| name | review |
| description | Comprehensive code review: security, edge cases, performance, maintainability. Use before public release, major versions, or production deployment. Triggers: "レビュー", "review", "セキュリティ監査", "公開前チェック", "リリース準備", "コードレビューして".
|
Review Skill
Comprehensive code review. Replicates the successful "Rigorous Pre-Release Quality Review" pattern.
Workflow
Execute this review autonomously without asking questions:
Phase 1: Security Audit
1. Framework Security:
- Electron:
nodeIntegration: false, contextIsolation: true, sandbox: true
- Web: CORS config, CSP headers, HTTPS
- API: Authentication, rate limiting
2. Injection Vulnerabilities:
- SQL injection (parameterized queries?)
- Command injection (shell exec with user input?)
- XSS (
dangerouslySetInnerHTML, innerHTML)
3. Secrets:
- Hardcoded API keys or passwords
.env in .gitignore?- Secrets in console logs
4. Dependencies:
npm audit for known vulnerabilities- Outdated packages with CVEs
Phase 2: Correctness & Edge Cases
5. Error Handling:
JSON.parse() without try-catch- Fetch/API calls without
.catch()
- Backend endpoints without error handling
- Missing React Error Boundaries
6. Index & Boundary:
- Array access without bounds checking
- Off-by-one errors in loops
7. Null/Undefined:
- Chained property access without
?.
- Missing null checks before
.map(), .filter()
8. Type Safety:
- Run
tsc --noEmit --strict
- Flag
any types in critical paths
- Flag unsafe type assertions
Phase 3: Performance
9. Memory Leaks:
- Event listeners without cleanup
useEffect without cleanup return- Timers without
clearTimeout/clearInterval
10. Bundle Size:
- Large unoptimized assets
- Code splitting opportunities
Phase 4: Code Quality
11. Documentation:
- LICENSE file exists?
- README complete?
- Setup instructions work?
12. Dead Code:
- Unused imports and exports
- Commented-out code blocks
13. Test Coverage:
- Run coverage report
- Critical paths tested?
Phase 5: Report
Categorize all issues:
## P0 (MUST FIX before release)
- [ ] Security: contextIsolation disabled
- [ ] Hardcoded API key in src/config.ts:12
## P1 (SHOULD FIX)
- [ ] Missing error boundary in App.tsx
- [ ] Unhandled promise rejection in api.ts:45
## P2 (NICE TO FIX)
- [ ] Test coverage 30%
- [ ] 5 unused imports
After reporting, offer to auto-fix P0 issues.
Phase 6: Verification
After fixes:
npm run build
npm run typecheck
npm test
npm audit
Important Rules
- DO prioritize issues (P0 > P1 > P2)
- DO provide file paths and line numbers for every issue
- DO offer to auto-fix P0 issues after reporting
- NEVER fix issues without reporting first — user should see the audit
- NEVER skip security checks — critical for public release
