菜单
Run this skill when auditing backend code. Covers error message format, architecture boundaries, input validation, DI compliance, Prisma safety, test coverage, API contracts, and security.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | backend-audit |
| description | Run this skill when auditing backend code. Covers error message format, architecture boundaries, input validation, DI compliance, Prisma safety, test coverage, API contracts, and security. |
| user-invocable | true |
Error message format — do all controller error responses follow "Failed to {action} {resource}" pattern? Check backend-error-messages.instructions.md for details.
Architecture boundaries — any service importing from another service's internals? Any controller bypassing the service layer to call repositories directly?
Input validation — all endpoints validated at the controller boundary. No raw request body data passed directly to Prisma queries.
DI compliance — all service dependencies injected via constructor/factory. No internal instantiation (e.g., new Service() inside another service).
Prisma safety — any schema changes that could drop data? Migrations reviewed before applying? Never drop columns — use @map or additive migrations. See prisma-schema-changes.instructions.md.
Test coverage — new/modified business logic has corresponding unit tests (mocked deps) or integration tests (test DB). Coverage target >80% for business logic.
API contract — response shape matches what the frontend expects? Shared types in packages/shared-types/ updated?
Security — authentication/authorization checks on protected endpoints? Input sanitized against XSS? Rate limiting considered?
Use when: designing a new page or feature UI, deciding where to place a component, or choosing between creating new vs reusing existing components.
Run this skill when auditing frontend code. Covers CSS tokens, shared component reuse, API client rules, barrel files, store placement, accessibility, responsiveness, memoization, timer edge cases, console leftovers, and wireframe alignment.
Extract a lesson from recent agent struggles and create a .instructions.md file to prevent recurrence. Use when: agent made a mistake, discovered a new convention, found a recurring issue pattern.
Run Prisma schema changes safely after editing schema.prisma. Use when: editing schema.prisma, adding new models, changing columns, database migration.
