review
Review orchestrator and single entry point for all application reviews. Triage what needs reviewing, then run the right domains: security (OWASP, auth, headers, supply chain), privacy (PII, tracking, consent, GDPR/CCPA), compliance (HIPAA, SOC 2, PCI-DSS, GDPR), design (responsive, accessibility, typography, i18n), resilience (error handling, degradation, API contracts), performance (Core Web Vitals, bundles, runtime), SEO (meta, structured data, crawlability), and GEO (AI citation readiness, llms.txt, entity clarity). Use for pre-launch readiness, post-incident planning, or any 'review my app for X' request.
- Installs
- 607
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/shiplightai/agent-skills --skill review- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads review automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Review Orchestrator
The single entry point for application reviews. It triages what matters, then
runs one or more domain reviews and merges them into a unified report. Each
domain lives in references/<domain>.md and is loaded only when selected.
When to use
- User wants a review but isn't sure which kind
- Pre-launch readiness assessment
- Post-incident review planning
- A targeted request for one domain ("check my app's security", "review SEO")
Modes
- Triage (default,
/review) — ask context questions, recommend a plan, run it. - Full suite (
/review --all) — run every applicable domain. - Targeted (
/review <domain>) — jump straight into one domain, skipping triage. E.g./review security,/review seo. Accepts an optional depth flag (--quick/--thorough).
Domains
Each row maps to a reference file. Load the file only when the domain is selected.
| Domain | Reference | Run it when… (trigger signals) |
|---|---|---|
| security | references/security.md | auth/login changes, sensitive data, OWASP, headers/CORS/CSP, supply chain |
| privacy | references/privacy.md | collects PII, tracking/analytics, consent banners, GDPR/CCPA |
| compliance | references/compliance.md | regulated industry, audit prep, HIPAA/SOC 2/PCI-DSS/GDPR, payments or health data |
| design | references/design.md | UI shipping without a designer, responsive, accessibility, typography, i18n |
| resilience | references/resilience.md | error handling, network/API failures, empty/edge states, degradation |
| performance | references/performance.md | slow pages, Core Web Vitals, bundle size, runtime/render perf |
| seo | references/seo.md | public site, meta tags, structured data, crawlability, sitemaps |
| geo | references/geo.md | discovered via AI assistants, LLM citation readiness, llms.txt, entity clarity |
Shared conventions (phases, scoring, confidence, severity, output paths) live in
references/report-format.md — every domain follows them.
Steps
1. Gather context
- Read the project: tech stack, framework,
package.json, routes, components. - Check
git difffor recent changes. - Look for existing reports in
shiplight/reports/. - Auto-detect compliance markers (HIPAA/PHI, PCI/payment fields, GDPR/cookie consent).
If invoked as /review <domain>, skip to step 4 for that domain.
2. Ask targeted questions (max 4)
One at a time, with auto-detected defaults:
- What type of application? (SaaS, healthcare, fintech, e-commerce, internal tool, marketing site, API-only)
- What triggered this review? (pre-launch, new feature, dependency update, security incident, audit prep, routine)
- Any compliance requirements? (none, HIPAA, SOC2, PCI-DSS, GDPR, multiple) — auto-detect from codebase
- Specific concerns? (open-ended, optional)
3. Generate review plan
Categorize each applicable domain as CRITICAL (must run), RECOMMENDED (meaningful value), or OPTIONAL (nice to have), with estimated depth (quick / standard / thorough).
SEO vs GEO prioritization by product type:
| Product type | SEO | GEO |
|---|---|---|
| Developer tools, API products, SaaS | RECOMMENDED | CRITICAL |
| E-commerce, local business, marketplace | CRITICAL | OPTIONAL |
| Content/media, documentation, blog | CRITICAL | CRITICAL |
| Internal tools | — | — |
Present a decision matrix:
| Review | Priority | Rationale | Depth |
|---|---|---|---|
| security | CRITICAL | New auth feature + SaaS app | thorough |
| privacy | CRITICAL | Handles user PII, GDPR applies | standard |
| … |
4. Execute
Ask: "Run all CRITICAL reviews now? [Y/n] Or pick specific ones."
For each selected domain, read references/<domain>.md and follow its five
phases, applying references/report-format.md for scoring, severity, and
output paths. Run domains sequentially; show a brief summary after each before
moving on.
5. Unified report
After the selected domains complete, merge their per-domain reports into one,
saved to shiplight/reports/review-{date}.md:
- Overall readiness score (0–10) and per-domain scores
- Top 5 findings across all domains, by severity
- Regression test summary (total YAML tests generated, in
shiplight/tests/)
Tips
- Run
/reviewbefore every major launch. /review <domain>is the fast path when you already know what you need.- Reports accumulate in
shiplight/reports/— the orchestrator can show trends. - YAML regression tests from reviews accumulate in
shiplight/tests/.
FAQ
What does the review skill do?
Review orchestrator and single entry point for all application reviews. Triage what needs reviewing, then run the right domains: security (OWASP, auth, headers, supply chain), privacy (PII, tracking, consent, GDPR/CCPA), compliance (HIPAA, SOC 2, PCI-DSS, GDPR), design (responsive, accessibility, typography, i18n), resilience (error handling, degradation, API contracts), performance (Core Web Vitals, bundles, runtime), SEO (meta, structured data, crawlability), and GEO (AI citation readiness, llms.txt, entity clarity). Use for pre-launch readiness, post-incident planning, or any 'review my app for X' request.
How do I install review?
Run npx skills add https://github.com/shiplightai/agent-skills --skill review in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/review/ (personal) or .claude/skills/review/ (project).
Which AI agents can use review?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is review safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains review?
It is published by shiplightai in shiplightai/agent-skills. It has 607 recorded installs.
More from shiplightai/agent-skills
verify
shiplightai/agent-skills
Verify UI changes in the browser using Shiplight MCP tools.
cloud
shiplightai/agent-skills
Sync local tests with Shiplight cloud — push and pull YAML test cases, templates, and functions between your repo and the cloud. Requires a Shiplight cloud subscription.
triage
shiplightai/agent-skills
Triage failing Shiplight YAML tests: reproduce failures, inspect evidence, apply minimal correct fixes, report app/spec mismatches, and update project memory.
create-tests
shiplightai/agent-skills
Deprecated alias for create-yaml-tests. Renamed to create-yaml-tests; this entry only redirects for backward compatibility. Use create-yaml-tests to create, update, and repair local Shiplight YAML E2E tests.
compliance-review
shiplightai/agent-skills
Open the skill to read its SKILL.md instructions.
design-review
shiplightai/agent-skills
Open the skill to read its SKILL.md instructions.
Popular code quality & workflow skills
grill-me
mattpocock/skills
A relentless interview to sharpen a plan or design.
improve-codebase-architecture
mattpocock/skills
Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.
handoff
mattpocock/skills
Compact the current conversation into a handoff document for another agent to pick up.
domain-modeling
mattpocock/skills
Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.
codebase-design
mattpocock/skills
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
diagnosing-bugs
mattpocock/skills
Diagnosis loop for hard bugs and performance regressions. Use when the user says "diagnose"/"debug this", or reports something broken/throwing/failing/slow.