review
Comprehensive code review: security, edge cases, performance, maintainability. Use before public release, major versions, or production deployment. Triggers: "レビュー", "review", "セキュリティ監査", "公開前チェック", "リリース準備", "コードレビューして".
소스 정보
- 저장소
- t2hnd/skills
- 최근 소스 활동
- 2026년 2월 7일 11:36
- 감지된 SKILL.md 언어
- 영어
- 스타
- 0
- 포크
- 0
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- review
- description
- Comprehensive code review: security, edge cases, performance, maintainability. Use before public release, major versions, or production deployment. Triggers: "レビュー", "review", "セキュリティ監査", "公開前チェック", "リリース準備", "コードレビューして".
# Review Skill
Comprehensive code review. Replicates the successful "Rigorous Pre-Release Quality Review" pattern.
## Workflow
Execute this review **autonomously** without asking questions:
### Phase 1: Security Audit
**1. Framework Security:**
- Electron: `nodeIntegration: false`, `contextIsolation: true`, `sandbox: true`
- Web: CORS config, CSP headers, HTTPS
- API: Authentication, rate limiting
**2. Injection Vulnerabilities:**
- SQL injection (parameterized queries?)
- Command injection (shell exec with user input?)
- XSS (`dangerouslySetInnerHTML`, `innerHTML`)
**3. Secrets:**
- Hardcoded API keys or passwords
- `.env` in `.gitignore`?
- Secrets in console logs
**4. Dependencies:**
- `npm audit` for known vulnerabilities
- Outdated packages with CVEs
### Phase 2: Correctness & Edge Cases
**5. Error Handling:**
- `JSON.parse()` without try-catch
- Fetch/API calls without `.catch()`
- Backend endpoints without error handling
- Missing React Error Boundaries
**6. Index & Boundary:**
- Array access without bounds checking
- Off-by-one errors in loops
**7. Null/Undefined:**
- Chained property access without `?.`
- Missing null checks before `.map()`, `.filter()`
**8. Type Safety:**
- Run `tsc --noEmit --strict`
- Flag `any` types in critical paths
- Flag unsafe type assertions
### Phase 3: Performance
**9. Memory Leaks:**
- Event listeners without cleanup
- `useEffect` without cleanup return
- Timers without `clearTimeout`/`clearInterval`
**10. Bundle Size:**
- Large unoptimized assets
- Code splitting opportunities
### Phase 4: Code Quality
**11. Documentation:**
- LICENSE file exists?
- README complete?
- Setup instructions work?
**12. Dead Code:**
- Unused imports and exports
- Commented-out code blocks
**13. Test Coverage:**
- Run coverage report
- Critical paths tested?
### Phase 5: Report
Categorize all issues:
```markdown
## P0 (MUST FIX before release)
- [ ] Security: contextIsolation disabled
- [ ] Hardcoded API key in src/config.ts:12
## P1 (SHOULD FIX)
- [ ] Missing error boundary in App.tsx
- [ ] Unhandled promise rejection in api.ts:45
## P2 (NICE TO FIX)
- [ ] Test coverage 30%
- [ ] 5 unused imports
```
After reporting, offer to auto-fix P0 issues.
### Phase 6: Verification
After fixes:
```bash
npm run build
npm run typecheck
npm test
npm audit
```
## Important Rules
- **DO prioritize issues** (P0 > P1 > P2)
- **DO provide file paths and line numbers** for every issue
- **DO offer to auto-fix P0 issues** after reporting
- **NEVER fix issues without reporting first** — user should see the audit
- **NEVER skip security checks** — critical for public release
GitHub에서 보기