skills.rest
Probably-Group
Probably-GroupOFFICIAL
Explore all skills by this author →
Website𝕏@problynotingGitHub

staged-review

Validates code against specification then performs quality and security review.

3|1|Updated Dec 3, 2025
Search Tags:#code review#security scanning#spec compliance#SAST#gitleaks#PR verification#staged checks
One-click install
npx skills add https://github.com/Probably-Group/Dev-AID --skill staged-review
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: staged-review
Source: https://github.com/Probably-Group/Dev-AID/tree/main/.dev-aid/skills/process/staged-review
Command: npx skills add https://github.com/Probably-Group/Dev-AID --skill staged-review

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill prevents wasted review effort by verifying that code matches the specification before spending time on architecture, quality, testing, and security checks.

Core Features & Use Cases

  • Two-stage PR verification: validates spec compliance first, then assesses architecture/quality and security.
  • Security automation integration: runs gitleaks, opengrep, and trivy (when dependency locks change) to surface secrets, SAST, and dependency vulnerabilities.
  • Clear review protocol and severity taxonomy: enforces response formats and categorizes findings by BLOCKER/MAJOR/MINOR/NITPICK for actionable remediation.

Quick Start

Use the staged-review skill during PR review after code is complete to validate implementation against the spec and run security checks before approving merge.

Frequently Asked Questions about staged-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I verify pull request code against a specification before reviewing?▼

Verifying pull request code against a specification requires a two-stage review process that validates spec compliance first, preventing wasted effort before proceeding to architecture, quality, and security checks.

How do I automate security scanning for secrets and vulnerabilities in pull requests?▼

Automating security scanning for pull requests involves running gitleaks, opengrep, and trivy to surface secrets, SAST findings, and dependency vulnerabilities. These scans categorize results by severity for actionable remediation.

What is the best way to enforce spec compliance before checking code quality?▼

Enforcing spec compliance before checking code quality is best achieved through a staged review workflow that validates implementation against the spec first, then assesses SOLID principles, error handling, and testing.

Can I run trivy for dependency vulnerabilities only when lock files change?▼

Yes, you can run trivy for dependency vulnerabilities when dependency locks change. This targeted execution ensures dependency scanning only triggers when relevant lock file modifications occur in the pull request.

Does staged code review support severity-based findings for PR remediation?▼

Staged code review supports severity-based findings by categorizing security and quality issues into BLOCKER, MAJOR, MINOR, and NITPICK levels, enforcing clear response formats for actionable pull request remediation.

When should I not use a two-stage spec and security review workflow?▼

A two-stage spec and security review workflow should not be used for incomplete features or non-code-change reviews, as it strictly requires spec-vs-implementation verification and completed code to function properly.

Related Skills

Explore More Software Engineering Skills→
joaquimscostajoaquimscosta
21

creating-pr

Create GitHub pull requests from feature branches using the GitHub CLI.

Community
Advanced
Endor-Solutions-ArchitectureEndor-Solutions-Architecture
2

endor-review

Analyze Git changes for security risks before merging pull requests.

Official
Advanced
MayaDispelerMayaDispeler
3

devsecops

Apply security checks across CI/CD pipelines with GitLeaks, Semgrep, Snyk, Trivy, and cosign.

Community
Advanced
LeoWSY-hashblueLeoWSY-hashblue
3

source-code-scanning

Scan source code for vulnerabilities, secrets, and dependency CVEs.

Community
Advanced