Skip to content
Back to skills

Onex Plan Review

ASecurity

Adversarial pre-execution check on a plan file. Run this before execute_plan or manually.

  • 2 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added September 1, 2026
developmentpythonapi

Works with

  • api

Security analysis

A100/100

Scanned September 1, 2026

npx -y skills add Julian0444/omnicursor --skill onex-plan-review --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Onex Plan Review?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Onex Plan Review
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/julian0444-onex-plan-review/badge)](https://www.skillsdirectory.com/skills/julian0444-onex-plan-review)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: "onex-plan-review"
description: >-
  Adversarial pre-execution check on a plan file. Run this before execute_plan or manually.
disable-model-invocation: true
---

# onex-plan-review

Adversarial pre-execution check on a plan file. Run this before execute_plan or manually.

**Announce at start:** "I'm using the onex-plan-review skill."

## Usage

```
/plan-review docs/plans/my-plan.md
```

## Checks (R1–R6)

Run all six checks. Classify each finding: CRITICAL, MAJOR, MINOR, NIT.

### R1 — Count Integrity

Scan numeric claims near "tasks", "steps", "phases". Recount from actual `## Task N:` headings.
If any count claim ≠ actual count: CRITICAL.

### R2 — Acceptance Criteria Strength

For each task's acceptance criteria:
- Ban subjective language: "clean", "robust", "nice" → MAJOR unless paired with a measurable check
- Weak verification ("tests pass") without specific assertion → MAJOR
- "superset of N" without listing exact N → MINOR

### R3 — Scope Violations

Can the task's stated scope implement everything it claims?
- DB-only task claiming Python runtime guards → MAJOR
- Doc-only task claiming runtime enforcement → MAJOR (unless doc is a confirmed runtime source)

### R4 — Integration Traps

- New import paths: confirm module exists in repo before referencing
- API signatures: pin to actual call site, not assumed shape
- Return types: state actual path or describe shape — not "returns ModelFoo" without a path

### R5 — Idempotency

Tasks that create resources must state dedup mechanism:
- Files: check existence before writing
- Tickets: dedup by title match
Missing dedup for a resource-creating task → MINOR.

### R6 — Verification Soundness

Grade each verification step:
- **strong**: schema introspection + rollback + runtime call
- **medium**: asserts specific fields or types
- **weak**: log contains string, file exists, command exits 0

Weak-only proof for a core invariant → MAJOR. Pair with medium or strong.

## Verdict

After all checks:
- No CRITICAL or MAJOR findings → **PASS** (execute_plan may proceed)
- Any CRITICAL or MAJOR → **FAIL** (list all findings, stop — do not proceed to ticket creation)

Output format:
```
Plan Review: docs/plans/my-plan.md
R1: PASS  R2: PASS  R3: PASS  R4: MINOR  R5: PASS  R6: PASS
Findings: 0 CRITICAL, 0 MAJOR, 1 MINOR, 0 NIT
Verdict: PASS
```

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.