# Staff Level Review

> Read-only engineering review with a fixed findings/verdict output contract. Use when the review needs that contract, a review context bundle, or a non-GitHub diff source (e.g. Azure DevOps, a patch file, a bounded set of repos and docs). For routine review of a local diff or GitHub PR, prefer the built-in /code-review or /review instead.

- **Type:** Skill
- **Install:** `agentstack add skill-justinmchoi-ai-toolkit-staff-level-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [justinmchoi](https://agentstack.voostack.com/s/justinmchoi)
- **Installs:** 0
- **Category:** [Cloud & Infrastructure](https://agentstack.voostack.com/c/cloud-infrastructure)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [justinmchoi](https://github.com/justinmchoi)
- **Source:** https://github.com/justinmchoi/ai-toolkit/tree/main/skills/engineering/staff-level-review

## Install

```sh
agentstack add skill-justinmchoi-ai-toolkit-staff-level-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Staff-Level Review

Use this as a read-only engineering review checkpoint. Produce findings and a
verdict; do not edit files, push changes, or post PR comments unless the user
explicitly switches to a separate review-fix or posting workflow.

If `docs/specs/0004-staff-level-review.md` exists in the current repo, it is
the fuller definition and takes precedence. If it does not exist, this file is
self-contained — do not go looking for the spec elsewhere.

## Inputs

Review any bounded diff source:

- PR number, URL, branch, or local diff
- provided patch or diff file
- review context bundle
- changed files plus related docs, ADRs, CONTEXT files, and CI/test signals

If the diff source is ambiguous, ask before reviewing.

## Preflight

Before reviewing, decide whether to proceed:

```text
proceed: yes | no | needs-info
reason:
required_context:
suggested_next_action:
```

Stop instead of forcing a low-confidence review when the PR is closed/merged,
the diff is too large, requirements are missing, context is insufficient, or
extra repositories are needed but not approved.

## Review Scope

Review for high-signal issues across:

- correctness and regressions
- architecture and responsibility boundaries
- security and privacy
- performance and unbounded work
- test quality and missing behavior coverage
- maintainability and naming
- API/interface design
- breaking changes and migration risk
- operability, rollout, observability, and rollback
- requirement compliance

Apply a false-positive filter before reporting: skip issues that are
pre-existing, covered elsewhere, already verified by tests/CI, intentionally
documented, or merely preference without a clear better alternative.

## Test Policy

Do not run broad build or test commands by default.

Allowed by default:

- read CI status or provided test output
- read relevant tests
- reason about missing coverage

Run targeted tests, typecheck, or lint only when the command is known, scoped,
and allowed by the user or calling workflow.

## Severity And Verdict

Use this severity vocabulary:

- `BLOCKING`: must be fixed before merge
- `SUGGESTION`: important improvement worth discussing
- `QUESTION`: intent is unclear and blocks review confidence
- `NIT`: minor issue that should not block merge

Verdict is driven by findings:

- `Request changes`: at least one `BLOCKING`
- `Needs clarification`: confidence-blocking `QUESTION`
- `Approve with suggestions`: no `BLOCKING`, but meaningful suggestions
- `Approve`: no blocking or confidence-blocking findings

## Output Format

Findings come first. If there are no findings, say so explicitly. Specific,
evidence-backed positives may appear only after findings.

```markdown
# Staff-Level Review

## Findings

[BLOCKING] Short title

- Issue:
- Why it matters:
- Evidence:
- Recommendation:
- Location:

[SUGGESTION] Short title

- Issue:
- Why it matters:
- Evidence:
- Recommendation:
- Location:

[QUESTION] Short title

- Question:
- Why it matters:
- Evidence:
- What would resolve it:
- Location:

[NIT] Short title

- Issue:
- Recommendation:
- Location:

## Verdict

Approve | Approve with suggestions | Request changes | Needs clarification

## Summary

...

## What's Working Well

- ...

## Verification

- Diff source:
- Context inspected:
- Commands run:
- Checks reviewed:
- Not run:

## Review Constraints

- Read-only:
- Extra repos:
- Disallowed paths:
- Sensitivity:
```

## External References

External or legacy `staff-review` material may be used as reference only after
source and license verification. Do not import external material into this repo
unless it has been grilled against `docs/specs/0004-staff-level-review.md` and
the required source registry / notices are updated.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [justinmchoi](https://github.com/justinmchoi)
- **Source:** [justinmchoi/ai-toolkit](https://github.com/justinmchoi/ai-toolkit)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-justinmchoi-ai-toolkit-staff-level-review
- Seller: https://agentstack.voostack.com/s/justinmchoi
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.