Skip to content
design-review logo

Design Review (Challenger Agent)

design-review

Dispatch an independent challenger agent to adversarially review a spec or implementation plan against the actual codebase. Catches hallucinated APIs, wrong field names, nonexistent files, and incorrect assumptions. Two modes: (1) spec review — verifies DB model fields, API paths, config attribut...

xwtro0tk1t-cloud/harness0installs265stars

SKILL.md

Full skill instructions

Design Review (Challenger Agent)

Overview

Specs and plans written by AI often contain hallucinations: references to APIs that don't exist, wrong column names, incorrect file paths, assumed config attributes that were never defined. These errors waste hours during implementation.

This skill dispatches an independent challenger agent that reads the spec or plan, identifies every concrete claim, and verifies each one against the actual codebase. The challenger has zero context from the authoring session — it trusts only grep, read, and the code.

Announce at start: "I'm using the design-review skill to dispatch a challenger agent for adversarial review."

When to Use

  • After superpowers:brainstorming produces a spec → design-review spec <path>
  • After superpowers:writing-plans produces a plan → design-review plan <path>
  • When a spec/​plan references models, APIs, or config from an unfamiliar codebase
  • When the document was written in a session that hit context limits (higher hallucination risk)
  • User says "review the spec", "review the plan", "challenge this", "check for hallucinations"

Modes

Mode 1: Spec Review — design-review spec <path>

Triggered after a spec is written. Verifies:

Claim TypeVerification Method
DB model fields mentioned in specgrep "column_name" models.py or backend/​db/​models.py
API endpoints mentioned in specgrep "router.*path" backend/​api/
Config attributes mentioned in specgrep "get_setting.*key" backend/
File paths mentioned in specls / test -f to verify existence
Function names mentioned in specgrep "def func_name" backend/

Mode 2: Plan Review — design-review plan <path> [--spec <spec_path>]

Triggered after a plan is written. Two verification dimensions:

Dimension 1: Technical Reference Verification (same as original plan-review)

Claim TypeVerification Method
Import statementsDoes the module/​function exist? grep "def Y|class Y" X.py
Model field accessDoes the column exist? Read model file
Function callsDoes the function exist with that signature?
File pathsDoes the file exist? Is the name correct?
Config attributesDoes config have this attribute?
Constructor argumentsDoes the model/​class accept these kwargs?

Dimension 2: Spec Coverage Verification (requires --spec parameter)

When a spec path is provided, the challenger also verifies plan ↔ spec alignment:

CheckMethod
Spec requirement → Plan task mappingEvery spec requirement (F1, F2, ...) must have at least one plan task covering it
Missing requirementsList any spec sections with NO corresponding plan task → BLOCKER
Partial coverageSpec requirement mentioned in plan but implementation steps incomplete → WARNING
Extra scopePlan tasks that don't trace to any spec requirement → WARNING (scope creep)

Usage: design-review plan <plan_path> --spec <spec_path> or design-review plan <plan_path> (spec-only review if spec auto-detected from same date prefix)

Graph Enhancement (optional, if graph available)

If .code-review-graph/​graph.db exists:

  • Plan files → /​explore impact to check for missed affected modules
  • Spec functions → query graph nodes to verify existence

Process

1. Identify the document path and type (spec or plan)
2. If plan review → auto-detect related spec (same date prefix in docs/​superpowers/​specs/) or use --spec
3. Dispatch challenger agent (general-purpose, in foreground)
4. Receive findings: BLOCKERs + WARNINGs + Coverage matrix (if spec provided)
5. If BLOCKERs exist → fix inline, re-verify
6. If only WARNINGs → present to user, fix if agreed
7. Report final status

Step 1: Identify Inputs

Determine the document type and path:

Spec locations:

  • docs/​superpowers/​specs/​*.md
  • User-specified path

Plan locations:

  • docs/​superpowers/​plans/​*.md
  • .harness/​plans/​*.md
  • User-specified path

Step 2: Dispatch Challenger Agent

Use the Agent tool:

Agent:
  description: "Adversarial design review"
  subagent_type: general-purpose
  prompt: <see challenger-prompt.md — fill [DOC_PATH], [DOC_TYPE], [SPEC_PATH]>

Critical rules:

  • MUST be general-purpose (needs Read, Grep, Glob tools)
  • Do NOT use superpowers:code-reviewer — this is codebase verification, not code review
  • Run in foreground (need results before proceeding)

Step 3-6: Same as plan-review

See the Process section above. Handle BLOCKERs (must fix) and WARNINGs (should fix) exactly as described in the original plan-review skill.

Severity Levels

BLOCKER (must fix before execution)

  • Nonexistent attribute / field / column
  • Wrong import path / module name
  • Hallucinated API / function
  • Wrong function signature
  • Nonexistent file path

WARNING (should fix, won't crash)

  • Stale patterns (codebase has better approach)
  • Missing error handling that siblings have
  • Field name cosmetic mismatch
  • Missing data fetch

Anti-Patterns

WrongRight
Review the document yourself in the same sessionDispatch a fresh agent with zero context
Use superpowers:code-reviewer agent typeUse general-purpose — codebase verification
Only check text for readabilityVerify every import, field, API against actual code
Trust model fields because they "sound right"grep for the actual column definition
Skip spec review because "it's just a design"Specs with wrong field names become plans with wrong field names

Key Principle

The challenger trusts nothing from the authoring session. Every concrete reference is verified by reading the actual source.

More skills from xwtro0tk1t-cloud

Harness logo
xwtro0tk1t-cloud/harness

Harness

--- description: Use when the user wants to initialize a project development environment, establish a documentation system, set up an Agent Team, or says "harness", "project initialization", or "setup dev environment". Also automatically suggested at the first development session of a new project...

265 0
View

--- description: Triggered when the user says "harness help", "harness commands", "harness usage", "what commands are available", or "show harness commands". Displays the Harness command index, installed Skill inventory, and high-frequency scenario entry points. ---

265 0
View
security-review-skill-creator logo
xwtro0tk1t-cloud/harness

security-review-skill-creator

生成安全审计 skill。两种模式:(1) 项目模式——根据项目文档生成定制化审计 skill;(2) 通用模式——仅指定语言+框架,从参考资料库生成通用审计 skill。当用户想创建安全审计 skill、生成审计规则、或提到"生成安全审计skill"、"创建code review skill"、"生成 Java 审计 skill"时使用。

265 0
View

--- description: Triggered when the user says "harness audit", "project health check", "harness status", "check harness health", or "check project configuration". Scans the project's Harness configuration completeness and outputs a checklist + score + remediation suggestions. ---

265 0
View
security-review-skill-for-terraform logo
xwtro0tk1t-cloud/harness

security-review-skill-for-terraform

审计 Terraform / IaC 代码安全(AWS 基础设施)。检测硬编码凭据、过宽 Security Group(0.0.0.0/0)、IAM 权限过大(Action/Resource *)、S3 公开访问、RDS 未加密/公开、State 文件泄露、ECS/EKS 容器特权、CloudTrail/VPC FlowLog 缺失、不安全 Provider/Module 引用等。当审计 Terraform 代码、IaC 安全评审、AWS 云基础设施配置检查、GitOps 安全审计时使用。支持 HCL(.tf)、Terraform JSON、tfvars、Terragrunt(HCL) 代码。

265 0
View
supply-chain-audit logo
xwtro0tk1t-cloud/harness

supply-chain-audit

多语言供应链投毒检测。支持 python(.pth投毒/setup.py hooks)、npm(postinstall hooks/eval混淆)、go(init() 后门/go:generate)、rust(build.rs)、ruby(extconf.rb)、java(Maven plugin/Gradle exec)、php(composer scripts)。当用户担心供应链安全、想检查依赖投毒、或提到 litellm/ua-parser-js/event-stream 等供应链攻击事件时使用。

265 0
View

--- description: Triggered when the user says "recommend skill", "which skill", "harness guide", "skill recommendation", "what skill should I use", or "suggest a skill". Matches the best Skill for the user's scenario, shows installation status and invocation method. ---

265 0
View

--- description: Trigger when user says "harness resume", "resume context", "recover context", "load context", "resume after compact", "I want to continue where I left off", "restore work context". Lightweight same-session context recovery after /compact. Do NOT trigger for: "continue writing X f...

265 0
View
skills-audit logo
xwtro0tk1t-cloud/harness

skills-audit

Audit AI Agent skills for security vulnerabilities including malicious code, remote execution, credential leaks, and supply chain risks. Use when reviewing third-party skills, investigating suspicious behavior, or performing security assessments.

265 0
View
security-review-skill-for-docker logo
xwtro0tk1t-cloud/harness

security-review-skill-for-docker

审计 Docker/容器部署安全。检测 Dockerfile、docker-compose.yml、Kubernetes manifests 中的安全问题:特权容器、root 运行、敏感挂载、资源无限制、密钥泄露、Base Image 不合规、网络暴露等。当审计容器配置、Docker 安全、K8s 部署安全、或检查基础设施安全时使用。支持 Dockerfile、docker-compose.yml、Kubernetes YAML、Helm charts。

265 0
View
sca-ai-denoise logo
xwtro0tk1t-cloud/harness

sca-ai-denoise

SCA 漏洞 AI 降噪与风险优先级评估。对 Grype/Snyk/Xray 等 SCA 工具的漏洞发现进行多维度风险评估,按 P0-P3 分级,过滤噪音(DoS、本地提权、低影响信息泄露),聚焦真正可利用的高风险漏洞。当用户需要对 SCA 扫描结果降噪、漏洞优先级排序、或供应链风险评估时使用。

265 0
View
explore logo
xwtro0tk1t-cloud/harness

explore

Graph-driven project understanding using code-review-graph (CRG). Query architecture, modules, callers/callees, impact radius, hotspots, execution flows, and search nodes. Use when: (1) brainstorming and need to understand project structure, (2) writing plans and need impact analysis, (3) user sa...

265 0
View

Popular AI tools

Kaiber logo
Video

Kaiber

Generate, edit, and beat-sync AI video with leading models in one workspace.

Paid
View
Vimcal logo
Productivity

Vimcal

The world's fastest calendar for remote work

Free
View

Transform Your Design with AI Designer by ImgCreator.ai

Freemium
View
Akool AI logo
Content & writing

Akool AI

Revolutionizing Video Production with AI-Powered Creativity

Paid
View

Extend an image past the frame and let AI fill the new aspect ratio.

Freemium
View
StarByFace logo
Security

StarByFace

Discover your celebrity doppelgänger with StarByFace!

Free
View
C

ChainClarity explains 700+ crypto whitepapers in plain English, with layered summaries, comparisons, research tools, alerts, and a $4.99 Pro plan.

Freemium
View
Opus Clip logo
Coding & apps

Opus Clip

Opus.ai: Revolutionize Your Web Experience

Free
View