P1: Reviewer prompt embeds untrusted output directly with no anti-injection guardrails, allowing adversarial reviewed text to steer verdicts.

Check if this issue is valid — if so, understand the root cause and fix it. At skills/santa-method/SKILL.md, line 93:

<comment>Reviewer prompt embeds untrusted output directly with no anti-injection guardrails, allowing adversarial reviewed text to steer verdicts.</comment>

<file context>
@@ -0,0 +1,306 @@
+{task_spec}
+
+## Output Under Review
+{output}
+
+## Evaluation Rubric
</file context>

P1: Batch-sampling pseudocode can crash on small batches and recurse without a convergence cap, risking runtime errors and non-termination.

Check if this issue is valid — if so, understand the root cause and fix it. At skills/santa-method/SKILL.md, line 255:

<comment>Batch-sampling pseudocode can crash on small batches and recurse without a convergence cap, risking runtime errors and non-termination.</comment>

<file context>
@@ -0,0 +1,306 @@
+import random
+
+def santa_batch(items, rubric, sample_rate=0.15):
+    sample = random.sample(items, max(5, int(len(items) * sample_rate)))
+
+    for item in sample:
</file context>

P1: santa_verdict returns inconsistent shapes (string vs tuple), causing runtime unpacking failure on the NICE path.

Check if this issue is valid — if so, understand the root cause and fix it. At skills/santa-method/SKILL.md, line 164:

<comment>`santa_verdict` returns inconsistent shapes (string vs tuple), causing runtime unpacking failure on the NICE path.</comment>

<file context>
@@ -0,0 +1,306 @@
+def santa_verdict(review_b, review_c):
+    """Both reviewers must pass. No partial credit."""
+    if review_b.verdict == "PASS" and review_c.verdict == "PASS":
+        return "NICE"  # Ship it
+
+    # Merge flags from both reviewers, deduplicate
</file context>

santa_verdict return value causes tuple-unpacking error on NICE path

santa_verdict returns the bare string "NICE" on success, but the call site at line 181 attempts to destructure the result as verdict, issues, suggestions = santa_verdict(review_b, review_c). In Python, unpacking a 4-character string into exactly 3 variables raises ValueError: too many values to unpack (expected 3) — so any successful first-pass would crash the convergence loop instead of shipping.

The fix is to return a consistent tuple from santa_verdict in both branches:

Convergence loop off-by-one: the final fix's output is never verified

With MAX_ITERATIONS = 3, the loop runs iterations 0, 1, and 2. At the end of iteration 2 the code applies a third fix and creates fresh review_b/review_c agents — but the loop ends immediately after and those agents are never consulted. escalate_to_human is then called with issues from the verdict check before the third fix, which may no longer accurately describe the current (post-fix) state of output.

The architecture diagram also shows inconsistency: it says if i > MAX: escalate (implying the check happens before the fix on the last iteration) but the pseudocode fixes first and then escalates — the final fix is silently dropped.

A minimal correction is to perform one final verdict check after the loop:

MAX_ITERATIONS = 3

for iteration in range(MAX_ITERATIONS):
    verdict, issues, suggestions = santa_verdict(review_b, review_c)

    if verdict == "NICE":
        log_santa_result(output, iteration, "passed")
        return ship(output)

    output = fix_agent.execute(
        output=output,
        issues=issues,
        instruction="Fix ONLY the flagged issues. Do not refactor or add unrequested changes."
    )

    review_b = Agent(prompt=REVIEWER_PROMPT.format(output=output, ...))
    review_c = Agent(prompt=REVIEWER_PROMPT.format(output=output, ...))

# One final check on the output produced by the last fix
verdict, issues, suggestions = santa_verdict(review_b, review_c)
if verdict == "NICE":
    log_santa_result(output, MAX_ITERATIONS, "passed")
    return ship(output)

# Genuinely exhausted — escalate with current issues
log_santa_result(output, MAX_ITERATIONS, "escalated")
escalate_to_human(output, issues)

santa_batch has no recursion depth limit — contradicts stated failure-mode mitigation

santa_batch calls itself recursively every time a NAUGHTY item is found. There is no max_iterations guard, so if batch_fix never fully resolves the failure pattern (or introduces new ones), this recurses until a Python RecursionError is raised. The failure modes table in the same document explicitly lists "Infinite loop" and prescribes a "Max iteration cap (3)" as the mitigation — but santa_batch does not implement it.

Missing tools frontmatter field and non-standard section headings

CLAUDE.md specifies that skills should have "Clear sections (When to Use, How It Works, Examples)". Two deviations:

1. Section headings — this skill uses ## When to Activate instead of the standard ## When to Use, and there is no ## How It Works or ## Examples section. The detailed phase/pattern content could be reorganised under those headings to stay consistent with the rest of the skill library.

2. Missing tools frontmatter — Other skills that invoke the Agent tool (e.g. eval-harness) declare tools: Read, Write, Edit, Bash, Grep, Glob in their YAML frontmatter. Since this skill explicitly relies on spawning subagents, adding a tools key helps the harness and users understand the required permissions upfront.

_{Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!}

⚠️ Potential issue | 🟡 Minor

#!/bin/bash
# Description: Check if santa-method is registered in the workflow-quality module

# Search for the workflow-quality module and display its paths array
jq '.[] | select(.id == "workflow-quality") | {id, paths}' manifests/install-modules.json

#!/bin/bash
# First, check if the manifest file exists and view its overall structure
echo "=== Checking if manifest file exists ==="
if [ -f "manifests/install-modules.json" ]; then
    echo "File found. First 50 lines:"
    head -50 manifests/install-modules.json
    echo ""
    echo "=== Total lines in file ==="
    wc -l manifests/install-modules.json
else
    echo "File not found at manifests/install-modules.json"
    # Try to find it
    echo "Searching for install-modules.json:"
    find . -name "install-modules.json" -type f 2>/dev/null
fi

#!/bin/bash
# Search for the workflow-quality module in the manifest
echo "=== Searching for workflow-quality module ==="
grep -n "workflow-quality" manifests/install-modules.json

echo ""
echo "=== Checking if santa-method is mentioned in manifest ==="
grep -n "santa-method" manifests/install-modules.json

echo ""
echo "=== Using jq to extract workflow-quality module ==="
python3 <<'PYTHON_EOF'
import json

with open('manifests/install-modules.json', 'r') as f:
    data = json.load(f)

# Find workflow-quality module
for module in data.get('modules', []):
    if module.get('id') == 'workflow-quality':
        print("Found workflow-quality module:")
        print(json.dumps(module, indent=2))
        break
else:
    print("workflow-quality module not found")
    print("\nAvailable modules:")
    for module in data.get('modules', []):
        print(f"  - {module.get('id')}")
PYTHON_EOF

Add santa-method to the workflow-quality module manifest.

The new skill is not registered in manifests/install-modules.json. It should be added to the workflow-quality module's paths array (currently at line 182) alongside related skills like verification-loop, eval-harness, and continuous-learning-v2.

Add "skills/santa-method" to the paths array in the workflow-quality module definition.

Verify each finding against the current code and only fix it if needed.

In `@skills/santa-method/SKILL.md` around lines 1 - 305, The workflow-quality
module's paths array in the install modules manifest is missing the new skill;
add the string "skills/santa-method" to the paths array alongside existing
entries like "verification-loop", "eval-harness", and "continuous-learning-v2"
so the Santa Method skill is registered for installation; ensure the value is
quoted and comma-separated consistently with the other path entries and commit
the manifest change.

🛠️ Refactor suggestion | 🟠 Major

Rename section to match repository guidelines.

The section title should be "When to Use" rather than "When to Activate" to align with the repository's skill documentation standards. As per coding guidelines, skills must be formatted with clear sections for "When to Use", "How It Works", and "Examples".

-## When to Activate
+## When to Use

Verify each finding against the current code and only fix it if needed.

In `@skills/santa-method/SKILL.md` at line 13, Change the section header "## When
to Activate" to "## When to Use" in SKILL.md (look for the header string "When
to Activate"), and ensure the file includes the required sibling sections "How
It Works" and "Examples" (add them if missing) so the skill follows the
repository documentation standard.

🛠️ Refactor suggestion | 🟠 Major

Restructure to align with repository skill format.

The repository guidelines require an explicit "How It Works" section for skill documentation. Consider restructuring the content so that "Phase Details" becomes a subsection under a top-level "How It Works" section. This would align the document with established repository patterns for skills.

-## Phase Details
+## How It Works
+
+### Phase Details

Verify each finding against the current code and only fix it if needed.

In `@skills/santa-method/SKILL.md` at line 65, The document's headings don't
follow the repo skill format: move the existing "Phase Details" section to be a
subsection under a new top-level "How It Works" heading; specifically add a
top-level "How It Works" header and nest "Phase Details" beneath it (e.g., "##
How It Works" followed by "### Phase Details"), ensuring the rest of the content
is reflowed under that new structure so the skill matches repository patterns.

🛠️ Refactor suggestion | 🟠 Major

Restructure to include explicit "Examples" section.

Repository guidelines require skills to have clear sections for "When to Use", "How It Works", and "Examples". Consider moving or reorganizing "Implementation Patterns" under a top-level "Examples" section to align with established repository patterns.

-## Implementation Patterns
+## Examples
+
+### Implementation Patterns

Verify each finding against the current code and only fix it if needed.

In `@skills/santa-method/SKILL.md` at line 206, The doc is missing a top-level
"Examples" section and "Implementation Patterns" should be moved under it to
match repo guidelines; update SKILL.md to ensure there are clear top-level
headings "When to Use", "How It Works", and "Examples", create an "Examples"
section if absent, relocate the existing "Implementation Patterns" content under
that "Examples" heading (renaming if needed), and adjust any Table of Contents
or cross-references so the new heading references (e.g., "Implementation
Patterns" -> "Examples / Implementation Patterns") remain correct.