メニュー
This skill should be used when implementing code quality standards, setting up linting/testing/security scans, enforcing coverage thresholds, or establishing CI/CD guardrails.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
SDK development, external developer communication, code samples, API client libraries, community engagement, and developer experience. Use when creating SDKs, writing external guides, creating code samples, or improving developer experience.
Profile systems, identify bottlenecks, optimize code and infrastructure for speed, throughput, and resource efficiency.
WCAG 2.1 AA compliance, keyboard navigation, screen reader testing, semantic HTML, ARIA labels, color contrast, assistive technology validation. Use when ensuring accessibility, conducting a11y audits, testing with screen readers, or designing inclusive interfaces.
REST/gRPC API design, versioning strategies, error codes, request/response contracts, backward compatibility, rate limiting, OpenAPI specifications. Use when designing APIs, defining contracts, planning versioning, or ensuring API consistency.
Hermetic builds, dependency management, build caching, reproducible builds, cross-compilation, build optimization. Use when optimizing build speed, ensuring reproducibility, or designing build infrastructure.
Secrets management, environment-specific configs, safe defaults, feature flags, configuration-as-code, compliance and audit trails. Use when managing secrets, configuring deployments, or implementing feature flags.
| name | skill-code-quality |
| description | This skill should be used when implementing code quality standards, setting up linting/testing/security scans, enforcing coverage thresholds, or establishing CI/CD guardrails. |
| version | 1.0.0 |
Code quality is the cornerstone of maintainable, secure, and performant software. This skill provides a comprehensive framework for enforcing quality across five dimensions: static analysis, testing, architecture, security, and CI/CD automation.
What: Enforce language-specific style guides with automated tools
Why: Consistent code style reduces cognitive load, prevents merge conflicts, and catches common mistakes early.
How to Enforce:
# .eslintrc.js or similar
extends: ['recommended', 'prettier']
rules:
no-console: warn
no-unused-vars: error
max-lines: [warn, { max: 300 }]
Configure pre-commit hook:
husky install
npx husky add .husky/pre-commit "npm run lint:fix"
Standard Patterns:
data, temp, info, objExample Violations:
// ❌ Bad
const d = new Date();
const temp = calculateTotal(items);
function x() { return 42; }
// ✓ Good
const currentDate = new Date();
const cartTotal = calculateTotal(items);
function getUserAge() { return 42; }
Cyclomatic Complexity Limits:
Tools: SonarQube, eslint-plugin-complexity, radon (Python)
How to Measure:
# JavaScript
npx eslint --max-warnings 0 --ext .js,.ts src/
# Python
radon cc -n C your_code.py # Show functions with complexity > C
Red Flags:
How to Detect:
# Find duplicated code blocks
npx jscpd --threshold 0.1 src/
# Clone detection with git
git diff --stat HEAD~10
Refactoring Patterns:
▲
/E2E\ 10% (expensive, slow)
/─────\ 1-2 tests per critical flow
/Integration\ 20% (medium cost)
/─────────────\ 10-20 tests per service
/Unit Tests─────\70% (cheap, fast)
/─────────────────\Hundreds of tests
Unit Tests (70%):
Integration Tests (20%):
E2E Tests (10%):
Minimum Standards:
Enforcement:
{
"jest": {
"collectCoverageFrom": ["src/**/*.{js,ts}"],
"coverageThreshold": {
"global": {
"branches": 80,
"functions": 80,
"lines": 80,
"statements": 80
},
"src/auth/**": {
"lines": 95,
"functions": 95
}
}
}
}
How: Automatically rerun all tests on every commit
Flaky Test Detection:
# Run tests 5+ times, track inconsistency
for i in {1..5}; do npm test -- --seed $RANDOM; done
S — Single Responsibility: One class/module, one reason to change
// ❌ Bad
class UserManager {
createUser() { /* ... */ }
sendEmail() { /* ... */ }
logAnalytics() { /* ... */ }
}
// ✓ Good
class UserRepository { createUser() { /* ... */ } }
class EmailService { sendEmail() { /* ... */ } }
class AnalyticsService { logEvent() { /* ... */ } }
O — Open/Closed: Open for extension, closed for modification
// Use inheritance/composition, not hardcoding
interface PaymentGateway { process(amount) }
class StripeGateway implements PaymentGateway { /* ... */ }
class PayPalGateway implements PaymentGateway { /* ... */ }
// Add new gateways without modifying existing code
L — Liskov Substitution: Subtypes must be substitutable for parent types I — Interface Segregation: Clients shouldn't depend on unused methods D — Dependency Inversion: Depend on abstractions, not concrete implementations
Code-Level:
Project-Level:
Example:
/**
* Calculate discount based on customer tier and purchase history.
* Premium customers (3+ purchases) get 15% off; others get 5%.
* @param customerId - UUID of the customer
* @param purchaseCount - Number of prior purchases
* @returns Discount percentage (0-100)
*/
function calculateDiscount(customerId: string, purchaseCount: number): number {
// Historical data shows 15% threshold improves LTV without margin impact
return purchaseCount >= 3 ? 15 : 5;
}
What Counts:
Enforcement:
# Find all TODO comments
git grep -n "TODO\|FIXME\|HACK" -- src/
# Track in issues with label "tech-debt"
# Review quarterly, prioritize by impact
Standards:
Tools:
npm audit # Check for CVEs
npm outdated # Show outdated packages
npm ls --depth=0 # See direct dependencies
depcheck # Find unused dependencies
Tools by Language:
Common Patterns Caught:
CI Integration:
# GitHub Actions example
- name: SAST Scan
run: |
npm install -g snyk
snyk test --severity-threshold=high --fail-on=all
What: Scan dependencies for known CVEs
Tools:
Threshold: 0 high/critical vulnerabilities; medium resolved within 30 days
npm audit --audit-level=moderate
Tools:
Patterns to Catch:
Pre-Commit Hook:
husky add .husky/pre-commit "npx detect-secrets scan --baseline .secrets.baseline"
Standards:
Example:
// ❌ Bad: no validation
function transferFunds(amount, toAccount) {
return db.query(`UPDATE accounts SET balance = balance - ${amount} WHERE id = ${toAccount}`);
}
// ✓ Good: validated and parameterized
function transferFunds(amount: number, toAccount: UUID) {
if (amount <= 0 || amount > 1000000) throw new Error("Invalid amount");
if (!isValidUUID(toAccount)) throw new Error("Invalid account");
return db.query("UPDATE accounts SET balance = balance - ? WHERE id = ?", [amount, toAccount]);
}
Ensure defenses for:
Standards:
Checklist for Reviewers:
Block on Failure:
Report but Don't Block (comment on PR):
Example CI Pipeline:
name: Quality Gates
on: [pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- uses: actions/setup-node@v3
- run: npm ci
- run: npm run lint
- run: npm test -- --coverage --collectCoverageFrom='src/**'
- run: npm run build
- name: Check Coverage
run: |
if [ $(cat coverage/coverage-summary.json | jq .total.lines.pct) -lt 80 ]; then
echo "Coverage below 80%"
exit 1
fi
- name: SAST Scan
run: npm audit --audit-level=high
- name: Secret Detection
run: npm run secrets:check
Hermetic Builds: No network calls during tests
Trunk-Based Development:
Pre-Commit Hooks (enforce before push):
# .husky/pre-commit
npm run lint:fix
npm run type-check
npm test -- --bail --findRelatedTests
Use this checklist when setting up quality standards on a new project:
Reference: Clean Code, The Pragmatic Programmer, Architecture: The Hard Parts