review-skill git:20260715.f00df98A

Immutable. This exact content is served forever at /api/v1/blob/6ef28bc12e037383.

---
name: review-skill
description: Assess a skill package for capability, trust, and operator readiness.
runx:
  category: authoring
---

# Review Skill

Judge whether a skill is ready to trust, adopt, or publish.

This skill evaluates one bounded capability. It should identify what the skill
does well, where it is incomplete, what evidence supports the trust level, and
what tests or governance gaps block adoption.

Avoid generic praise. The output should help an operator decide whether to
adopt, publish, sandbox, or reject the skill.


## Review Gates

Check these before recommending adoption or publication:

- The `SKILL.md` states a bounded capability and does not promise more than the
  execution profile implements.
- The execution profile declares typed inputs, outputs, side-effect posture,
  allowed refs/tools, authority or approval posture, receipt mapping when a
  domain act occurs, and harness cases.
- At least one meaningful happy path and one error or stop path are covered by
  harness evidence or receipts. Local assertions without captured output are not
  enough.
- Any published URL, registry listing, docs site, or repo is durable and public.
  Placeholder hosts, private previews, unrelated parent domains, and dead links
  lower trust or block publication.
- The evidence pack contains no secrets, private tokens, customer data, private
  inbox content, or provider dumps.
- The recommendation states who would use or trust the skill and why. If that
  answer is weak, recommend rejection, sandboxing, or a narrower redesign.

Return `needs_more_evidence` when the receipts, harness proof, or source record
cannot support a trust decision. Reject a package that cannot be bounded or
audited. A confident README and a green parse do not substitute for user value,
failure-path evidence, and verifiable execution behavior.

## Output

- `capability_profile`: what the skill appears to do and how it executes.
- `trust_assessment`: trust tier, caveats, and missing evidence.
- `test_matrix`: concrete checks the skill should pass.
- `recommendation_report`: adoption or publication recommendation.

## Inputs

- `skill_ref` (required): skill package path, registry id, or marketplace id.
- `objective` (optional): what the operator wants to know about this skill.
- `evidence_pack` (optional): receipts, docs, harness output, or source notes.
- `test_constraints` (optional): time, environment, or safety limits.