0023 — Review skills + cliff.toml: code-review, security-review, pr-description, changelog-entry #41

New Issue

Claude · 2026-06-28T17:12:17Z

Claude commented

2026-06-28 17:12:17 +00:00

Type: HITL
Parent PRD: docs/prd/chunk-3-skills-library.md

What to build

The 4 review phase skills plus the cliff.toml changelog config. All skills are new. Authored via write-skill (0018), evals via write-eval (0017). cliff.toml is a deterministic config file added to the repo root (no skill implementation required for the config itself).

Skills and trigger descriptions:

Flat name	Trigger description
`code-review`	Review this code, check this diff, pre-commit review
`security-review`	Security review, OWASP check, pre-merge security scan
`pr-description`	Write PR description, describe this change
`changelog-entry`	Write changelog entry, add to CHANGELOG, release notes

Key constraints per skill:

code-review: severity-rated findings (critical/high/low); auto-fixes obvious style issues; flags architectural concerns for human review
security-review: OWASP LLM Top 10 + Agentic AI Top 10 for application code; AST03/04/06/07/09 categories for self-authored factory skills (AST01 excluded — requires attacker-controlled content, does not apply to self-authored skills); includes credential and licence checks
pr-description: derives from diff; covers what changed, why, and what to review carefully
changelog-entry: conventional changelog format; derives from PR description and diff; designed for git-cliff consumption

cliff.toml:

Config file at repo root for git-cliff deterministic changelog generation
Selected over release-please (GitHub-only, incompatible with Gitea) and conventional-changelog (Node.js dependency, less actively maintained)
CI integration is Chunk 6; this issue only adds the config

Implementation notes

Follow the per-skill workflow defined in docs/notes/skill-implementation-workflow.md.

Known upstream sources to review:

mattpocock/skills — check for code-review or security-review skills
bmad-method/bmad-method — BMAD reviewer and security role patterns
OWASP LLM Top 10 (current published version) and Agentic AI Top 10 (current published version) as authoritative checklists for security-review
OWASP Agentic Skills Top 10 (AST10) — incubator draft; use AST03/04/06/07/09 only for self-authored skills
git-cliff documentation for cliff.toml format

Acceptance criteria

All 4 SKILL.md files exist at .agents/skills/<skill-name>/SKILL.md; metadata.category: review; authoring standard met
security-review uses correct OWASP checklist per context (LLM Top 10 + Agentic AI Top 10 for app code; AST03/04/06/07/09 for self-authored factory skills)
changelog-entry produces output compatible with git-cliff conventional format
cliff.toml exists at repo root with conventional commits config; git-cliff runs against repo history without error
source: fields populated for any adopted upstream content
Each skill has a co-located eval at .agents/evals/review/<skill-name>/eval.yaml via write-eval
install.sh deploys all 4 skills to ~/.agents/skills/
HITL: human runs behavioral test per skill
HITL: human reviews each SKILL.md, eval, and cliff.toml before committing
Per-skill process followed for all 4 skills: source discovery → source review → conflict check → synthesis grill → co-write iteratively
Trigger description for each skill tested against explicit, implicit, and negative queries before body written
eval.yaml for each skill contains all 5 required test types
Body ≤500 lines for each skill
docs/spec/overview.md updated to reflect all 4 skills deployed

Blocked by

0016 (per-skill workflow)
0017 (write-eval)
0018 (write-skill)

**Type:** HITL **Parent PRD:** `docs/prd/chunk-3-skills-library.md` ## What to build The 4 review phase skills plus the `cliff.toml` changelog config. All skills are new. Authored via `write-skill` (0018), evals via `write-eval` (0017). `cliff.toml` is a deterministic config file added to the repo root (no skill implementation required for the config itself). **Skills and trigger descriptions:** | Flat name | Trigger description | |---|---| | `code-review` | Review this code, check this diff, pre-commit review | | `security-review` | Security review, OWASP check, pre-merge security scan | | `pr-description` | Write PR description, describe this change | | `changelog-entry` | Write changelog entry, add to CHANGELOG, release notes | **Key constraints per skill:** - `code-review`: severity-rated findings (critical/high/low); auto-fixes obvious style issues; flags architectural concerns for human review - `security-review`: OWASP LLM Top 10 + Agentic AI Top 10 for application code; AST03/04/06/07/09 categories for self-authored factory skills (AST01 excluded — requires attacker-controlled content, does not apply to self-authored skills); includes credential and licence checks - `pr-description`: derives from diff; covers what changed, why, and what to review carefully - `changelog-entry`: conventional changelog format; derives from PR description and diff; designed for git-cliff consumption **cliff.toml:** - Config file at repo root for git-cliff deterministic changelog generation - Selected over release-please (GitHub-only, incompatible with Gitea) and conventional-changelog (Node.js dependency, less actively maintained) - CI integration is Chunk 6; this issue only adds the config ## Implementation notes Follow the per-skill workflow defined in `docs/notes/skill-implementation-workflow.md`. **Known upstream sources to review:** - `mattpocock/skills` — check for code-review or security-review skills - `bmad-method/bmad-method` — BMAD reviewer and security role patterns - OWASP LLM Top 10 (current published version) and Agentic AI Top 10 (current published version) as authoritative checklists for `security-review` - OWASP Agentic Skills Top 10 (AST10) — incubator draft; use AST03/04/06/07/09 only for self-authored skills - git-cliff documentation for `cliff.toml` format ## Acceptance criteria - [ ] All 4 SKILL.md files exist at `.agents/skills/<skill-name>/SKILL.md`; `metadata.category: review`; authoring standard met - [ ] `security-review` uses correct OWASP checklist per context (LLM Top 10 + Agentic AI Top 10 for app code; AST03/04/06/07/09 for self-authored factory skills) - [ ] `changelog-entry` produces output compatible with git-cliff conventional format - [ ] `cliff.toml` exists at repo root with conventional commits config; `git-cliff` runs against repo history without error - [ ] `source:` fields populated for any adopted upstream content - [ ] Each skill has a co-located eval at `.agents/evals/review/<skill-name>/eval.yaml` via `write-eval` - [ ] `install.sh` deploys all 4 skills to `~/.agents/skills/` - [ ] **HITL:** human runs behavioral test per skill - [ ] **HITL:** human reviews each SKILL.md, eval, and cliff.toml before committing - [ ] Per-skill process followed for all 4 skills: source discovery → source review → conflict check → synthesis grill → co-write iteratively - [ ] Trigger description for each skill tested against explicit, implicit, and negative queries before body written - [ ] eval.yaml for each skill contains all 5 required test types - [ ] Body ≤500 lines for each skill - [ ] `docs/spec/overview.md` updated to reflect all 4 skills deployed ## Blocked by - 0016 (per-skill workflow) - 0017 (`write-eval`) - 0018 (`write-skill`)

Claude added this to the Legacy / Triage milestone 2026-06-28 17:12:17 +00:00

Claude added the Kind/Feature

Priority

Medium

3

labels 2026-06-28 17:12:17 +00:00

Claude referenced this issue

2026-06-28 17:14:45 +00:00

refactor: align repo with marketplace/plugin model — migrate docs and issues to Gitea, rewrite specs, clean up stale artifacts #15

Claude modified the milestone from Legacy / Triage to Skills & Agents

2026-06-28 19:26:50 +00:00

Sign in to join this conversation.