القائمة
ESLint, Stylelint, TypeScript config, environment validation, dead-code checks, and automated convention enforcement. 日本語の依頼例:「Lint設定」「tsconfig」「Stylelint」「ルールをCIで強制」。
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Frontend/BFF security for forms and external input, auth, cookies, HTML, URLs, fetch, CORS, webhooks, uploads, secrets, logging, dependencies, and LLM-bound content. 日本語の依頼例:「認証実装」「問い合わせフォーム」「外部API」「webhook」「ログ」「LLMに渡す」「依存追加」。
Repository policy design or changes: CI, releases, dependency or license policy, secrets scanning, protected-branch/PR rules, and performance budgets. Not for routine metadata edits such as a one-line .gitignore change. 日本語の依頼例:「CI/CD設定」「リリース手順」「依存ライセンス」「ブランチ/PR運用」。
Next.js-specific App Router work: Server/Client Components, data fetching, caching, Server Actions, route handlers, metadata, and env vars. Not for framework-neutral styling or tests. 日本語の依頼例:「Next.jsで実装」「Server Action」「RSC」「ルートハンドラ」「キャッシュ」。
Pre-merge verification covering scope, typecheck, lint, affected tests, security, accessibility, and a single pass or fail report. 日本語の依頼例:「出荷前チェック」「マージ前確認」「完成か確認」「PR前チェック」。
React component, hook, state, effect, and rendering conventions. Use for React implementation or re-render and useEffect debugging. 日本語の依頼例:「Reactコンポーネント」「カスタムフック」「状態管理」「再レンダリング」「useEffect修正」。
Accessibility implementation and review for semantic HTML, keyboard use, focus, ARIA, contrast, forms, and screen readers. Use for UI components or accessibility fixes. 日本語の依頼例:「アクセシビリティ対応」「キーボード操作」「フォーカス管理」「スクリーンリーダー対応」。
| name | tooling |
| description | ESLint, Stylelint, TypeScript config, environment validation, dead-code checks, and automated convention enforcement. 日本語の依頼例:「Lint設定」「tsconfig」「Stylelint」「ルールをCIで強制」。 |
Every mechanical rule in this rule-set should be backed by a tool so lint/CI catches violations regardless of who (or what) wrote the code. When setting up or auditing a project, wire these:
strict: true, plus noUncheckedIndexedAccess, noImplicitOverride, verbatimModuleSyntax.| Convention (source) | ESLint rule / plugin |
|---|---|
No any (AGENTS.md) | @typescript-eslint/no-explicit-any |
@ts-expect-error needs reason, @ts-ignore banned (AGENTS.md) | @typescript-eslint/ban-ts-comment with ts-expect-error: 'allow-with-description' |
| Hooks rules + complete effect deps (react-patterns) | eslint-plugin-react-hooks (rules-of-hooks, exhaustive-deps) — suppression comments banned |
| No array-index keys (react-patterns) | react/no-array-index-key |
| Named exports only, with exceptions (react-patterns) | import/no-default-export + overrides allowing app/**, pages/**, src/pages/**, *.stories.*, *.config.*, .storybook/** |
| No inline styles (AGENTS.md) | react/forbid-dom-props (style) |
No dangerouslySetInnerHTML / eval family (frontend-security) | react/no-danger, no-eval, no-implied-eval, no-new-func |
| Semantic HTML, labels, keyboard, no positive tabindex (a11y) | eslint-plugin-jsx-a11y (recommended config, as errors) |
| Testing Library discipline (testing-vitest) | eslint-plugin-testing-library (prefer-user-event, prefer-find-by, no-container, no-node-access, no-wait-for-side-effects) |
| Playwright bans (testing-playwright) | eslint-plugin-playwright (no-wait-for-timeout, no-networkidle, missing-playwright-await, no-element-handle) |
| Awaited play interactions (storybook) | eslint-plugin-storybook (await-interactions, use-storybook-expect) |
| Server-only module isolation (nextjs) | server-only package + import/no-restricted-paths |
| Feature-boundary imports (vite-react) | eslint-plugin-boundaries or dependency-cruiser in CI |
stylelint-declaration-strict-value: require var() for color, background-color, z-index, transition-duration, spacing properties — enforces the CSS Modules profile's token rule.declaration-property-value-disallowed-list: ban raw z-index integers outside tokens.css.typescript-plugin-css-modules. CI: generated .d.ts (typed-css-modules or the bundler's typegen) so a renamed class fails typecheck, not production.@t3-oss/env-nextjs / @t3-oss/env-core are options to vet, not automatic dependencies; a small zod schema at the boundary is sufficient for many projects.knip is already installed, run it in CI for unused files, exports, and dependencies. Otherwise vet it before adoption; do not fetch it ad hoc with npx.zod at every boundary, per-resource authorization (IDOR), webhook signature verification, mock-at-the-boundary policy, "measure before optimizing", small focused diffs, manual keyboard walks (a11y). Lint cannot catch these. The shipped templates/.semgrep/ heuristics backstop webhook-missing-verification, SSRF, secret exposure, and unsanitized HTML (flags for review, not proof); zod-at-boundary and IDOR have no reliable static rule and stay review-only. All of them still require human/AI code review.