Angular frontend security best practices for building secure, production-grade applications. Use when writing or reviewing security-sensitive Angular code, configuring authentication, handling user input, setting up CSP, securing Angular SSR, or hardening an Angular application. Covers OWASP 2025, XSS prevention, DomSanitizer, template injection, CSRF/XSRF, HttpClient security, Angular SSR vulnerabilities (CVE-2025-59052), XSRF token leakage (CVE-2025-66035), stored XSS via SVG (CVE-2025-66412), AutoCSP, Trusted Types, zoneless Angular, functional guards/interceptors, NgRx security, supply chain, and deployment hardening. Keywords: Angular security, XSS, CSRF, CSP, DomSanitizer, bypassSecurityTrust, template injection, AOT, Angular SSR, HttpClient, XSRF, route guards, NgRx, signals, zoneless. (updated 2026-03-28)
Angular enterprise architecture guidelines for structuring scalable, production-grade applications. Use when scaffolding a new Angular project, reviewing project structure, setting up feature slices, choosing state management, configuring data fetching, or making architectural decisions in an Angular/TypeScript codebase. Covers folder structure, signals, standalone components, new control flow, deferrable views, zoneless change detection, NgRx SignalStore, httpResource, functional guards/interceptors, typed reactive forms, esbuild + Vite, Vitest, Playwright, Tailwind v4, SSR with incremental hydration, and Nx monorepos. Keywords: Angular architecture, project structure, feature slices, DDD, enterprise Angular, folder layout, monorepo, Nx, signals, standalone, zoneless. (updated 2026-03-30)
Angular/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with Angular version-aware rules. Trigger when reviewing Angular components, services, directives, pipes, guards, resolvers, NgRx stores/effects, RxJS streams, Apollo Angular GraphQL, HttpClient calls, SSR (Angular Universal), or any .ts/.html file in an Angular project. Keywords: Angular, standalone, component, NgRx, signal, computed, effect, RxJS, Observable, HttpClient, inject(), OnPush, @if, @for, router, guard, resolver, lazy loading, Angular Material, SSR, hydration. Do NOT trigger for Node.js backend code in the same monorepo (use code-reviewer-node for that) or for plain TypeScript utilities with no Angular imports. (updated 2026-03-28)
Django/Python-specific code review overlay. Extends the universal code-reviewer skill with Django and Python version-aware rules. Trigger when reviewing Django views, models, serializers, forms, URLs, settings, migrations, Celery tasks, or any .py file in a Django project. Keywords: Django, DRF, ORM, QuerySet, serializer, viewset, model, migration, WSGI, ASGI, Celery, pytest-django. Do NOT trigger for pure Python scripts unrelated to Django, or for frontend code in the same project (use code-reviewer-react or code-reviewer-node for those). (updated 2026-03-28)
Node.js/Express/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with Node.js version-aware rules. Trigger when reviewing Express route handlers, middleware, REST controllers, GraphQL resolvers, Apollo Server setup, JWT/OAuth middleware, Bull/BullMQ job processors, or any .ts/.js file in a Node.js backend project. Keywords: Express, REST API, GraphQL, Apollo, JWT, OAuth, BullMQ, Bull, queue, middleware, TypeScript strict, tsconfig, req, res, next, router. Do NOT trigger for frontend React/Vue/Angular code in the same repo (use code-reviewer-react for those) or for infrastructure/IaC files. (updated 2026-03-28)
React/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with React version-aware rules. Trigger when reviewing React components, hooks, context, Suspense boundaries, Server Components, Client Components, React Router, TanStack Query, Zustand, Redux, React Hook Form, or any .tsx/.jsx file in a React project. Keywords: React, useState, useEffect, useCallback, useMemo, useRef, useContext, useReducer, useTransition, Suspense, memo, RSC, Server Component, Client Component, TanStack Query, Zustand, React Hook Form, Next.js, Vite, prop drilling, key prop. Do NOT trigger for Angular or Vue files in the same monorepo. (updated 2026-03-28)
Conducts structured, senior-level code reviews with categorized, actionable feedback — and fixes issues before presenting output to the user. Trigger when user says "review this code", "check my PR", "look over this function", "give me feedback on this implementation", "audit this before deploy", "simplify this", or "review these changes". Covers correctness, security (OWASP 2025), performance, maintainability, DRY violations, test coverage, and technical debt. The review loop runs before output is shown — the user receives the second draft, not the first. Produces output with blocking issues clearly separated from suggestions. Do NOT trigger for architecture-only discussions (use architect-reviewer) or security-only audits (use security-auditor). (updated 2026-03-28)
Graphene-Django best practices, N+1 prevention, query optimization, schema design, security, caching, and testing. Load when working with graphene-django GraphQL APIs.