# Skill: review-plan

## Purpose
Reviews a plan file (*-PLAN.md) against best practices before implementation begins. Catches security gaps, missing specs, untested assumptions, and API design issues early -- when they're cheap to fix.

## Usage
```
/review-plan M2-auth-PLAN.md
/review-plan          # prompts to select from *-PLAN.md files
```

## How it works
1. Loads 5 best practice files: api-design, llm-code-security, spec-driven-development, test-driven-development, security-architecture
2. Reads the specified plan file
3. Evaluates against a 6-area checklist: security by design, API design, LLM code security, spec-driven development, test-driven development, operational readiness
4. Outputs a scorecard, critical gaps, recommendations, and acknowledgment of what's done well

## Best practice files referenced
- `~/dev/claude/projects/best-practices/api-design.md`
- `~/dev/claude/projects/best-practices/llm-code-security.md`
- `~/dev/claude/projects/best-practices/spec-driven-development.md`
- `~/dev/claude/projects/best-practices/test-driven-development.md`
- `~/dev/claude/projects/best-practices/security-architecture.md`
- Plus any tech-stack-specific files from the index

## Gotchas
- Read-only skill (allowed-tools: Read, Glob, Grep, Bash cat/ls/find). Cannot edit files.
- Relies on best-practices repo being cloned at `~/dev/claude/projects/best-practices/`
- The `~/` path in the bang-command generates a validator warning but works in practice