Review Prompt

# Skill Quality Review

You are reviewing a skill for structural correctness, activation quality, and security.

**Skill path:** `{SKILL_PATH}`

Read the entire skill directory: SKILL.md, references/, scripts/, tests/, README.md.

---

## Review Checklist

| # | Category | What to Check |
|---|----------|---------------|
| 1 | Description | Single line, quoted, 150-250 chars, starts with action verb, no multiline `\|` pipe |
| 2 | Description (LLM) | If `disable-model-invocation` is NOT true: has `Triggers -` line with 3-5 keyword phrases |
| 3 | Frontmatter | Valid YAML, `name` is lowercase-hyphens and <=64 chars |
| 4 | Frontmatter flags | `user-invocable`, `disable-model-invocation`, `allowed-tools`, `model` all present and correct |
| 5 | Body size | <500 lines total in SKILL.md |
| 6 | Body tone | Imperative form ("Read the file", not "You should read the file") |
| 7 | Body instructions | WHY-based: each rule explains rationale or has a consequence ("STOP if...") |
| 8 | References exist | Every file referenced in SKILL.md exists on disk. Verify with `ls` or `Glob` |
| 9 | References loading | References loaded conditionally (per phase/mode), NOT all at once at top |
| 10 | References guard | Each reference load has: "If not found, STOP" or equivalent error handling |
| 11 | Scripts executable | All `.sh` files in `scripts/` have `chmod +x` and execute without error |
| 12 | Scripts paths | Scripts use `${CLAUDE_SKILL_DIR}` for own files, never hardcoded absolute paths |
| 13 | Scripts pattern | Every bash block ends with `&& echo "OK" \|\| echo "FAILED"` or equivalent pass/fail signal |
| 14 | Tests exist | `tests/` directory exists with test files for each script |
| 15 | Tests pass | All tests execute successfully, cover happy path + at least one error path |
| 16 | README exists | `README.md` present in skill directory |
| 17 | README quality | Has auto-sync frontmatter, Quick Start section, content matches actual skill behavior |
| 18 | Progressive L1 | Description acts as L1 (~100 words equivalent): enough to decide whether to invoke |
| 19 | Progressive L2 | Body acts as L2 (<500 lines): full instructions without needing references |
| 20 | Progressive L3 | References act as L3: loaded on demand per phase, not eagerly |
| 21 | Security: secrets | No hardcoded tokens, passwords, API keys, or credentials anywhere |
| 22 | Security: injection | No unescaped user input in bash blocks, no `eval` on external data |

---

## Severity Definitions

| Severity | Meaning | Action |
|----------|---------|--------|
| critical | Skill broken, security risk, or will not activate | Must fix before use |
| major | Significant quality issue, poor activation, missing required component | Should fix |
| minor | Suboptimal but functional | Fix when convenient |
| nit | Style preference, cosmetic | Optional |

---

## Output Format

Report ALL findings in this exact format: