Skip to main content 首页 创作者 ajbcoding claude-skill-eval moai-alfred-code-reviewer
moai-alfred-code-reviewer Enterprise systematic code review orchestrator with TRUST 5 principles, multi-language support, Context7 integration, AI-powered quality checks, SOLID principle validation, security vulnerability detection, and maintainability analysis across 25+ programming languages; activates for code reviews, quality standard validation, TRUST 5 enforcement, architectural audits, and automated review automation
跳到安装 Skills Marketplace 发现并探索由社区构建的 Agent Skills
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/AJBcoding/claude-skill-eval --skill moai-alfred-code-reviewer命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
下载 Zip 下载中... name moai-alfred-code-reviewer version 4.0.0 created 2025-11-11T00:00:00.000Z updated 2025-11-12T00:00:00.000Z status stable description Enterprise systematic code review orchestrator with TRUST 5 principles, multi-language support, Context7 integration, AI-powered quality checks, SOLID principle validation, security vulnerability detection, and maintainability analysis across 25+ programming languages; activates for code reviews, quality standard validation, TRUST 5 enforcement, architectural audits, and automated review automation keywords ["code-review","TRUST-5","quality-assurance","SOLID-principles","security-scanning","maintainability-analysis","ai-code-review","context7-integration","automated-review","enterprise-quality"] allowed-tools ["Read","Write","Edit","Glob","Bash","AskUserQuestion","mcp__context7__resolve-library-id","mcp__context7__get-library-docs","WebFetch"]
Enterprise Systematic Code Review Orchestrator v4.0.0
Skill Metadata
Field Value Skill Name moai-alfred-code-reviewer Version 4.0.0 Enterprise (2025-11-12) Core Framework TRUST 5 principles, Context7 integration AI Integration ✅ Context7 MCP, AI quality checks, pattern matching Auto-load When conducting code reviews or quality checks Languages 25+ (Python, JavaScript, Go, Rust, Java, etc.) Lines of Content 950+ with 15+ production examples Progressive Disclosure 3-level (framework, patterns, advanced)
What It Does
Provides systematic guidance for enterprise-grade code review processes applying TRUST 5 principles , validating SOLID principles, identifying security issues, ensuring maintainability, and automating quality gates across all programming languages.
The TRUST 5 Review Framework
T - Test First
Focus : Test coverage, quality, comprehensiveness
Key Questions :
Are tests comprehensive? Do they cover happy path + edge cases?
Test coverage ≥ 85%?
Tests verify behavior, not just implementation?
Edge cases handled: null, empty, boundary values?
Async/concurrent scenarios tested?
Tools : pytest coverage, jest --coverage, go test -cover, cargo test
Examples :
def test_add ():
assert add(2 , 2 ) == 4
def test_add_positive_numbers ():
assert
2
2
4
assert
1
1
0
assert
0
0
0
def
test_add_boundary
assert
int
max
1
R - Readable Focus : Code clarity, self-documentation, maintainability
Are function/variable names meaningful and clear?
Can a new team member understand the intent?
Comments explain WHY, not WHAT (code shows what)?
Cyclomatic complexity reasonable (<10)?
Functions single responsibility?
Magic numbers extracted as constants?
Tools : linters, code formatters, readability checkers
def calc (x, y, z ):
return x * (1 + y / 100 ) - z * 0.05
DISCOUNT_RATE = 0.05
TAX_RATE = 0.05
def calculate_final_price (base_price: float , tax_percent: float , discount: float ) -> float :
"""Calculate final price after tax and discount.
Args:
base_price: Original product price
tax_percent: Tax percentage (0-100)
discount: Discount amount to subtract
"""
with_tax = base_price * (1 + tax_percent / 100 )
return with_tax - (discount * DISCOUNT_RATE)
U - Unified Focus : Consistency, patterns, architectural cohesion
Does code follow team patterns and conventions?
Consistent with codebase style?
Uses established error handling patterns?
Logging strategy aligned?
Database access follows repository pattern?
API design consistent with existing endpoints?
Tools : style guides, architectural patterns, linters
def get_user (user_id ):
try :
return fetch_from_db(user_id)
except Exception as e:
return None
def get_user (user_id: int ) -> User:
"""Get user by ID.
Raises:
UserNotFoundError: If user doesn't exist
DatabaseError: If database connection fails
"""
try :
return self .user_repository.find_by_id(user_id)
except DatabaseConnectionError as e:
logger.error(f"Database error: {e} " )
raise DatabaseError(str (e)) from e
except Exception as e:
logger.error(f"Unexpected error: {e} " )
raise
S - Secured Focus : Security vulnerabilities, input validation, secret handling
Are inputs validated before use?
No hardcoded credentials, API keys, or secrets?
SQL injection prevention (parameterized queries)?
XSS prevention (output escaping)?
CSRF tokens used for state-changing operations?
Authentication required for sensitive operations?
Rate limiting on public endpoints?
Dependency vulnerabilities scanned?
Tools : bandit, safety, npm audit, go vet, security scanners
def get_user (user_id ):
query = f"SELECT * FROM users WHERE id = {user_id} "
return db.execute(query)
def get_user (user_id: int ) -> User:
query = "SELECT * FROM users WHERE id = ?"
return db.execute(query, [user_id])
T - Trackable
Changelog entry added?
Git history clear and atomic?
Breaking changes documented?
Migration guides for version updates?
def calculate_discount (price, customer_type ):
if customer_type == "vip" :
return price * 0.8
return price
def calculate_discount (price: float , customer_type: str ) -> float :
"""Calculate discount based on customer type.
Implements SPEC-042: VIP customers receive 20% discount
Linked to:
- SPEC-042: VIP pricing requirements
- TEST-042-001: VIP discount validation
- PR #1234: Feature implementation
"""
VIP_DISCOUNT_RATE = 0.20
if customer_type == "vip" :
return price * (1 - VIP_DISCOUNT_RATE)
return price
SOLID Principles Checklist Principle Focus Review Question S ingle ResponsibilityOne reason to change Does this class/function do one thing? O pen/ClosedOpen for extension, closed for modification Can behavior be extended without modifying? L iskov SubstitutionSubstitutable subtypes Can derived classes replace base without breaking? I nterface SegregationMinimal, specific interfaces Are clients forced to depend on methods they don't use? D ependency InversionDepend on abstractions, not concretions Do high-level modules depend on low-level implementations?
Code Review Process (4-Step)
Step 1: Automated Checks (5 min) ✓ Linting & formatting
✓ Security scanning (bandit, safety, npm audit)
✓ Dependency vulnerabilities
✓ Test coverage ≥85%
✓ Type checking (mypy, TypeScript, etc.)
Step 2: Architecture Review (15 min) ✓ SOLID principles
✓ Design patterns appropriate?
✓ Consistency with codebase
✓ Scalability implications?
✓ Performance implications?
Step 3: Security Audit (10 min) ✓ Input validation
✓ No hardcoded secrets
✓ Authentication/authorization correct?
✓ SQL injection prevention
✓ XSS prevention
✓ CSRF tokens present
Step 4: Implementation Review (20 min) ✓ TRUST 5 checklist
✓ Edge cases handled?
✓ Error messages helpful?
✓ Documentation complete?
Review Depth Matrix Change Type Severity Automation Review Time Focus Areas Security fix 🔴 Critical Full scan 30+ min Vulnerabilities, test coverage, audit trail Core architecture 🔴 Critical Partial 45+ min Design patterns, scalability, consistency Feature (new) 🟡 Major Full scan 30 min Completeness, TRUST 5, documentation Bug fix 🟢 Minor Partial 15 min Root cause, test coverage, regressions Documentation 🟢 Minor Basic 5 min Accuracy, completeness, examples Configuration 🟡 Medium Full 10 min Security, best practices, side effects Refactoring 🟢 Minor Full 15 min Behavior preservation, performance
Best Practices
DO
Automate repetitive checks : Linting, coverage, formattingFocus human review on high-value areas : Architecture, security, designBe constructive : Review code, not peopleExplain WHY : Help reviewer understand the reasoningRequest specific changes : Not vague "improve this"Provide examples : Show the better approachFlag trade-offs : Explain choices madeDocument decisions : Comment on why certain patterns chosen
DON'T
Nitpick style : Let linters handle formattingReject without alternatives : Always suggest improvementsMake personal comments : Focus on code qualityReview when tired : Quality suffersBlock on minor issues : Distinguish critical from nice-to-haveSkip security review : Always check authentication, validation, secretsIgnore test coverage : Enforce ≥85% requirement
Integration with Context7 Live Security Scanning : Get latest vulnerability patterns from official databasesBest Practice Integration : Apply latest security recommendations from official docsVersion-Aware Checks : Context7 provides version-specific security guidanceAutomated Fix Suggestions : Context7 patterns for common vulnerability fixes
Related Skills
moai-alfred-practices (Code patterns and best practices)moai-essentials-refactor (Refactoring strategies)
For detailed review checklists : reference.md For real-world examples : examples.md Last Updated : 2025-11-12Status : Production Ready (Enterprise v4.0.0)
Enterprise-grade security expertise with production-ready patterns for OWASP Top 10 2021, zero-trust architecture, threat modeling (STRIDE, PASTA), secure SDLC, DevSecOps automation, cloud security, cryptography, identity & access management, and compliance frameworks (SOC 2, ISO 27001, GDPR, CCPA).
