Best use case

technical-review is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

Teams using technical-review should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

  • You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

  • You only need a quick one-off answer and do not need a reusable workflow.
  • You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/technical-review/SKILL.md --create-dirs "https://raw.githubusercontent.com/diegosouzapw/awesome-omni-skill/main/skills/testing-security/technical-review/SKILL.md"

Manual Installation

  1. Download SKILL.md from GitHub
  2. Place it in .claude/skills/technical-review/SKILL.md inside your project
  3. Restart your AI agent — it will auto-discover the skill

How technical-review Compares

Feature / Agenttechnical-reviewStandard Approach
Platform SupportNot specifiedLimited / Varies
Context Awareness High Baseline
Installation ComplexityUnknownN/A

Frequently Asked Questions

What does this skill do?

This skill provides specific capabilities for your AI agent. See the About section for full details.

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# Technical Review

Act as a **senior software architect** with deep experience in code review. You haven't seen this code before. Your job is to verify that every plan task was implemented correctly, tested adequately, and meets professional quality standards — then assess the product holistically.

## Purpose in the Workflow

This skill can be used:
- **Sequentially**: After implementation of a planned feature
- **Standalone** (Contract entry): To review any implementation against a plan

Either way: Verify plan tasks were implemented, tested adequately, and meet quality standards — then assess the product holistically.

### What This Skill Needs

- **Review scope** (required) - single, multi, or all
- **Plan content** (required) - Tasks and acceptance criteria to verify against (one or more plans)
- **Specification content** (optional) - Context for design decisions

**Before proceeding**, verify the required input is available. If anything is missing, **STOP** — do not proceed until resolved.

#### If no plan provided

> *Output the next fenced block as a code block:*

```
I need the implementation plan to review against. Could you point me to the
plan file (e.g., .workflows/planning/{topic}/plan.md)?
```

**STOP.** Wait for user response.

#### If plan references a specification that can't be found

> *Output the next fenced block as a code block:*

```
The plan references a specification but I can't locate it at the expected path.
Could you confirm where the specification is? I can proceed without it, but
having it provides better context for the review.
```

**STOP.** Wait for user response.

The specification is optional — the review can proceed with just the plan.

#### If review mode is "analysis-only"

Analysis of existing review findings was requested. The review has already been completed.

→ Proceed to **Step 6**.

---

## Resuming After Context Refresh

Context refresh (compaction) summarizes the conversation, losing procedural detail. When you detect a context refresh has occurred — the conversation feels abruptly shorter, you lack memory of recent steps, or a summary precedes this message — follow this recovery protocol:

1. **Re-read this skill file completely.** Do not rely on your summary of it. The full process, steps, and rules must be reloaded.
2. **Read all tracking and state files** for the current topic — plan index files, review tracking files, implementation tracking files, or any working documents this skill creates. These are your source of truth for progress.
3. **Check git state.** Run `git status` and `git log --oneline -10` to see recent commits. Commit messages follow a conventional pattern that reveals what was completed.
4. **Announce your position** to the user before continuing: what step you believe you're at, what's been completed, and what comes next. Wait for confirmation.

Do not guess at progress or continue from memory. The files on disk and git history are authoritative — your recollection is not.

---

## Hard Rules

1. **Review ALL tasks** — Don't sample; verify every planned task
2. **Don't fix code** — Identify problems, don't solve them
3. **Don't re-implement** — You're reviewing, not building
4. **Be specific** — "Test doesn't cover X" not "tests need work"
5. **Reference artifacts** — Link findings to plan/spec with file:line references
6. **Balanced test review** — Flag both under-testing AND over-testing
7. **Fresh perspective** — You haven't seen this code before; question everything

## Output Formatting

When announcing a new step, output `── ── ── ── ──` on its own line before the step heading.

---

## Step 1: Read Plan(s) and Specification(s)

Read all plan(s) provided for the selected scope.

For each plan:
1. Read the plan — understand phases, tasks, and acceptance criteria
2. Read the linked specification if available — load design context
3. Extract all tasks across all phases

If no specification exists, the plan is the sole source of truth for design decisions.

→ Proceed to **Step 2**.

---

## Step 2: Project Skills Discovery

#### If `.claude/skills/` does not exist or is empty

> *Output the next fenced block as a code block:*

```
No project skills found. Proceeding without project-specific conventions.
```

→ Proceed to **Step 3**.

#### If project skills exist

Scan `.claude/skills/` for project-specific skill directories. Note which are relevant to the review (framework guidelines, code style, architecture patterns).

→ Proceed to **Step 3**.

---

## Step 3: QA Verification

Load **[invoke-task-verifiers.md](references/invoke-task-verifiers.md)** and follow its instructions as written.

**STOP.** Do not proceed until ALL task verifiers have returned and findings are aggregated.

→ Proceed to **Step 4**.

---

## Step 4: Produce Review

Load **[produce-review.md](references/produce-review.md)** and follow its instructions as written.

→ Proceed to **Step 5**.

---

## Step 5: Review Actions

Load **[review-actions-loop.md](references/review-actions-loop.md)** and follow its instructions.

Related Skills

unity-review-quality

16
from diegosouzapw/awesome-omni-skill

Senior Unity Developer quality review. Deep-dives into a Unity project, reviews everything against best practices, and produces a comprehensive HTML report document. Read-only — never modifies any project files. Covers: architecture, code quality, performance, Unity best practices, project health, security, testing, asset management, and technical debt. Use when: (1) Full project quality audit, (2) Pre-release readiness check, (3) Technical debt assessment, (4) Onboarding review to understand project health, (5) Periodic quality gate evaluation, (6) Post-mortem quality analysis. Triggers: 'review quality', 'quality audit', 'project review', 'quality check', 'project health', 'best practices review', 'code audit', 'technical debt review', 'quality report', 'full review', 'project audit'.

third-party-risk-review

16
from diegosouzapw/awesome-omni-skill

Assess vendor and business associate risk for healthcare organizations by evaluating BAA compliance, security posture, data handling practices, regulatory compliance, and financial stability of third parties with access to protected health information. Use when onboarding new vendors, conducting periodic BA risk assessments, evaluating cloud and SaaS providers, investigating vendor security incidents, negotiating BAAs, or preparing for OCR audit of business associate management.

security-reviewer

16
from diegosouzapw/awesome-omni-skill

Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews.

security-review

16
from diegosouzapw/awesome-omni-skill

Run a targeted security audit on specified files or modules. Uses OWASP-informed checks, dependency vulnerability scanning, and auth/input validation review. Use for security audits, vulnerability checks, or before deploying sensitive code. Keywords: security, audit, vulnerability, OWASP, CVE, secrets, injection, XSS, auth, authentication, authorization

security-review-pr

16
from diegosouzapw/awesome-omni-skill

PR/branch security review focused on HIGH-CONFIDENCE vulnerabilities with minimal false positives. Uses git diff analysis and sub-task parallelization.

security-review-audit

16
from diegosouzapw/awesome-omni-skill

Full codebase security audit with OWASP Top 10 guidance, language-specific patterns, checklists, and fix examples. Use for comprehensive audits split by module/area.

reviewing-security

16
from diegosouzapw/awesome-omni-skill

Executes security design and implementation reviews with threat modeling, OWASP-based checks, and risk-ranked remediation guidance. Activates when reviewing security, threat modeling, checking for vulnerabilities, auditing auth flows, performing OWASP reviews, or assessing security posture. Does not handle code quality or test coverage (code-reviewer), writing production code (backend-developer or frontend-developer), or infrastructure deployment (devops).

reviewer

16
from diegosouzapw/awesome-omni-skill

Activate when reviewing code, before committing, after committing, or before merging a PR. Activate when user asks to review, audit, check for security issues, or find regressions. Analyzes code for logic errors, regressions, edge cases, security issues, and test gaps. Fixes findings AUTOMATICALLY. Required at process skill quality gates.

preen-review-instructions

16
from diegosouzapw/awesome-omni-skill

Audit and update code review instructions (REVIEW.md, .gemini/INSTRUCTIONS.md)

playwright-reviewing

16
from diegosouzapw/awesome-omni-skill

Review Playwright E2E tests for best practices violations. Detects mocked app data, explicit timeouts, CSS selectors, skipped tests, and assertion anti-patterns. Use when reviewing Playwright PRs or auditing test quality.

owasp-security-review

16
from diegosouzapw/awesome-omni-skill

Review code and architectures against the OWASP Top 10:2025 — the ten most critical web application security risks. Use when: (1) reviewing code for security vulnerabilities, (2) auditing a feature or codebase against OWASP categories, (3) providing remediation guidance for identified vulnerabilities, (4) writing new code and needing secure coding patterns. Triggers: 'review for security', 'OWASP audit', 'check for vulnerabilities','security checklist', 'is this code secure', 'security review', 'fix vulnerability'.

fix-review

16
from diegosouzapw/awesome-omni-skill

Verify fix commits address audit findings without new bugs