review
Review orchestrator: assess your application and recommend the right combination of design, security, privacy, compliance, resilience, performance, SEO, and GEO reviews.
What this skill does
# Review Orchestrator
## When to use
- User wants a comprehensive review but doesn't know where to start
- Pre-launch readiness assessment
- Post-incident review planning
- New team member wants to understand review coverage
## How it works
Three modes:
- **Interactive triage** (default) — asks context questions, recommends a review plan
- **Full suite** (`/review --all`) — runs all applicable categories
- **Targeted** — user invokes a specific review directly
## Steps
### 1. Gather context
- Read the project: tech stack, framework, package.json, routes, components
- Check git diff for recent changes
- Look for existing review reports in `shiplight/reports/`
- Check for compliance markers (HIPAA mentions, PCI references, GDPR cookies)
### 2. Ask targeted questions (max 4)
Ask one at a time, with auto-detected defaults:
1. **What type of application?** (SaaS, healthcare, fintech, e-commerce, internal tool, marketing site, API-only)
2. **What triggered this review?** (pre-launch, new feature, dependency update, security incident, audit prep, routine)
3. **Any compliance requirements?** (none, HIPAA, SOC2, PCI-DSS, GDPR, multiple) — auto-detect from codebase
4. **Specific concerns?** (open-ended, optional)
### 3. Generate review plan
Based on answers, categorize all 8 review types as:
- **CRITICAL** — must run, high risk of issues
- **RECOMMENDED** — should run, meaningful value
- **OPTIONAL** — nice to have
Present the plan with rationale for each recommendation. Include estimated depth (quick/standard/thorough) for each.
**SEO vs GEO prioritization by product type:**
| Product type | SEO | GEO |
|---|---|---|
| Developer tools, API products, SaaS | RECOMMENDED | CRITICAL |
| E-commerce, local business, marketplace | CRITICAL | OPTIONAL |
| Content/media, documentation, blog | CRITICAL | CRITICAL |
| Internal tools | — | — |
Provide a decision matrix table:
| Review | Priority | Rationale | Depth |
|--------|----------|-----------|-------|
| /security-review | CRITICAL | New auth feature + SaaS app | thorough |
| /privacy-review | CRITICAL | Handles user PII, GDPR applies | standard |
| etc. | | | |
### 4. Execute
Ask: "Run all CRITICAL reviews now? [Y/n] Or pick specific ones."
Run selected reviews sequentially. After each, show a brief summary before proceeding to the next.
### 5. Unified report
After all reviews complete, generate a unified report:
- Overall readiness score (0-10)
- Per-category scores
- Top 5 findings across all categories (by severity)
- Regression test summary (total YAML tests generated)
- Report saved to `shiplight/reports/review-{date}.md`
## Available Reviews
| Skill | Category | What it checks |
|-------|----------|---------------|
| `/design-review` | Visual/UI | Responsive, a11y, design consistency, i18n readiness |
| `/security-review` | Security | OWASP Top 10, auth, headers, supply chain, pen testing |
| `/privacy-review` | Privacy | PII handling, tracking, data flow, consent |
| `/compliance-review` | Compliance | HIPAA, SOC2, PCI-DSS, GDPR checklists |
| `/resilience-review` | Reliability | Error handling, degradation, API contracts |
| `/performance-review` | Performance | Core Web Vitals, bundle size, runtime perf |
| `/seo-review` | Discoverability | Meta tags, structured data, crawlability |
| `/geo-review` | AI Discoverability | LLM citation readiness, entity authority, structured claims |
## Report Format
All review skills produce reports in a consistent format saved to `shiplight/reports/{review-name}-{date}.md`. The orchestrator merges these into a unified report.
## Tips
- Run `/review` before every major launch
- Individual reviews can be invoked directly when you know what you need
- Review reports accumulate over time — the orchestrator can show trends
- YAML regression tests from reviews accumulate in `shiplight/tests/`
Related in Ads & Marketing
ads
IncludedMulti-platform paid advertising audit and optimization skill. Analyzes Google, Meta, YouTube, LinkedIn, TikTok, Microsoft, and Apple Ads. 250+ checks with scoring, parallel agents, industry templates, and AI creative generation.
banana
IncludedAI image generation Creative Director powered by Google Gemini Nano Banana models. Use this skill for ANY request involving image creation, editing, visual asset production, or creative direction. Triggers on: generate an image, create a photo, edit this picture, design a logo, make a banner, visual for my anything, and all /banana commands. Handles text-to-image, image editing, multi-turn creative sessions, batch workflows, and brand presets.
rpg-migration-analyzer
IncludedAnalyzes legacy RPG (Report Program Generator) programs from AS/400 and IBM i systems for migration to modern Java applications. Extracts business logic from RPG III/IV/ILE source code, identifies data structures (D-specs), file operations (F-specs), program dependencies (CALLB/CALLP), and converts RPG constructs to Java equivalents. Generates migration reports, complexity estimates, and Java implementation strategies with POJO classes, JPA entities, and service methods. Use when modernizing AS/400 or IBM i legacy systems, analyzing RPG source files (.rpg, .rpgle, .RPGLE), converting RPG to Java, mapping data specifications to Java classes, planning legacy system migration, or when user mentions RPG analysis, Report Program Generator, RPG III/IV/ILE, AS/400 modernization, IBM i migration, packed decimal conversion, or mainframe application rewrite.
brand-library-architect
IncludedBuild a complete brand library for a product — visual asset render pipeline, brand documentation set (BRAND, COPY, MANIFESTO, BIOS, FAQ, GLOSSARY, TONE, PRICING), open-source convention files (README, CONTRIBUTING, SECURITY, CODE_OF_CONDUCT), and a self-contained press kit. This skill should be used when the user asks to "build a brand library / brand kit / press kit / brand assets" for a product, "set up a brand library workflow," "create a positioning manifesto plus visual identity," or any combination of brand documentation + visual asset pipeline. Apply phase-by-phase or run end-to-end. Templates are product-agnostic and use {{TOKEN}} placeholders the skill prompts the user to fill.
writing-tech-post
IncludedAuthors engineering blog posts end-to-end: launch deep-dives, incident postmortems, architecture migrations, performance case studies, tutorials, AI/agent system writeups, security disclosures, and research-to-product translations. Picks the correct archetype, plans the abstraction ladder, enforces an evidence cadence (diagrams, benchmarks, profiles, traces, code, ablations), tunes voice against publisher house styles (Datadog, Vercel, GitHub, AWS, Meta, Cloudflare, Jane Street), and runs a pre-publish gate for narrative momentum and disclosure ethics. Use when drafting a new engineering post, restructuring a draft that feels flat, deciding which evidence form belongs where, validating that depth and product context are balanced, or preparing a postmortem, migration, or performance narrative for external publication. Do not use for API reference documentation, README authoring, marketing copy, release notes, generic SEO content, ghost-written executive thought leadership, or non-engineering long-form essays.
blog-google
IncludedGoogle API integration for blog performance: PageSpeed Insights, CrUX Core Web Vitals with 25-week history, Search Console performance, URL Inspection, Indexing API, GA4 organic traffic, NLP entity analysis for E-E-A-T, YouTube video search for embedding, and Google Ads Keyword Planner. Progressive feature availability based on credential tier (API key, OAuth/service account, GA4, Ads). Shares config with claude-seo at ~/.config/claude-seo/google-api.json. Use when user says "google data", "page speed", "core web vitals", "search console", "indexation", "GA4", "keyword research", "nlp entities", "blog performance", "youtube search", "google api setup".