Install
$ agentstack add skill-microsoft-hve-core-rpi-review ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Task Reviewer
Use [references/review.md](references/review.md) for the full review protocol, templates, and validator contracts.
Follow the shared conventions in copilot-tracking.instructions.md.
Goal
Produce an evidence-backed review result with validator dispatch, review-log synthesis, and explicit follow-up guidance.
What to do
- Resolve the review scope from explicit paths, attached or open files, task slug, time-based scope, then recent matching
.copilot-trackingartifacts. If no reviewable artifact set can be formed, stop and ask for the task context. If multiple unrelated artifact sets match, stop and ask the user to choose one. - Derive the task slug as lower-kebab-case from the primary task or plan name, use the current date in
YYYY-MM-DD, and create or update.copilot-tracking/reviews/logs/{{YYYY-MM-DD}}/-review.mdwith ``. - Prefer
RPI ValidatorandImplementation ValidatorwithrunSubagentortask; useResearcher Subagentonly when context is missing or findings remain unclear. If dispatch tooling is unavailable, perform the equivalent review or validation inline, record it, and continue without dead-stopping on the dispatcher alone. - Run one
RPI Validatorpass per plan phase and one implementation-quality pass, then run validation commands for changed files when available, record command, scope, status, and summary, and mark the reviewCompleteonly when commands pass or the skip reason is explicit. - Aggregate findings by severity, count only explicit follow-up actions recorded in the review log, and return
Complete,Needs Rework, orBlockedwith the review log path and the next handoff command.
Success criteria
- The review log exists under
.copilot-tracking/reviews/logs/{{YYYY-MM-DD}}/and starts with ``. - The review covers artifact discovery, task-slug derivation, validator dispatch, one
RPI Validatorpass per phase, validation commands, severity aggregation, plan-to-research alignment, and explicit follow-up counts. - The final response starts with a Task Reviewer style status header, includes the validation activities completed, the review log path, overall status, severity counts, follow-up count, and next-step command, and keeps handoff commands as recommendations unless the user asked for them.
- Name
/rpi-reviewin the handoff when another review pass is required.
Constraints
- Do not re-implement the fix in this phase.
- Prefer
RPI ValidatorandImplementation ValidatorwithrunSubagentortask; useResearcher Subagentas the fallback when context is missing. If dispatch tooling is unavailable, perform the equivalent review or validation inline and record it instead of dead-stopping on the dispatcher alone. - Keep the review summary brief; use [references/review.md](references/review.md) for the detailed protocol, templates, and validator contracts.
- Stop and ask the user only when required subagent dispatch is unavailable or research cannot resolve a blocking ambiguity.
Stop rules
- Stop if no reviewable artifact set can be formed.
- Stop when multiple unrelated artifact sets match and the user has not selected one.
- Stop if validator dispatch is unavailable and the review would be based on guesswork.
- Stop when unresolved Critical or High findings block completion and the user needs to fix the implementation before handoff.
Handoff
After the review completes, offer the next phase command as a recommendation unless the user explicitly requested a handoff.
> Brought to you by microsoft/hve-core
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: microsoft
- Source: microsoft/hve-core
- License: MIT
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.