メニュー
Performs a comprehensive production-readiness evaluation. Covers error handling, security, performance, observability, testing, and documentation with severity-rated findings. DO NOT use for quick style reviews, refactoring, or generating code.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use to implement a REST or GraphQL API endpoint from a specification or description, including request validation, error handling, and accompanying tests. Activate for building a new API route, resolver, or handler end-to-end. Do NOT use for API design/contract creation, documentation generation, or frontend API consumption.
Use to implement background job processing with a queue, worker, retry with exponential backoff, dead letter queue, and monitoring. Activate when the request involves offloading work from the request cycle (emails, reports, data processing). Do NOT use for real-time event streaming, webhook handling, or scheduled cron jobs.
Use to scaffold a new project from scratch — generating directory structure, configuration files, entry points, and a README skeleton. Activate when starting a new project, service, or package and needing a production-ready starting point. Do NOT use for adding features to existing projects, generating tests, or CI/CD configuration.
Use to design and implement a caching layer for data that is expensive to compute or fetch. Activate for cache-aside, write-through, or write-behind patterns, TTL strategy, and cache invalidation logic. Do NOT use for database query optimization, CDN configuration, or HTTP response caching headers.
Use to generate a CI/CD pipeline configuration for building, testing, and deploying an application. Activate for GitHub Actions, GitLab CI, CircleCI, or similar pipeline tools for any tech stack. Do NOT use for infrastructure provisioning, Dockerfile creation, or deployment strategy design.
Use to generate production-ready code for a new feature, function, class, or module from a description. Activate for writing new code from scratch with error handling, inline documentation, and a self-review checklist. Do NOT use for refactoring existing code, code review, or test generation.
| name | senior-code-review |
| description | Performs a comprehensive production-readiness evaluation. Covers error handling, security, performance, observability, testing, and documentation with severity-rated findings. DO NOT use for quick style reviews, refactoring, or generating code. |
| version | 1.1.0 |
| time_saved | Manual: 2–4 hours | With skill: 15–25 minutes |
| license | Proprietary — Personal Use Only |
| category | coding |
| complexity | Advanced |
| tokens | ~6000 |
| tags | ["code-review","production-readiness","security","observability","senior-review","architecture"] |
| author | vheins |
Perform a production-readiness evaluation focusing on reliability, security, scale, and observability.
| Variable | Type | Req | Description |
|---|---|---|---|
tech_stack | string | Yes | e.g., "Node.js + Express" |
code | string | Yes | Paste full function/class/module |
context | string | Yes | Traffic, SLA, PII, conventions |
| Dimension | Focus Areas |
|---|---|
| Error Handling | Propagation, retry logic, fail-safe modes. |
| Security | Input validation, secrets, PII, authz/authn. |
| Performance | Big-O, N+1, leaks, locking, caching. |
| Observability | Log levels, context, metrics, tracing. |
| Test Coverage | Happy/Error/Edge cases, testability. |
| Documentation | "Why" logic, API docs, limitations. |
| Case | Strategy |
|---|---|
| Large Code (>300 lines) | Focus on high-risk sections (Auth, mutation, payments). |
| No Tests | Rate as P1 Coverage finding; provide a test plan. |
| Legacy Context | Distinguish pre-existing debt from new risks. |
flowchart TD
A([Start: Senior Code Review]) --> B{Code size?}
B -- Over 300 lines --> C[Focus on highest-risk sections: auth, payment, data mutation]
B -- Under 300 lines --> D[Full review across all 6 dimensions]
C & D --> E[Dimension 1: Error Handling]
E --> E1{All failure paths handled?}
E1 -- No --> E2[P0/P1: unhandled path → production incident risk]
E1 -- Yes --> F
E2 & F --> G[Dimension 2: Security]
G --> G1{Input validation present?}
G1 -- No --> G2[P0: injection / traversal vulnerability]
G1 -- Yes --> G3{Sensitive data in logs?}
G3 -- Yes --> G4[P0: PII / secret leak]
G3 -- No --> H
G2 & G4 & H --> I[Dimension 3: Performance]
I --> I1{O n² or worse on unbounded input?}
I1 -- Yes --> I2[P1: algorithmic bottleneck]
I1 -- No --> I3{N+1 queries?}
I3 -- Yes --> I4[P1: DB performance issue]
I3 -- No --> J
I2 & I4 & J --> K[Dimension 4: Observability]
K --> K1{Errors logged with context?}
K1 -- No --> K2[P2: blind spots in production]
K1 -- Yes --> L
K2 & L --> M[Dimension 5: Test Coverage]
M --> M1{Error paths tested?}
M1 -- No --> M2[P1: untested failure modes]
M1 -- Yes --> N
M2 & N --> O[Dimension 6: Documentation]
O --> P{Legacy code context?}
P -- Yes --> Q[Distinguish new risks vs pre-existing tech debt]
P -- No --> R
Q & R --> S[Rate all findings: P0 / P1 / P2 / P3]
S --> T[Produce: Production Readiness Verdict + Top 5 Must-Fix]
T --> U([Output: Severity-rated review across 6 dimensions])
@upstash/context7-mcp: Library documentation and examples.@modelcontextprotocol/server-sequential-thinking: Complex reasoning.@modelcontextprotocol/server-memory: Knowledge graph.| Version | Date | Description |
|---|---|---|
| 1.1.0 | 2026-03-20 | Restructured: examples/ and references/, added compatibility/license |
| 1.0.0 | 2026-03-20 | Initial release |