SKILL.md
Full skill instructions
Review Orchestrator
The single entry point for application reviews. It triages what matters, then
runs one or more domain reviews and merges them into a unified report. Each
domain lives in references/<domain>.md and is loaded only when selected.
When to use
- User wants a review but isn't sure which kind
- Pre-launch readiness assessment
- Post-incident review planning
- A targeted request for one domain ("check my app's security", "review SEO")
Modes
- Triage (default,
/review) — ask context questions, recommend a plan, run it. - Full suite (
/review --all) — run every applicable domain. - Targeted (
/review <domain>) — jump straight into one domain, skipping triage. E.g./review security,/review seo. Accepts an optional depth flag (--quick/--thorough).
Domains
Each row maps to a reference file. Load the file only when the domain is selected.
| Domain | Reference | Run it when… (trigger signals) |
|---|---|---|
| security | references/security.md | auth/login changes, sensitive data, OWASP, headers/CORS/CSP, supply chain |
| privacy | references/privacy.md | collects PII, tracking/analytics, consent banners, GDPR/CCPA |
| compliance | references/compliance.md | regulated industry, audit prep, HIPAA/SOC 2/PCI-DSS/GDPR, payments or health data |
| design | references/design.md | UI shipping without a designer, responsive, accessibility, typography, i18n |
| resilience | references/resilience.md | error handling, network/API failures, empty/edge states, degradation |
| performance | references/performance.md | slow pages, Core Web Vitals, bundle size, runtime/render perf |
| seo | references/seo.md | public site, meta tags, structured data, crawlability, sitemaps |
| geo | references/geo.md | discovered via AI assistants, LLM citation readiness, llms.txt, entity clarity |
Shared conventions (phases, scoring, confidence, severity, output paths) live in
references/report-format.md — every domain follows them.
Steps
1. Gather context
- Read the project: tech stack, framework,
package.json, routes, components. - Check
git difffor recent changes. - Look for existing reports in
shiplight/reports/. - Auto-detect compliance markers (HIPAA/PHI, PCI/payment fields, GDPR/cookie consent).
If invoked as /review <domain>, skip to step 4 for that domain.
2. Ask targeted questions (max 4)
One at a time, with auto-detected defaults:
- What type of application? (SaaS, healthcare, fintech, e-commerce, internal tool, marketing site, API-only)
- What triggered this review? (pre-launch, new feature, dependency update, security incident, audit prep, routine)
- Any compliance requirements? (none, HIPAA, SOC2, PCI-DSS, GDPR, multiple) — auto-detect from codebase
- Specific concerns? (open-ended, optional)
3. Generate review plan
Categorize each applicable domain as CRITICAL (must run), RECOMMENDED (meaningful value), or OPTIONAL (nice to have), with estimated depth (quick / standard / thorough).
SEO vs GEO prioritization by product type:
| Product type | SEO | GEO |
|---|---|---|
| Developer tools, API products, SaaS | RECOMMENDED | CRITICAL |
| E-commerce, local business, marketplace | CRITICAL | OPTIONAL |
| Content/media, documentation, blog | CRITICAL | CRITICAL |
| Internal tools | — | — |
Present a decision matrix:
| Review | Priority | Rationale | Depth |
|---|---|---|---|
| security | CRITICAL | New auth feature + SaaS app | thorough |
| privacy | CRITICAL | Handles user PII, GDPR applies | standard |
| … |
4. Execute
Ask: "Run all CRITICAL reviews now? [Y/n] Or pick specific ones."
For each selected domain, read references/<domain>.md and follow its five
phases, applying references/report-format.md for scoring, severity, and
output paths. Run domains sequentially; show a brief summary after each before
moving on.
5. Unified report
After the selected domains complete, merge their per-domain reports into one,
saved to shiplight/reports/review-{date}.md:
- Overall readiness score (0–10) and per-domain scores
- Top 5 findings across all domains, by severity
- Regression test summary (total YAML tests generated, in
shiplight/tests/)
Tips
- Run
/reviewbefore every major launch. /review <domain>is the fast path when you already know what you need.- Reports accumulate in
shiplight/reports/— the orchestrator can show trends. - YAML regression tests from reviews accumulate in
shiplight/tests/.