prd-review
Skill40 starsChanged 7 months agoMITView on GitHub
PRD-specific validation gate: checks required PRD sections, TR-ID requirement IDs, GIVEN-WHEN-THEN acceptance criteria, dependency-graph bidirectionality, and traceability readiness for engineering hand-off. Use ONLY for PRDs (`design/prd/*.md`); for any other design doc, use /design-review. Run in a fresh session — never the same session that wrote the PRD.
16 other projects use a version of this.
Adopted by
Most recently taken up by
- jikefan/product-manager-skillstheir own version, first seen Nov 8, 2026
- ritamgh/claude-skillstheir own version, first seen Nov 1, 2026
- The-AI-Thinker/claude-code-pm-startertheir own version, first seen Oct 15, 2026
- wuyining0130/c-roomtheir own version, first seen Oct 15, 2026
- osac-project/osac-ai-skillstheir own version, first seen Oct 13, 2026
- sashabogi/trantortheir own version, first seen Oct 11, 2026
Used with
Projects with it also use security-review.
Other files people use alongside this one.
Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
SentrySkillsecurity-review
Finds exploitable application security vulnerabilities in code changes. Use for Warden security scans, appsec review, OWASP-style checks, authentication or authorization bugs, injection, XSS, SSRF, path traversal, secrets, unsafe crypto, webhook verification, open redirects, or sensitive data exposure.
Also in 3 projects that use this
Other versions16 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 16
- TayaIntelligence/skills★ 32same name
- caiaffa/claude-code-ultimate-engineering-system★ 17same name
- The-AI-Thinker/claude-code-pm-starter★ 13same name
- andrewthetechie/andrew-skills★ 6same name
- yihannangua/prd-review-skill★ 5same name
- jikefan/product-manager-skills★ 4same name
- shitiandou83-maker/claude-skills★ 2same name
- janellecipriano/pm-skills★ 1same name
- mikeweib/claude-skills★ 1same name
- sashabogi/trantor★ 1same name
6 more not listed
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository77 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- design/CLAUDE.mdCLAUDE.md
- docs/CLAUDE.mdCLAUDE.md
- src/CLAUDE.mdCLAUDE.md
- tests/CLAUDE.mdCLAUDE.md
- adoptSkill
- architecture-decisionSkill
- architecture-reviewSkill
- asset-auditSkill
- asset-specSkill
- balance-checkSkill
- brainstormSkill
- bug-reportSkill
- bug-triageSkill
- changelogSkill
- code-reviewSkill
- consistency-checkSkill
- content-auditSkill
- create-architectureSkill
- create-control-manifestSkill
- create-epicsSkill
- create-storiesSkill
- day-one-patchSkill
- design-bibleSkill
- design-reviewSkill
- design-systemSkill
- dev-storySkill
- estimateSkill
- extractSkill
- gate-checkSkill
- helpSkill
- hotfixSkill
- launch-checklistSkill
- localizeSkill
- map-systemsSkill
- milestone-reviewSkill
- onboardSkill
- patch-notesSkill
- perf-profileSkill
- project-stage-detectSkill
- propagate-design-changeSkill
- prototypeSkill
- qa-planSkill
- quick-designSkill
- regression-suiteSkill
- release-checklistSkill
- retrospectiveSkill
- reverse-documentSkill
- review-all-prdsSkill
- scope-checkSkill
- security-auditSkill
- setup-frameworkSkill
- skill-improveSkill
- skill-testSkill
- smoke-checkSkill
- soak-testSkill
- sprint-planSkill
- sprint-statusSkill
- startSkill
- story-doneSkill
- The first 60 shown.
The file
Show its rules and text
We split this skill into the rules it gives an agent
15 rules. 0 are common, 12 are distinctive, and 3 are very specific to this project.
0
Common
Most of the 11 edited versions we read keep these.
12
Distinctive
This author's own choices. Worth a look.
3
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 25
Do not run when:
- Very specific: line 46
If the argument is a system name (not a path), check design/prd/<name>.md.
- Very specific: line 48
If no argument, glob design/prd/*.md and ask:
- Distinctive: line 52
If the file does not exist, stop with a clear error.
- Distinctive: line 112
Look up in the registry
- Distinctive: line 113
If registered with a different value: FAIL — VALUE MISMATCH
- Distinctive: line 114
If unregistered: WARN — should be registered or already declared in another PRD
- Distinctive: line 124
If the system is monetized and the concept said "Free" → FAIL
- Distinctive: line 141
Check if the PRD addresses:
- Distinctive: line 156
Every numerical value has units
- Distinctive: line 157
Every external system referenced has at least an interface description (even if the integration ADR is not yet written)
- Very specific: line 214
If the user agrees, update the system's row in design/systems-index.md:
- Distinctive: line 225
Every blocker has a section reference and a suggested fix.
- Distinctive: line 247
Run in a fresh session — never the same session that wrote the PRD.
- Distinctive: line 248
Read-only on the PRD itself.
“Common” is measured: kept by at least 6 in 10 of the 11 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Review a PRD
Independent review gate for a single PRD. The reviewer must be in a fresh session so it does not inherit the authoring context — a PRD that "felt right while writing" can still fail review.
Output: a printed verdict + structured blockers list. Optionally writes a .review.md sibling file.
Purpose / When to Run
Run when:
- A PRD has just been finished by
/design-system - A PRD has been retrofit from extracted code
- A reviewer wants a second pass on a previously-approved PRD that has changed
Do not run when:
- The PRD is incomplete (sections still
[To be designed]) → run/design-systemfirst - The PRD has not yet been written → run
/design-systemfirst
Inputs
- Path to a PRD file (required)
design/concept.mdfor pillar checks- Dependency PRDs from
design/systems-index.md design/registry/entities.yaml
Outputs
- A verdict:
APPROVED,NEEDS REVISION, orMAJOR REVISION - A structured blockers list
- Optional:
<prd-path>.review.mdsnapshot written
Phase 1: Resolve Path and Confirm Doc Type
If the argument is a system name (not a path), check design/prd/<name>.md. If exists, use it. If multiple matches, ask which.
If no argument, glob design/prd/*.md and ask:
- Prompt: "Which PRD should I review?"
- Options: list of files (use AskUserQuestion if ≤ ~6, else free text)
If the file does not exist, stop with a clear error.
Doc-type guard: this skill is for PRDs only. If the resolved file is
not a PRD (no ## Detailed Requirements with TR- IDs and not under
design/prd/), stop and recommend /design-review <path> instead. Do
not run PRD checks against a non-PRD doc.
Phase 2: Read Context
Read:
- The target PRD in full
design/concept.mdfor principle and metric alignmentdesign/systems-index.mdto identify dependencies- For each listed dependency, read the dependency PRD's interface sections
design/registry/entities.yaml.claude/docs/technical-preferences.md(framework + min OS)
Phase 3: Run the Checks
Each check produces a status: PASS, WARN, or FAIL.
3a: Section presence (FAIL on missing)
Required sections grep:
- Overview
- User Goal
- Detailed Requirements
- Edge Cases
- Dependencies
- Configurable Values
- Acceptance Criteria
- Accessibility
Each missing or placeholder-only section is FAIL.
3b: Section quality
- Overview — at least one paragraph, not a single sentence; does not contradict the concept doc
- User Goal — explicitly mentions the user, the moment, the alternative they would use otherwise
- Detailed Requirements — every requirement has a TR-ID (
TR-<system>-NNN); FAIL if missing - Edge Cases — covers: offline, slow network, backgrounding, OS permission denied, accessibility overlays — at minimum. Each formatted as
If <condition>: <resolution>. FAIL if any vague resolution (e.g., "handle gracefully" without specifics) - Dependencies — bidirectional check: each listed dependency is also referenced in the dependency PRD's "depended on by" section (or the systems-index)
- Configurable Values — each value has: name, default, range, owner. FAIL if a default is missing.
- Acceptance Criteria — every requirement has at least one criterion; every criterion is GIVEN-WHEN-THEN. FAIL if any criterion is non-testable.
- Accessibility — for UI systems, must cover: contrast, touch target, screen reader, dynamic type, reduce motion. WARN if any of those are missing; FAIL if section is empty or
N/Afor a UI system.
3c: Internal consistency
- TR-IDs unique within the PRD: FAIL if any duplicates
- Configurable values referenced by name in Detailed Requirements: WARN if a value is defined but not referenced (likely dead)
- Acceptance criteria reference TR-IDs: WARN if a criterion has no TR-ID linkage
- Edge cases cover every state transition mentioned: WARN if a state transition has no edge-case row
3d: Cross-document consistency
For every entity / configurable / event mentioned in the PRD:
- Look up in the registry
- If registered with a different value: FAIL — VALUE MISMATCH
- If unregistered: WARN — should be registered or already declared in another PRD
For every dependency listed:
- Confirm the dependency PRD exists. If not, WARN — provisional assumptions about the interface
- Confirm the interface this PRD expects matches what the dependency PRD declares
3e: Concept alignment
- The User Goal must serve a JTBD related to the concept's Section 2 persona
- The PRD must not contradict the concept's anti-features (Section 4 Cuts / 5 Anti-features)
- If the system is monetized and the concept said "Free" → FAIL
3f: Accessibility floor
For any UI-bearing system, the Accessibility section must explicitly state:
- WCAG 2.2 AA contrast verified
- Min touch target ≥ 44pt iOS / 48dp Android (state which platforms)
- VoiceOver / TalkBack labels and reading order
- Dynamic Type support up to at least Large (iOS) / 200% (Android)
- Reduce-motion alternative for any motion
- No color-only differentiation
- Accessibility test plan reference (manual or automated)
WARN per missing item; FAIL if 3+ items are missing.
3g: Mobile platform considerations
Check if the PRD addresses:
- Offline behavior
- Background-foreground transitions
- App-killed-mid-action recovery
- iOS / Android divergences if both are targets
- Push token rotation if push is involved
- IAP receipt validation if monetized
- Permission denial handling for any sensor / camera / location / notification
WARN per missing item that is clearly relevant to this system.
3h: Implementation readiness
A PRD passes if a competent engineer could read it and write the spec without re-asking the PM. Specifically:
- No "TBD" or "tbd" or "TODO" left
- Every numerical value has units
- Every external system referenced has at least an interface description (even if the integration ADR is not yet written)
- Acceptance criteria are independently verifiable
Phase 4: Optional Specialist Cross-Check
For UI-heavy PRDs, optionally spawn Task to a UX specialist to validate Section 8 (Accessibility) and the User Goal against platform conventions (iOS HIG / Material 3).
For systems with framework-tricky behavior (push, biometrics, payments, background work), optionally spawn the framework specialist to flag implementation realities the PRD missed.
The reviewer remains in charge — specialists return findings, the reviewer integrates them into the verdict.
Phase 5: Build the Verdict
Tally checks:
- 0 FAIL, 0 WARN → APPROVED
- 0 FAIL, ≤ 5 WARN → APPROVED WITH NOTES (treat as APPROVED but list warns)
- 0 FAIL, >5 WARN → NEEDS REVISION
- 1-3 FAIL → NEEDS REVISION
- 4+ FAIL → MAJOR REVISION
Surface the verdict at the top of the output.
Phase 6: Output
# PRD Review: <system>
**Verdict: <APPROVED / APPROVED WITH NOTES / NEEDS REVISION / MAJOR REVISION>**
## Blockers (FAIL)
1. <specific issue> — Section <N>, line <approx>
Fix: <suggested action>
## Warnings (WARN)
- <issue>
## Confirmed strengths
- <what passed and matters>
## Recommended next steps
- <if APPROVED> Run `/consistency-check` if not already, then `/architecture-review` will use this PRD.
- <if NEEDS REVISION> Run `/design-system retrofit <path>` to address the listed sections, then re-run this review.
- <if MAJOR REVISION> The PRD has too many gaps for line-edits. Recommend re-authoring sections in `/design-system`.Optionally ask: "Write this review to <prd-path>.review.md?"
Phase 7: Update Systems Index
If the user agrees, update the system's row in design/systems-index.md:
- APPROVED → Status:
Approved - NEEDS REVISION / MAJOR REVISION → Status:
In Review
Ask before writing.
Quality Gates
- The verdict must match the tally rules — no "soft passes" if FAILs exist.
- Every blocker has a section reference and a suggested fix.
- The review never edits the PRD itself.
- The review is opinionated about Accessibility and Edge Cases — these are the most-skipped sections in mobile PRDs and the cheapest gaps to flag here vs. fix in production.
Examples
PRD auth.md: 0 FAIL, 2 WARN (offline edge case missing, dynamic type not mentioned).
- Verdict: APPROVED WITH NOTES.
- Blockers: none.
- Warnings: missing offline edge case, missing dynamic type assertion.
- Recommend: add the two warns; PRD is good to ship.
PRD paywall.md: 4 FAIL (no acceptance criteria, no accessibility, missing receipt-validation edge case, missing iOS / Android divergence section).
- Verdict: MAJOR REVISION.
- Recommend: re-author Sections 4, 7, 8, 9 in
/design-system.
Constraints
- Run in a fresh session — never the same session that wrote the PRD.
- Read-only on the PRD itself; only the systems index and optional review-snapshot file are written.
- The reviewer does not silently fix problems — surfaces them so the author can correct.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

