菜单
Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
10-step checklist for safely removing one or more packages from the Cacti monorepo. Covers inventory, dependency scan, TypeScript import audit, CI workflow cleanup, tsconfig references, test-tooling helpers, directory deletion, lockfile regeneration, tracking-doc update, and verification pass.
Triage Cacti CI failures on a PR or main branch, fetch failing job logs via gh CLI, categorize root causes, and produce a structured markdown report at docs/ci-reports/. Use when the user asks why CI is failing, asks for a CI failure report, references a failing PR or run, mentions GitHub Actions failures, or asks to analyze/diagnose pipeline issues in the Hyperledger Cacti monorepo.
Analyze code for common vulnerability patterns using CodeQL-style queries. Identify injection flaws, unsafe deserialization, prototype pollution, path traversal, and other security issues in TypeScript/JavaScript code.
Cross-verify assertions, assumptions, and logic in code or explanations. Use as a quality gate before committing changes. Re-reads relevant code and confirms correctness.
Generate a structured refactoring plan for a Cacti package or module. Analyzes current code structure, identifies improvement opportunities, and produces a phased plan with risk assessment.
<One sentence describing what knowledge this skill provides.>
| name | code-review |
| description | Apply when reviewing a pull request in Hyperledger Cacti. Covers PR scope, Conventional Commits, TypeScript conventions, public API surface, testing, security (OWASP Top 10), AI slop detection, and CI status. |
Review every PR against this checklist. Prioritize blocking issues over nits. Leave a comment only when you have a concrete, actionable suggestion. Do not approve a PR — human maintainer approval is required.
| # | Check | Goal | Reference |
|---|---|---|---|
| 1 | PR scope | One logical unit; no bundled unrelated concerns | PULL.md §1–2 |
| 2 | Conventional Commits | Header ≤ 72 chars; correct type prefix; PR title matches linked issue | CONVENTIONS.md §8 |
| 3 | TypeScript conventions | I prefix on interfaces; no any/console.log/eval; Prettier format | CONVENTIONS.md §5 |
| 4 | Public API surface | New types in public-api.ts; no manual edits to generated/ | CONVENTIONS.md §4 |
| 5 | Package conventions | cacti- prefix; tsconfig.base.json extended; cactus-test-tooling devDep only | CONVENTIONS.md §3–4 |
| 6 | Testing | Failing test for every behaviour change; port 0; no coverage bloat | CONVENTIONS.md §7, PULL.md §3 |
| 7 | Security (OWASP Top 10) | No secrets/injection/permissive CORS/verbose errors; SHA-pinned Actions | SECURITY.md |
| 8 | AI slop | No restatement comments, single-caller abstractions, hallucinated APIs | AI_GUIDELINES.md |
| 9 | CI status | Fetch the PR's actual check-run results; report any failing checks | PR state |
Flag the following as requiring resolution before merge:
// increment i by 1 above i++.data, result, obj, handler where a domain name is possible.Blocking / Required / NitCI for check-run failures)Do not post a comment without a concrete suggestion.