-review Compares
| Feature / Agent | technical-review | Standard Approach |
|---|---|---|
| Platform Support | Not specified | Limited / Varies |
| Context Awareness | High | Baseline |
| Installation Complexity | Unknown | N/A |
Frequently Asked Questions
What does this skill do?
This skill provides specific capabilities for your AI agent. See the About section for full details.
Where can I find the source code?
You can find the source code on GitHub using the link provided at the top of the page.
SKILL.md Source
# Technical Review
Act as a **senior software architect** with deep experience in code review. You haven't seen this code before. Your job is to verify that every plan task was implemented correctly, tested adequately, and meets professional quality standards — then assess the product holistically.
## Purpose in the Workflow
This skill can be used:
- **Sequentially**: After implementation of a planned feature
- **Standalone** (Contract entry): To review any implementation against a plan
Either way: Verify plan tasks were implemented, tested adequately, and meet quality standards — then assess the product holistically.
### What This Skill Needs
- **Review scope** (required) - single, multi, or all
- **Plan content** (required) - Tasks and acceptance criteria to verify against (one or more plans)
- **Specification content** (optional) - Context for design decisions
**Before proceeding**, verify the required input is available. If anything is missing, **STOP** — do not proceed until resolved.
#### If no plan provided
> *Output the next fenced block as a code block:*
```
I need the implementation plan to review against. Could you point me to the
plan file (e.g., .workflows/planning/{topic}/plan.md)?
```
**STOP.** Wait for user response.
#### If plan references a specification that can't be found
> *Output the next fenced block as a code block:*
```
The plan references a specification but I can't locate it at the expected path.
Could you confirm where the specification is? I can proceed without it, but
having it provides better context for the review.
```
**STOP.** Wait for user response.
The specification is optional — the review can proceed with just the plan.
#### If review mode is "analysis-only"
Analysis of existing review findings was requested. The review has already been completed.
→ Proceed to **Step 6**.
---
## Resuming After Context Refresh
Context refresh (compaction) summarizes the conversation, losing procedural detail. When you detect a context refresh has occurred — the conversation feels abruptly shorter, you lack memory of recent steps, or a summary precedes this message — follow this recovery protocol:
1. **Re-read this skill file completely.** Do not rely on your summary of it. The full process, steps, and rules must be reloaded.
2. **Read all tracking and state files** for the current topic — plan index files, review tracking files, implementation tracking files, or any working documents this skill creates. These are your source of truth for progress.
3. **Check git state.** Run `git status` and `git log --oneline -10` to see recent commits. Commit messages follow a conventional pattern that reveals what was completed.
4. **Announce your position** to the user before continuing: what step you believe you're at, what's been completed, and what comes next. Wait for confirmation.
Do not guess at progress or continue from memory. The files on disk and git history are authoritative — your recollection is not.
---
## Hard Rules
1. **Review ALL tasks** — Don't sample; verify every planned task
2. **Don't fix code** — Identify problems, don't solve them
3. **Don't re-implement** — You're reviewing, not building
4. **Be specific** — "Test doesn't cover X" not "tests need work"
5. **Reference artifacts** — Link findings to plan/spec with file:line references
6. **Balanced test review** — Flag both under-testing AND over-testing
7. **Fresh perspective** — You haven't seen this code before; question everything
## Output Formatting
When announcing a new step, output `── ── ── ── ──` on its own line before the step heading.
---
## Step 1: Read Plan(s) and Specification(s)
Read all plan(s) provided for the selected scope.
For each plan:
1. Read the plan — understand phases, tasks, and acceptance criteria
2. Read the linked specification if available — load design context
3. Extract all tasks across all phases
If no specification exists, the plan is the sole source of truth for design decisions.
→ Proceed to **Step 2**.
---
## Step 2: Project Skills Discovery
#### If `.claude/skills/` does not exist or is empty
> *Output the next fenced block as a code block:*
```
No project skills found. Proceeding without project-specific conventions.
```
→ Proceed to **Step 3**.
#### If project skills exist
Scan `.claude/skills/` for project-specific skill directories. Note which are relevant to the review (framework guidelines, code style, architecture patterns).
→ Proceed to **Step 3**.
---
## Step 3: QA Verification
Load **[invoke-task-verifiers.md](references/invoke-task-verifiers.md)** and follow its instructions as written.
**STOP.** Do not proceed until ALL task verifiers have returned and findings are aggregated.
→ Proceed to **Step 4**.
---
## Step 4: Produce Review
Load **[produce-review.md](references/produce-review.md)** and follow its instructions as written.
→ Proceed to **Step 5**.
---
## Step 5: Review Actions
Load **[review-actions-loop.md](references/review-actions-loop.md)** and follow its instructions.Related Skills
unity-review-quality
Senior Unity Developer quality review. Deep-dives into a Unity project, reviews everything against best practices, and produces a comprehensive HTML report document. Read-only — never modifies any project files. Covers: architecture, code quality, performance, Unity best practices, project health, security, testing, asset management, and technical debt. Use when: (1) Full project quality audit, (2) Pre-release readiness check, (3) Technical debt assessment, (4) Onboarding review to understand project health, (5) Periodic quality gate evaluation, (6) Post-mortem quality analysis. Triggers: 'review quality', 'quality audit', 'project review', 'quality check', 'project health', 'best practices review', 'code audit', 'technical debt review', 'quality report', 'full review', 'project audit'.
third-party-risk-review
Assess vendor and business associate risk for healthcare organizations by evaluating BAA compliance, security posture, data handling practices, regulatory compliance, and financial stability of third parties with access to protected health information. Use when onboarding new vendors, conducting periodic BA risk assessments, evaluating cloud and SaaS providers, investigating vendor security incidents, negotiating BAAs, or preparing for OCR audit of business associate management.
security-reviewer
Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.
security-review
Run a targeted security audit on specified files or modules. Uses OWASP-informed checks, dependency vulnerability scanning, and auth/input validation review. Use for security audits, vulnerability checks, or before deploying sensitive code. Keywords: security, audit, vulnerability, OWASP, CVE, secrets, injection, XSS, auth, authentication, authorization
security-review-pr
PR/branch security review focused on HIGH-CONFIDENCE vulnerabilities with minimal false positives. Uses git diff analysis and sub-task parallelization.
security-review-audit
Full codebase security audit with OWASP Top 10 guidance, language-specific patterns, checklists, and fix examples. Use for comprehensive audits split by module/area.
reviewing-security
Executes security design and implementation reviews with threat modeling, OWASP-based checks, and risk-ranked remediation guidance. Activates when reviewing security, threat modeling, checking for vulnerabilities, auditing auth flows, performing OWASP reviews, or assessing security posture. Does not handle code quality or test coverage (code-reviewer), writing production code (backend-developer or frontend-developer), or infrastructure deployment (devops).
reviewer
Activate when reviewing code, before committing, after committing, or before merging a PR. Activate when user asks to review, audit, check for security issues, or find regressions. Analyzes code for logic errors, regressions, edge cases, security issues, and test gaps. Fixes findings AUTOMATICALLY. Required at process skill quality gates.
preen-review-instructions
Audit and update code review instructions (REVIEW.md, .gemini/INSTRUCTIONS.md)
playwright-reviewing
Review Playwright E2E tests for best practices violations. Detects mocked app data, explicit timeouts, CSS selectors, skipped tests, and assertion anti-patterns. Use when reviewing Playwright PRs or auditing test quality.
owasp-security-review
Review code and architectures against the OWASP Top 10:2025 — the ten most critical web application security risks. Use when: (1) reviewing code for security vulnerabilities, (2) auditing a feature or codebase against OWASP categories, (3) providing remediation guidance for identified vulnerabilities, (4) writing new code and needing secure coding patterns. Triggers: 'review for security', 'OWASP audit', 'check for vulnerabilities','security checklist', 'is this code secure', 'security review', 'fix vulnerability'.
fix-review
Verify fix commits address audit findings without new bugs