[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6DF5WMF4TNZA10E2VRDESW8":3,"skill-same:01M6DF5WMF4TNZA10E2VRDESW8":82},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":47,"linkOnly":48,"markdownContent":49,"markdownBody":50,"frontMatter":51,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":14,"repositoryHtmlUrl":60,"repositoryHomepageUrl":6,"ownerHtmlUrl":61,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":62,"install":63,"resources":75},"01M6DF5WMF4TNZA10E2VRDESW8","design-review-gate",null,"Automatic review gate that runs after brainstorming completes - spawns PM, Architect, Designer, Security, and CTO agents in parallel, iterates until all approve","Prekzursil\u002Fagent-skills-toolchain","Prekzursil","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F54636077?v=4","01M6DACZ1PCQHD99SCR1YXG28B","Andrei Mihai Visalon","01M6DACZ670WZF535V3WYYSS4Z",0,"MIT","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fdesign-review-gate\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"design","review","design review","gate","design review gate","docs","security","brainstorming","architect","designer","parallel","superpowers","document","pm","plans","2026-11-10 10:12:30",false,"---\nname: design-review-gate\ndescription: Automatic review gate that runs after brainstorming completes - spawns PM, Architect, Designer, Security, and CTO agents in parallel, iterates until all approve\nauto_activate: true\ntriggers:\n  - \"design document created\"\n  - \"docs\u002Fplans\u002F*-design.md committed\"\n  - after:superpowers:brainstorming\n---\n\n# Design Review Gate\n\n## Purpose\n\nThis skill automatically activates after a design document is created (typically via `superpowers:brainstorming`). It ensures complex features receive proper review before implementation begins by spawning five specialist agents:\n\n1. **Product Manager Agent** - Use case validation and user benefit review\n2. **Architect Agent** - Technical architecture review\n3. **Designer Agent** - UX\u002FAPI design quality review\n4. **Security Design Agent** - Security threat modeling and protection review\n5. **CTO Agent** - Codebase alignment and TDD readiness review\n\nAll five must approve before proceeding to implementation.\n\n---\n\n## Coordination Mode Note\n\nThis skill supports both coordination modes:\n\n- **Task Mode** (default): Spawn 5 parallel `Task()` subagents for each review round. Fresh instances per round.\n- **Team Mode**: `TeamCreate(\"review-{design-doc-name}\")`, spawn 5 reviewers as named teammates (`pm`, `architect`, `designer`, `security`, `cto`). Reviewers retain context through revision cycles — saves 5 cold starts per re-review round. After approval, send `shutdown_request` to all, then `TeamDelete`.\n\nIn either mode, the review criteria, iteration protocol, and escalation rules are identical. See `.\u002Fguides\u002Fagent-coordination.md` for mode detection.\n\n---\n\n## Activation Triggers\n\nThis skill auto-activates when:\n\n1. A design document is committed to `docs\u002Fplans\u002F*-design.md`\n2. The `superpowers:brainstorming` skill completes\n3. User explicitly requests: `\u002Freview-design \u003Cpath-to-design.md>`\n\n---\n\n## Workflow\n\n### Phase 1: Spawn Review Agents (Parallel)\n\n```typescript\n\u002F\u002F Spawn all five agents in parallel for efficiency\nconst [pmResult, architectResult, designerResult, securityResult, ctoResult] = await Promise.all([\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"PM review\",\n    prompt: pmReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"Architect review\",\n    prompt: architectReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"Designer review\",\n    prompt: designerReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"Security design review\",\n    prompt: securityDesignReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"CTO review\",\n    prompt: ctoReviewPrompt(designDocPath),\n  }),\n]);\n```\n\n### Phase 2: Aggregate Results\n\nEach agent returns a structured review:\n\n```typescript\ninterface ReviewResult {\n  agent: \"product-manager\" | \"architect\" | \"designer\" | \"security-design\" | \"cto\";\n  verdict: \"APPROVED\" | \"NEEDS_REVISION\";\n  blockers: string[]; \u002F\u002F MUST fix before implementation\n  suggestions: string[]; \u002F\u002F Nice to have\n  questions: string[]; \u002F\u002F Clarifications needed\n  use_case_analysis?: {\n    \u002F\u002F PM agent only\n    total_use_cases: number;\n    clear: number;\n    needs_work: number;\n    missing_scenarios: string[];\n  };\n  threat_model?: {\n    \u002F\u002F Security agent only\n    high_risk: string[];\n    medium_risk: string[];\n    mitigations_required: string[];\n  };\n}\n```\n\n### Phase 3: Check Gate\n\n```\nIF all five agents return APPROVED:\n  → Proceed to implementation\n  → Create epic with approved design\n\nELSE:\n  → Consolidate feedback\n  → Present to user\n  → Iterate on design\n  → Re-run gate (max 3 iterations)\n```\n\n### Phase 4: Human Escalation\n\nAfter 3 failed iterations:\n\n1. Create summary of remaining blockers\n2. Ask human to decide: override, defer, or cancel\n\n---\n\n## Agent Prompts\n\n### Product Manager Agent Prompt\n\n````markdown\nYou are the PRODUCT MANAGER AGENT reviewing a design document.\n\n## Your Task\n\nReview this design for use case clarity and user benefit validation.\n\n## Design Document\n\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. Use Case Validation\n\n- [ ] Each use case follows WHO\u002FWANTS\u002FSO THAT\u002FWHEN format\n- [ ] User personas are clearly defined\n- [ ] Use cases are realistic and based on user needs\n- [ ] Edge cases and error scenarios considered from user perspective\n\n### 2. User Benefit Review\n\n- [ ] Value proposition clearly articulated\n- [ ] Benefits are measurable (time saved, success rate, etc.)\n- [ ] User journey impact understood\n- [ ] Improvement is significant enough to build\n\n### 3. Scope Assessment\n\n- [ ] MVP clearly defined (must have vs nice to have)\n- [ ] No feature creep detected\n- [ ] Scope matches user needs, not technical possibilities\n- [ ] \"Solution looking for problem\" anti-pattern avoided\n\n### 4. Success Criteria\n\n- [ ] Success metrics are user-focused (not just technical)\n- [ ] Metrics are measurable and have thresholds\n- [ ] Evaluation timeline defined\n- [ ] Failure criteria also defined\n\n## Output Format\n\nReturn JSON:\n\n```json\n{\n  \"agent\": \"product-manager\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"use_case_analysis\": {\n    \"total_use_cases\": \u003Cnumber>,\n    \"clear\": \u003Cnumber>,\n    \"needs_work\": \u003Cnumber>,\n    \"missing_scenarios\": [\"list of gaps\"]\n  },\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n```\n````\n\n````\n\n### Architect Agent Prompt\n\n```markdown\nYou are the ARCHITECT AGENT reviewing a design document.\n\n## Your Task\nReview this design for technical architecture soundness.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. Service Architecture\n- [ ] Follows existing codebase patterns\n- [ ] Service placement is correct\n- [ ] Dependencies flow correctly (no circular deps)\n- [ ] Naming conventions followed\n\n### 2. Technical Correctness\n- [ ] API contracts well-defined\n- [ ] Database operations are correct (if applicable)\n- [ ] Error handling is complete\n- [ ] Performance considerations addressed\n\n### 3. Integration Points\n- [ ] Integrates cleanly with existing services\n- [ ] No duplicate functionality (check docs\u002FSERVICE_INVENTORY.md)\n- [ ] Proper abstraction boundaries\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"architect\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n````\n\n````\n\n### Designer Agent Prompt\n\n```markdown\nYou are the DESIGNER AGENT reviewing a design document.\n\n## Your Task\nReview this design for UX, API design, and developer experience.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. API\u002FInterface Design\n- [ ] APIs are intuitive and consistent with existing patterns\n- [ ] Parameter names are clear and predictable\n- [ ] Return types are well-structured\n- [ ] Error responses are helpful (not cryptic)\n\n### 2. User Experience (if applicable)\n- [ ] User flows are logical and efficient\n- [ ] Edge cases handled gracefully\n- [ ] Error states provide actionable guidance\n- [ ] Loading\u002Fprogress states considered\n\n### 3. Developer Experience\n- [ ] Types are well-designed and reusable\n- [ ] Interfaces are easy to implement against\n- [ ] Mocking is straightforward\n- [ ] Documentation is complete\n\n### 4. Consistency\n- [ ] Follows existing codebase conventions\n- [ ] Similar to how other features work\n- [ ] Naming is consistent with codebase\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"designer\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n````\n\n````\n\n### Security Design Agent Prompt\n\n```markdown\nYou are the SECURITY DESIGN AGENT reviewing a design document.\n\n## Your Task\nReview this design for security vulnerabilities BEFORE code is written.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. Authentication & Authorization\n- [ ] User identity verified at every entry point\n- [ ] Authorization checked for each resource access\n- [ ] No user can access other users' data\n- [ ] Session management is secure\n\n### 2. Data Protection\n- [ ] Sensitive data identified and protected\n- [ ] PII encrypted at rest and in transit\n- [ ] No secrets in logs or error messages\n- [ ] Data leakage vectors closed\n\n### 3. Input Validation\n- [ ] ALL inputs validated server-side\n- [ ] No SQL injection vectors\n- [ ] No XSS vectors\n- [ ] Safe file upload handling (if applicable)\n\n### 4. API Security\n- [ ] Rate limits defined\n- [ ] Brute force protection\n- [ ] Error messages don't leak information\n- [ ] No IDOR (Insecure Direct Object Reference) risks\n\n### 5. OWASP Top 10 Check\n- [ ] A01: Broken Access Control\n- [ ] A02: Cryptographic Failures\n- [ ] A03: Injection\n- [ ] A04: Insecure Design\n- [ ] A07: Auth Failures\n\n## Required Context\nBEFORE reviewing, consider:\n- docs\u002FARCHITECTURE_CURRENT.md (security patterns)\n- Existing auth flows in codebase\n- OWASP guidelines\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"security-design\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"threat_model\": {\n    \"high_risk\": [\"components with critical risk\"],\n    \"medium_risk\": [\"components with moderate risk\"],\n    \"mitigations_required\": [\"security controls needed\"]\n  },\n  \"blockers\": [\"MUST fix security issues\"],\n  \"suggestions\": [\"nice to have security improvements\"],\n  \"questions\": [\"security clarifications needed\"]\n}\n````\n\n````\n\n### CTO Agent Prompt\n\n```markdown\nYou are the CTO AGENT reviewing a design document.\n\n## Your Task\nReview this design for TDD readiness and codebase alignment.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. TDD Readiness (CRITICAL)\n- [ ] Test specifications are present\n- [ ] RED-GREEN-REFACTOR cycles documented\n- [ ] Edge cases enumerated per method\n- [ ] Mock infrastructure specified\n- [ ] Integration test helpers defined\n\n### 2. Codebase Alignment\n- [ ] Follows CLAUDE.md guidelines\n- [ ] Aligns with docs\u002FARCHITECTURE_CURRENT.md\n- [ ] No conflicts with existing services\n- [ ] Security considerations addressed\n\n### 3. Completeness\n- [ ] All requirements addressed\n- [ ] Success criteria are measurable\n- [ ] Implementation phases are clear\n- [ ] Acceptance criteria defined\n\n### 4. Risk Assessment\n- [ ] Risks identified with mitigations\n- [ ] Dependencies documented\n- [ ] Breaking changes flagged (if any)\n\n## Required Context Files\nBEFORE reviewing, read:\n- docs\u002FBACKEND_SERVICE_GUIDE.md\n- docs\u002FTESTING_GUIDE.md\n- templates\u002Ftask-completion-checklist.md\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"cto\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n````\n\n````\n\n---\n\n## Iteration Protocol\n\n### Round 1: Initial Review\n\n1. Spawn all five agents in parallel\n2. Wait for all results\n3. If all APPROVED → proceed\n4. If any NEEDS_REVISION → consolidate and present\n\n### Rounds 2-3: Revision Cycles\n\n1. Present consolidated feedback to human\n2. Human revises design document\n3. Re-run all five agents on updated doc\n4. Repeat until all approve\n\n### Round 4: Escalation\n\nIf still not approved after 3 iterations:\n\n```markdown\n## Design Review Gate: Escalation Required\n\nAfter 3 review cycles, the following blockers remain unresolved:\n\n### Architect Agent\n- [blocker 1]\n- [blocker 2]\n\n### Designer Agent\n- [blocker 1]\n\n### CTO Agent\n- [blocker 1]\n- [blocker 2]\n\n### Options\n1. **Override** - Proceed anyway (document technical debt)\n2. **Defer** - Shelve this feature for later\n3. **Revise** - Continue iterating on design\n4. **Cancel** - Abandon this feature\n\nPlease choose an option or provide additional context.\n````\n\n---\n\n## Integration with Task Tracking\n\nWhen design is approved:\n\n```bash\n# Create epic linked to design doc\n# Use your project's task tracking system to create an epic and implementation phase tasks\n# Example:\n# task-cli create \"\u003Cfeature-name>\" --type epic\n# task-cli create \"Phase 1: Infrastructure\" --type task --parent \u003Cepic-id>\n# task-cli create \"Phase 2: Backend\" --type task --parent \u003Cepic-id>\n# task-cli create \"Phase 3: Frontend\" --type task --parent \u003Cepic-id>\n# task-cli create \"Phase 4: Polish\" --type task --parent \u003Cepic-id>\n```\n\n---\n\n## Output Format\n\n### Approved Design\n\n```markdown\n## Design Review Gate: APPROVED\n\nAll five reviewers have approved the design.\n\n| Agent           | Verdict  | Blockers | Suggestions |\n| --------------- | -------- | -------- | ----------- |\n| Product Manager | APPROVED | 0        | 1           |\n| Architect       | APPROVED | 0        | 2           |\n| Designer        | APPROVED | 0        | 1           |\n| Security Design | APPROVED | 0        | 2           |\n| CTO             | APPROVED | 0        | 3           |\n\n### Threat Model Summary (Security Agent)\n\n- **High Risk**: None identified\n- **Medium Risk**: AI-generated content could be manipulated\n- **Mitigations**: Defense in depth already designed\n\n### Suggestions (Non-Blocking)\n\n1. [Architect] Consider adding caching layer for frequent queries\n2. [Designer] Add loading skeleton to improve perceived performance\n3. [Security] Add audit logging for all assistant actions\n4. [Security] Consider anomaly detection for unusual query patterns\n5. [CTO] Document rate limit headers in API response\n\n### Next Steps\n\n1. Create epic for implementation\n2. Set up worktree with `superpowers:using-git-worktrees`\n3. Begin Phase 1 implementation\n\nReady to proceed with implementation? [Yes\u002FNo]\n```\n\n### Needs Revision\n\n```markdown\n## Design Review Gate: NEEDS REVISION\n\nOne or more reviewers found blocking issues.\n\n| Agent           | Verdict        | Blockers | Suggestions |\n| --------------- | -------------- | -------- | ----------- |\n| Architect       | APPROVED       | 0        | 2           |\n| Designer        | NEEDS_REVISION | 2        | 1           |\n| Security Design | NEEDS_REVISION | 2        | 1           |\n| CTO             | NEEDS_REVISION | 3        | 0           |\n\n### Blocking Issues (MUST FIX)\n\n#### Designer Agent\n\n1. **Missing error states** - The design doesn't specify what happens when search returns 0 results\n2. **Inconsistent API naming** - `get_contact_details` uses underscore but existing APIs use camelCase\n\n#### Security Design Agent\n\n1. **CRITICAL: userId trust boundary** - Design shows userId passed to tools, but userId MUST come from server session only. Model could be jailbroken to output arbitrary userIds.\n2. **Missing rate limits** - AI endpoints are expensive and must have rate limiting to prevent abuse\n\n#### CTO Agent\n\n1. **Missing TDD specs** - No RED-GREEN-REFACTOR cycles documented\n2. **Missing mock infrastructure** - No beforeEach\u002FafterEach setup specified\n3. **Missing edge cases** - Need systematic enumeration per method\n\n### Threat Model (Security Agent)\n\n- **High Risk**: User can potentially access other users' contacts via prompt injection\n- **Medium Risk**: Rate limiting not defined for AI endpoints\n- **Mitigations Required**: userId from session only, add rate limiting\n\n### Questions Requiring Clarification\n\n1. [CTO] What's the max conversation history size?\n2. [Designer] What happens when user clicks \"View More\"?\n3. [Security] How will location data be protected? Is it PII?\n\n---\n\n**Iteration**: 1 of 3\n**Action Required**: Please revise the design document to address the blocking issues above.\n```\n\n---\n\n## Success Criteria\n\nThe design review gate succeeds when:\n\n- [ ] All five agents return APPROVED verdict\n- [ ] All blocking issues are resolved\n- [ ] All clarifying questions are answered\n- [ ] Design document is updated with revisions\n- [ ] Security threat model reviewed and mitigations in place\n- [ ] Epic is created (or ready to create)\n\n---\n\n## Related Skills\n\n- `superpowers:brainstorming` - Triggers this gate after design completion\n- `superpowers:writing-plans` - Used after gate approval for detailed implementation plan\n\n---\n\n## Agent Definitions\n\nSee detailed agent definitions in your project's agent definition files (e.g., product-manager-agent.md, architect-agent.md, designer-agent.md, security-design-agent.md, cto-agent.md).\n","# Design Review Gate\n\n## Purpose\n\nThis skill automatically activates after a design document is created (typically via `superpowers:brainstorming`). It ensures complex features receive proper review before implementation begins by spawning five specialist agents:\n\n1. **Product Manager Agent** - Use case validation and user benefit review\n2. **Architect Agent** - Technical architecture review\n3. **Designer Agent** - UX\u002FAPI design quality review\n4. **Security Design Agent** - Security threat modeling and protection review\n5. **CTO Agent** - Codebase alignment and TDD readiness review\n\nAll five must approve before proceeding to implementation.\n\n---\n\n## Coordination Mode Note\n\nThis skill supports both coordination modes:\n\n- **Task Mode** (default): Spawn 5 parallel `Task()` subagents for each review round. Fresh instances per round.\n- **Team Mode**: `TeamCreate(\"review-{design-doc-name}\")`, spawn 5 reviewers as named teammates (`pm`, `architect`, `designer`, `security`, `cto`). Reviewers retain context through revision cycles — saves 5 cold starts per re-review round. After approval, send `shutdown_request` to all, then `TeamDelete`.\n\nIn either mode, the review criteria, iteration protocol, and escalation rules are identical. See `.\u002Fguides\u002Fagent-coordination.md` for mode detection.\n\n---\n\n## Activation Triggers\n\nThis skill auto-activates when:\n\n1. A design document is committed to `docs\u002Fplans\u002F*-design.md`\n2. The `superpowers:brainstorming` skill completes\n3. User explicitly requests: `\u002Freview-design \u003Cpath-to-design.md>`\n\n---\n\n## Workflow\n\n### Phase 1: Spawn Review Agents (Parallel)\n\n```typescript\n\u002F\u002F Spawn all five agents in parallel for efficiency\nconst [pmResult, architectResult, designerResult, securityResult, ctoResult] = await Promise.all([\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"PM review\",\n    prompt: pmReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"Architect review\",\n    prompt: architectReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"Designer review\",\n    prompt: designerReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"Security design review\",\n    prompt: securityDesignReviewPrompt(designDocPath),\n  }),\n  Task({\n    subagent_type: \"general-purpose\",\n    description: \"CTO review\",\n    prompt: ctoReviewPrompt(designDocPath),\n  }),\n]);\n```\n\n### Phase 2: Aggregate Results\n\nEach agent returns a structured review:\n\n```typescript\ninterface ReviewResult {\n  agent: \"product-manager\" | \"architect\" | \"designer\" | \"security-design\" | \"cto\";\n  verdict: \"APPROVED\" | \"NEEDS_REVISION\";\n  blockers: string[]; \u002F\u002F MUST fix before implementation\n  suggestions: string[]; \u002F\u002F Nice to have\n  questions: string[]; \u002F\u002F Clarifications needed\n  use_case_analysis?: {\n    \u002F\u002F PM agent only\n    total_use_cases: number;\n    clear: number;\n    needs_work: number;\n    missing_scenarios: string[];\n  };\n  threat_model?: {\n    \u002F\u002F Security agent only\n    high_risk: string[];\n    medium_risk: string[];\n    mitigations_required: string[];\n  };\n}\n```\n\n### Phase 3: Check Gate\n\n```\nIF all five agents return APPROVED:\n  → Proceed to implementation\n  → Create epic with approved design\n\nELSE:\n  → Consolidate feedback\n  → Present to user\n  → Iterate on design\n  → Re-run gate (max 3 iterations)\n```\n\n### Phase 4: Human Escalation\n\nAfter 3 failed iterations:\n\n1. Create summary of remaining blockers\n2. Ask human to decide: override, defer, or cancel\n\n---\n\n## Agent Prompts\n\n### Product Manager Agent Prompt\n\n````markdown\nYou are the PRODUCT MANAGER AGENT reviewing a design document.\n\n## Your Task\n\nReview this design for use case clarity and user benefit validation.\n\n## Design Document\n\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. Use Case Validation\n\n- [ ] Each use case follows WHO\u002FWANTS\u002FSO THAT\u002FWHEN format\n- [ ] User personas are clearly defined\n- [ ] Use cases are realistic and based on user needs\n- [ ] Edge cases and error scenarios considered from user perspective\n\n### 2. User Benefit Review\n\n- [ ] Value proposition clearly articulated\n- [ ] Benefits are measurable (time saved, success rate, etc.)\n- [ ] User journey impact understood\n- [ ] Improvement is significant enough to build\n\n### 3. Scope Assessment\n\n- [ ] MVP clearly defined (must have vs nice to have)\n- [ ] No feature creep detected\n- [ ] Scope matches user needs, not technical possibilities\n- [ ] \"Solution looking for problem\" anti-pattern avoided\n\n### 4. Success Criteria\n\n- [ ] Success metrics are user-focused (not just technical)\n- [ ] Metrics are measurable and have thresholds\n- [ ] Evaluation timeline defined\n- [ ] Failure criteria also defined\n\n## Output Format\n\nReturn JSON:\n\n```json\n{\n  \"agent\": \"product-manager\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"use_case_analysis\": {\n    \"total_use_cases\": \u003Cnumber>,\n    \"clear\": \u003Cnumber>,\n    \"needs_work\": \u003Cnumber>,\n    \"missing_scenarios\": [\"list of gaps\"]\n  },\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n```\n````\n\n````\n\n### Architect Agent Prompt\n\n```markdown\nYou are the ARCHITECT AGENT reviewing a design document.\n\n## Your Task\nReview this design for technical architecture soundness.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. Service Architecture\n- [ ] Follows existing codebase patterns\n- [ ] Service placement is correct\n- [ ] Dependencies flow correctly (no circular deps)\n- [ ] Naming conventions followed\n\n### 2. Technical Correctness\n- [ ] API contracts well-defined\n- [ ] Database operations are correct (if applicable)\n- [ ] Error handling is complete\n- [ ] Performance considerations addressed\n\n### 3. Integration Points\n- [ ] Integrates cleanly with existing services\n- [ ] No duplicate functionality (check docs\u002FSERVICE_INVENTORY.md)\n- [ ] Proper abstraction boundaries\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"architect\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n````\n\n````\n\n### Designer Agent Prompt\n\n```markdown\nYou are the DESIGNER AGENT reviewing a design document.\n\n## Your Task\nReview this design for UX, API design, and developer experience.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. API\u002FInterface Design\n- [ ] APIs are intuitive and consistent with existing patterns\n- [ ] Parameter names are clear and predictable\n- [ ] Return types are well-structured\n- [ ] Error responses are helpful (not cryptic)\n\n### 2. User Experience (if applicable)\n- [ ] User flows are logical and efficient\n- [ ] Edge cases handled gracefully\n- [ ] Error states provide actionable guidance\n- [ ] Loading\u002Fprogress states considered\n\n### 3. Developer Experience\n- [ ] Types are well-designed and reusable\n- [ ] Interfaces are easy to implement against\n- [ ] Mocking is straightforward\n- [ ] Documentation is complete\n\n### 4. Consistency\n- [ ] Follows existing codebase conventions\n- [ ] Similar to how other features work\n- [ ] Naming is consistent with codebase\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"designer\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n````\n\n````\n\n### Security Design Agent Prompt\n\n```markdown\nYou are the SECURITY DESIGN AGENT reviewing a design document.\n\n## Your Task\nReview this design for security vulnerabilities BEFORE code is written.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. Authentication & Authorization\n- [ ] User identity verified at every entry point\n- [ ] Authorization checked for each resource access\n- [ ] No user can access other users' data\n- [ ] Session management is secure\n\n### 2. Data Protection\n- [ ] Sensitive data identified and protected\n- [ ] PII encrypted at rest and in transit\n- [ ] No secrets in logs or error messages\n- [ ] Data leakage vectors closed\n\n### 3. Input Validation\n- [ ] ALL inputs validated server-side\n- [ ] No SQL injection vectors\n- [ ] No XSS vectors\n- [ ] Safe file upload handling (if applicable)\n\n### 4. API Security\n- [ ] Rate limits defined\n- [ ] Brute force protection\n- [ ] Error messages don't leak information\n- [ ] No IDOR (Insecure Direct Object Reference) risks\n\n### 5. OWASP Top 10 Check\n- [ ] A01: Broken Access Control\n- [ ] A02: Cryptographic Failures\n- [ ] A03: Injection\n- [ ] A04: Insecure Design\n- [ ] A07: Auth Failures\n\n## Required Context\nBEFORE reviewing, consider:\n- docs\u002FARCHITECTURE_CURRENT.md (security patterns)\n- Existing auth flows in codebase\n- OWASP guidelines\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"security-design\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"threat_model\": {\n    \"high_risk\": [\"components with critical risk\"],\n    \"medium_risk\": [\"components with moderate risk\"],\n    \"mitigations_required\": [\"security controls needed\"]\n  },\n  \"blockers\": [\"MUST fix security issues\"],\n  \"suggestions\": [\"nice to have security improvements\"],\n  \"questions\": [\"security clarifications needed\"]\n}\n````\n\n````\n\n### CTO Agent Prompt\n\n```markdown\nYou are the CTO AGENT reviewing a design document.\n\n## Your Task\nReview this design for TDD readiness and codebase alignment.\n\n## Design Document\n\u003Cpath>: {designDocPath}\n\n## Review Criteria\n\n### 1. TDD Readiness (CRITICAL)\n- [ ] Test specifications are present\n- [ ] RED-GREEN-REFACTOR cycles documented\n- [ ] Edge cases enumerated per method\n- [ ] Mock infrastructure specified\n- [ ] Integration test helpers defined\n\n### 2. Codebase Alignment\n- [ ] Follows CLAUDE.md guidelines\n- [ ] Aligns with docs\u002FARCHITECTURE_CURRENT.md\n- [ ] No conflicts with existing services\n- [ ] Security considerations addressed\n\n### 3. Completeness\n- [ ] All requirements addressed\n- [ ] Success criteria are measurable\n- [ ] Implementation phases are clear\n- [ ] Acceptance criteria defined\n\n### 4. Risk Assessment\n- [ ] Risks identified with mitigations\n- [ ] Dependencies documented\n- [ ] Breaking changes flagged (if any)\n\n## Required Context Files\nBEFORE reviewing, read:\n- docs\u002FBACKEND_SERVICE_GUIDE.md\n- docs\u002FTESTING_GUIDE.md\n- templates\u002Ftask-completion-checklist.md\n\n## Output Format\n\nReturn JSON:\n```json\n{\n  \"agent\": \"cto\",\n  \"verdict\": \"APPROVED\" | \"NEEDS_REVISION\",\n  \"blockers\": [\"list of MUST fix issues\"],\n  \"suggestions\": [\"nice to have improvements\"],\n  \"questions\": [\"clarifications needed\"]\n}\n````\n\n````\n\n---\n\n## Iteration Protocol\n\n### Round 1: Initial Review\n\n1. Spawn all five agents in parallel\n2. Wait for all results\n3. If all APPROVED → proceed\n4. If any NEEDS_REVISION → consolidate and present\n\n### Rounds 2-3: Revision Cycles\n\n1. Present consolidated feedback to human\n2. Human revises design document\n3. Re-run all five agents on updated doc\n4. Repeat until all approve\n\n### Round 4: Escalation\n\nIf still not approved after 3 iterations:\n\n```markdown\n## Design Review Gate: Escalation Required\n\nAfter 3 review cycles, the following blockers remain unresolved:\n\n### Architect Agent\n- [blocker 1]\n- [blocker 2]\n\n### Designer Agent\n- [blocker 1]\n\n### CTO Agent\n- [blocker 1]\n- [blocker 2]\n\n### Options\n1. **Override** - Proceed anyway (document technical debt)\n2. **Defer** - Shelve this feature for later\n3. **Revise** - Continue iterating on design\n4. **Cancel** - Abandon this feature\n\nPlease choose an option or provide additional context.\n````\n\n---\n\n## Integration with Task Tracking\n\nWhen design is approved:\n\n```bash\n# Create epic linked to design doc\n# Use your project's task tracking system to create an epic and implementation phase tasks\n# Example:\n# task-cli create \"\u003Cfeature-name>\" --type epic\n# task-cli create \"Phase 1: Infrastructure\" --type task --parent \u003Cepic-id>\n# task-cli create \"Phase 2: Backend\" --type task --parent \u003Cepic-id>\n# task-cli create \"Phase 3: Frontend\" --type task --parent \u003Cepic-id>\n# task-cli create \"Phase 4: Polish\" --type task --parent \u003Cepic-id>\n```\n\n---\n\n## Output Format\n\n### Approved Design\n\n```markdown\n## Design Review Gate: APPROVED\n\nAll five reviewers have approved the design.\n\n| Agent           | Verdict  | Blockers | Suggestions |\n| --------------- | -------- | -------- | ----------- |\n| Product Manager | APPROVED | 0        | 1           |\n| Architect       | APPROVED | 0        | 2           |\n| Designer        | APPROVED | 0        | 1           |\n| Security Design | APPROVED | 0        | 2           |\n| CTO             | APPROVED | 0        | 3           |\n\n### Threat Model Summary (Security Agent)\n\n- **High Risk**: None identified\n- **Medium Risk**: AI-generated content could be manipulated\n- **Mitigations**: Defense in depth already designed\n\n### Suggestions (Non-Blocking)\n\n1. [Architect] Consider adding caching layer for frequent queries\n2. [Designer] Add loading skeleton to improve perceived performance\n3. [Security] Add audit logging for all assistant actions\n4. [Security] Consider anomaly detection for unusual query patterns\n5. [CTO] Document rate limit headers in API response\n\n### Next Steps\n\n1. Create epic for implementation\n2. Set up worktree with `superpowers:using-git-worktrees`\n3. Begin Phase 1 implementation\n\nReady to proceed with implementation? [Yes\u002FNo]\n```\n\n### Needs Revision\n\n```markdown\n## Design Review Gate: NEEDS REVISION\n\nOne or more reviewers found blocking issues.\n\n| Agent           | Verdict        | Blockers | Suggestions |\n| --------------- | -------------- | -------- | ----------- |\n| Architect       | APPROVED       | 0        | 2           |\n| Designer        | NEEDS_REVISION | 2        | 1           |\n| Security Design | NEEDS_REVISION | 2        | 1           |\n| CTO             | NEEDS_REVISION | 3        | 0           |\n\n### Blocking Issues (MUST FIX)\n\n#### Designer Agent\n\n1. **Missing error states** - The design doesn't specify what happens when search returns 0 results\n2. **Inconsistent API naming** - `get_contact_details` uses underscore but existing APIs use camelCase\n\n#### Security Design Agent\n\n1. **CRITICAL: userId trust boundary** - Design shows userId passed to tools, but userId MUST come from server session only. Model could be jailbroken to output arbitrary userIds.\n2. **Missing rate limits** - AI endpoints are expensive and must have rate limiting to prevent abuse\n\n#### CTO Agent\n\n1. **Missing TDD specs** - No RED-GREEN-REFACTOR cycles documented\n2. **Missing mock infrastructure** - No beforeEach\u002FafterEach setup specified\n3. **Missing edge cases** - Need systematic enumeration per method\n\n### Threat Model (Security Agent)\n\n- **High Risk**: User can potentially access other users' contacts via prompt injection\n- **Medium Risk**: Rate limiting not defined for AI endpoints\n- **Mitigations Required**: userId from session only, add rate limiting\n\n### Questions Requiring Clarification\n\n1. [CTO] What's the max conversation history size?\n2. [Designer] What happens when user clicks \"View More\"?\n3. [Security] How will location data be protected? Is it PII?\n\n---\n\n**Iteration**: 1 of 3\n**Action Required**: Please revise the design document to address the blocking issues above.\n```\n\n---\n\n## Success Criteria\n\nThe design review gate succeeds when:\n\n- [ ] All five agents return APPROVED verdict\n- [ ] All blocking issues are resolved\n- [ ] All clarifying questions are answered\n- [ ] Design document is updated with revisions\n- [ ] Security threat model reviewed and mitigations in place\n- [ ] Epic is created (or ready to create)\n\n---\n\n## Related Skills\n\n- `superpowers:brainstorming` - Triggers this gate after design completion\n- `superpowers:writing-plans` - Used after gate approval for detailed implementation plan\n\n---\n\n## Agent Definitions\n\nSee detailed agent definitions in your project's agent definition files (e.g., product-manager-agent.md, architect-agent.md, designer-agent.md, security-design-agent.md, cto-agent.md).\n",{"name":5,"triggers":52,"description":7,"auto_activate":56},[53,54,55],"design document created","docs\u002Fplans\u002F*-design.md committed","after:superpowers:brainstorming",true,"main","a298c929b6cbd662e1fce54302ce520d5ceea1a5","tools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fdesign-review-gate","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain","https:\u002F\u002Fgithub.com\u002FPrekzursil","2026-11-02 14:30:57",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":56},[65,68,71],{"tool":66,"command":67},"npx","npx skills add Prekzursil\u002Fagent-skills-toolchain --skill design-review-gate",{"tool":69,"command":70},"bunx","bunx skills add Prekzursil\u002Fagent-skills-toolchain --skill design-review-gate",{"tool":72,"command":73},"pnpm","pnpm dlx skills add Prekzursil\u002Fagent-skills-toolchain --skill design-review-gate","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fdesign-review-gate\u002FSKILL.md",[76],{"path":77,"resourceType":78,"resourceTypeDesc":79,"sizeBytes":80,"sourceHtmlUrl":81},"guides\u002Fagent-coordination.md","REFERENCE","参考文档",13952,"https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fdesign-review-gate\u002Fguides\u002Fagent-coordination.md",[83,105,132,158,172,188],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":87,"categories":88,"keywords":89,"publishedAt":47},"01M6DF7D7478R55P46REYH4QAC","clarify-requirements","Resolve genuine pre-execution ambiguity by scanning repo context, generating 1-6 grounded options, and asking 1-3 focused questions via AskUserQuestion. NOT for mid-task use (injection risk); NOT when the goal is already unambiguous; use to disambiguate vague prompts before any file edits.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fworkspace-hooks\u002Fskills\u002Fclarify-requirements\u002FSKILL.md",[],[90,91,92,93,94,95,96,97,98,99,100,101,102,103,104],"clarify requirements","clarify","requirements","risk","options","task","prompts","goal","scanning","use","context","repo","injection","execution","file",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":112,"publishedAt":47},"01M6DF79CA4BHJS66J8EZDBPWJ","openmm-md","Run FREE, open-source, Windows-native GPU molecular dynamics via the openmm-md MCP (OpenMM + CUDA on the local NVIDIA GPU). Use for protein \u002F protein-ligand MD when you want a free stack or are on Windows without a Schrodinger license. Covers the full workflow (prepare, solvate, minimize, equilibrate, production, analyze, mmgbsa) AND an honest decision guide vs Schrodinger Desmond, including how to run Desmond legitimately on Linux or a cloud GPU with a real license. This is a deliberately LESSER free alternative and does NOT replace the schrodinger MCP tools. Do NOT use it to pick a free tool when a validated FEP+, WaterMap, IFD-MD, or Prime MM-GBSA result is actually required.","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Fmcp\u002Fopenmm-md-mcp\u002Fskill\u002Fopenmm-md\u002FSKILL.md",[111],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[113,114,115,116,117,118,119,120,121,122,123,124,125,126,99,127,128,129,130,131],"openmm md","how","decision","pick","linux","analyze","tool","stack","open","NVIDIA","gpu","license","workflow","windows","free","molecular dynamics","local","do","MCP",{"skillNo":133,"name":134,"nameZh":6,"description":135,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":136,"categories":137,"keywords":144,"publishedAt":47},"01M6DF76C1MG85VEWP8VZCBNMN","visual-review","Take screenshots of web pages and UI using Playwright for visual review and iteration","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fvisual-review\u002FSKILL.md",[138,141],{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":142,"categoryName":143,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[33,145,146,147,148,149,150,151,152,153,114,154,155,156,157],"visual","visual review","pages","web","false","iteration","take","check","slides","ui","screenshot","playwright","screenshots",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":164,"publishedAt":47},"01M6DF73AQVCBZKEN0YXEX9FXP","status","Diagnostic status report — shows metaswarm installation state, project setup, and potential issues","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstatus\u002FSKILL.md",[],[160,165,166,167,168,169,170,171],"setup","report","project","installation","project setup","issues","state",{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":179,"publishedAt":47},"01M6DF6X6C2XB0P6GX76P7TTYV","start","Use when starting work on any task, when the user mentions metaswarm, or when the user wants to begin tracked development work","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fstart\u002FSKILL.md",[178],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[174,180,95,181,182,183,99,184,185,186,187],"start issue","issue","ready","work on issue","user","work","work on","development",{"skillNo":189,"name":165,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":193,"publishedAt":47},"01M6DF6QMJ9AJKFKHHKRT005PQ","Interactive project setup — detects your project, configures metaswarm, writes project-local files","https:\u002F\u002Fgithub.com\u002FPrekzursil\u002Fagent-skills-toolchain\u002Fblob\u002Fmain\u002Ftools\u002Feditor\u002Fmetaswarm\u002Fskills\u002Fsetup\u002FSKILL.md",[],[165,167,129,194,169,195],"files","interactive"]