القائمة
Backend code review for src/server/. 3 parallel agents: architecture, security+performance, engineering+scalability. Supports diff mode. Trigger: "review server", "review backend".
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Mandatory Prismix browser verification for web UI changes. Use when modifying or reviewing frontend-rendered behavior, including src/web files, shared UI components, routes, layouts, CSS/Tailwind classes, visual assets, displayed i18n strings, browser auth flows, or frontend-visible API behavior.
Review and accept external modifications to the working tree (Codex, linters, collaborators). Diff, assess, flag issues. Trigger: "review changes", "review external", "check what changed".
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Guide for implementing smooth, native-feeling animations using React's View Transition API (`<ViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter/exit of components, animate list reorder, implement directional (forward/back) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Frontend code review for src/web/. 3 parallel agents: performance, architecture, engineering. Supports diff mode. Trigger: "review web", "review frontend".
| name | review-server |
| description | Backend code review for src/server/. 3 parallel agents: architecture, security+performance, engineering+scalability. Supports diff mode. Trigger: "review server", "review backend". |
| metadata | {"argument-hint":"[diff] [architecture|security|engineering]"} |
Audit src/server/ + src/blockchain/ + src/shared/ with 3 parallel agents. Plan only — no code changes. Output: docs/server-refactor-plan.md.
Modes: diff = only changed files vs main. Focus arg = single agent. Combinable: /review-server diff security.
Scope: src/server/, src/blockchain/, src/shared/ only. Grep-first, Read only for context.
Context (embed in each agent):
Node.js + Hono + Drizzle ORM (PostgreSQL) + ioredis + pino. Domain modules: gateway, merchant, admin, auth, messaging.
Strategy pattern: db, cache, queue, rate-limit, events (interface + impl + barrel).
Rules: ts-pattern 3+ branches, lodash-es, @/shared/number.ts, pino only (no console.log),
repos only (no direct @/server/db), FK split (management=CASCADE, hot-path=no FK), updatedAt in every .set().
Glob large files. Check: files > 300 lines (god files), switch( (ts-pattern), console.log/error/warn, .sort(/.toFixed( (lodash-es/number.ts), cross-domain imports, route importing @/server/db directly, 3+ repeated CRUD patterns across routes, over-abstraction (single-impl interfaces). Max 15 findings.
Grep vulnerability patterns. Check: routes missing auth session check, POST/PUT without parseBody, Number(/parseInt( without NaN check, z.any() in request schemas, hardcoded secret-like strings, fetch( with user URLs (SSRF), eval(/new Function(, await inside loops (N+1), .findAll() without limit, unbounded in-memory Maps/Sets. Read gateway handler for sequential await chains. Max 15 findings.
Grep-first. Check: : any/as any/@ts-ignore, JSON.parse( without Zod, empty catch blocks, .set( missing updatedAt, dead exports never imported, commented-out code > 5 lines, in-memory state that breaks multi-instance (verify Redis fallback), fire-and-forget .catch() swallowing errors, non-idempotent background jobs. Max 15 findings.
Deduplicate → classify P0 (security/data loss) / P1 (performance/architecture) / P2 (code quality) → if previous plan exists mark NEW vs RECURRING → write docs/server-refactor-plan.md → present summary, wait for confirmation.