apex-review
Cross-cutting review of recent work — catches gaps between specialists. Use when asked to "review what we built", "check the work", "pre-launch review", or after completing a significant chunk of work.
git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace /tmp/apex-review && cp -r /tmp/apex-review/plugins/ai-agency/tonone/skills/apex-review ~/.claude/skills/apex-reviewSKILL.md
# Apex Review You are Apex — the engineering lead. Review recent work with a cross-cutting eye. Catch what individual specialists miss: gaps between components, concerns that span domains. Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose. ## Steps 0. **Run the automated health snapshot.** From the repo root: ```bash cd team/apex/scripts && pip install -e . --quiet && python apex_agent/apex_scan.py . --skip-health --skip-deps --out /tmp/apex-scan.json 2>/dev/null || true python apex_agent/apex_scan.py . --skip-endpoints 2>&1 | tail -20 ``` Read `.reports/apex-<latest>.json` if written. Treat CRITICAL/HIGH findings as blocking issues. Treat the dependency cycle/unused-module findings as cross-cutting context for the review below. 1. **Read git log and recent changes to understand what was built.** ```bash git log --oneline -30 ``` ```bash git diff HEAD~10 --stat ``` Read the key changed files to understand the shape of the work. 2. **Review for cross-cutting concerns.** For each area, ask whether a specialist would flag this: - **Security** (Warden): Auth gaps, secrets exposure, input validation, dependency vulnerabilities - **Performance** (Spine): N+1 queries, missing indexes, unbounded lists, blocking calls - **Observability** (Vigil): Logging coverage, error tracking, health checks, alerting gaps - **Data integrity** (Flux): Migration safety, backup coverage, schema consistency, data validation - **Infrastructure** (Forge): Resource sizing, cost implications, networking gaps - **CI/CD** (Relay): Test coverage, deployment safety, rollback capability 3. **Check for consistency** — do the pieces fit together? Look for: - Naming mismatches between components - Assumptions one component makes that another doesn't satisfy - Missing error handling at boundaries - Gaps in the request/response flow - Configuration that exists in one environment but not others 4. **Present findings prioritized by risk.** For each issue: - What's wrong (one sentence) - Which specialist should fix it - Estimated effort (quick fix / medium / significant) - Risk level (critical / moderate / minor) 5. **If critical issues found, recommend blocking.** If all issues are minor, note them and give the green light. Be direct — "this is ready to ship with these caveats" or "do not ship until X is fixed." 6. **Delivery:** If findings exceed the 40-line CLI budget, invoke `/atlas-report` with the full findings. The HTML report is the output. CLI is the receipt only — print the box header, verdict (ship/block), top 3 issues, and the report path.
Guard the beads execution record: enforce the write-flush-verify discipline that defeats the bd rapid-write race, audit epic dependency graphs for cycles and orphans, catch closures whose title overstates what shipped, flag open beads carrying no disposition or a disproven premise, and reconcile bd against its GitHub and Plane projections. Owns RECORD INTEGRITY; delegates graph analysis to bead-dependency-mapper and epic-closure drift to bead-epic-auditor rather than duplicating them. Use before closing an epic, after any batch of bd writes, when a bead premise looks stale, or when auditing whether the record matches reality. Trigger with "audit beads", "check the bead DAG", "did that close actually land", "bead hygiene".
Verify every factual assertion in a diff, PR body, commit message, bead note, or governing doc against the actual repository, and fail anything that cannot be substantiated by a command. Use before merging any PR that makes claims about counts, coverage, consumers, enforcement, provenance, or certification, and when auditing standing docs for rot. Trigger with "verify claims", "check this PR body", "is this claim true", "claim audit".
Design and build Omarchy (Quickshell/QML) bar-widget, panel, and service plugins that actually work on a stock install. Knows the hard runtime constraint (no node on the graphical session PATH), the first-party contracts (BarWidget, Panel, KeyboardPanel, PanelKeyCatcher, Service), the curl-from-QML data pattern, FileView persistence, and the marketplace submission bar. Use when starting a new Omarchy plugin, porting a plugin off an external runtime, wiring a service to a bar widget, or deciding how a widget should fetch and persist. Trigger with "build an omarchy plugin", "omarchy widget", "quickshell plugin", "port this plugin to QML".
Audit an Omarchy plugin before it reaches the marketplace: prove it installs and runs on a stock box (no node/python on the session PATH), run the omarchy-submit gate lane, validate on the rig with omarchy-plugin-validate and qmllint, and check the QML security invariants and first-party idiom contracts. Read-only: it reports and blocks, it does not rewrite the plugin. Use before submitting an entry, after any data-layer change, or when a plugin works on the dev box and you need to know whether it works for a real user. Trigger with "audit this omarchy plugin", "is this plugin submission ready", "will this plugin work when installed".
Audit and fix Claude Code SKILL.md files against enterprise compliance standards: frontmatter completeness, required body sections, and style. Use when validating or repairing skills in a plugin directory. Trigger with "audit skill", "fix skill compliance".
Learn how SKILL.md files work in Claude Code plugins, then build a production-quality agent skill from scratch. Covers frontmatter schema, body structure, testing, and iteration.
Step-by-step guide to writing a SKILL.md file for Claude Code. Learn how to plan, structure, and test auto-activating skills with proper frontmatter, allowed-tools, dynamic context injection, and supporting files.
|