Menu
Live visual and UX audit of web UI with evidence-backed findings.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
| name | design-review |
| description | Live visual and UX audit of web UI with evidence-backed findings. |
/qa-report when visual polish is the remaining gap.Related: /accessibility-audit for WCAG; /qa-report for functional bugs; /performance-optimization for render cost.
Do not use this skill for backend-only changes or when no UI is renderable.
DESIGN.md, Tailwind config, or reference components if present.Return a markdown report with these exact sections:
/pricing — CTA button same color as background (#F5F5F5 on #FAFAFA); fails visibility heuristic.Code review and cleanup across reuse, quality, and efficiency dimensions. Launches three parallel review agents against the current diff, then aggregates findings and applies fixes.
Red-team the agent's own output against OWASP Top 10 for LLM Applications and Agentic AI. Self-inject, test boundaries, check exfiltration paths. If you can't attack your own output, someone else will.
Mandatory verification of every factual claim before emission. API contracts, dependency versions, file existence, behavior promises — claims about code are hypotheses until verified against the actual source. Based on Dhuliawala et al. (Meta FAIR, ACL 2024).
Disciplined 6-step diagnosis loop with strict evidence gates between stages. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Cannot advance without the required artifact per step.
Split the workflow into Evaluator and Optimizer personas. Evaluator scores output 1–10 on correctness, completeness, safety, and simplicity. Optimizer rewrites to address critiques. Loop until score ≥9 or 3 iterations. Self-improvement without measurement is guessing.
Detect fail-open security patterns: debug mode in production, permissive CORS, disabled CSRF, default admin credentials, verbose error messages, unauthenticated health endpoints. Configuration is code — review it with the same rigor.