ai-coding-skills

Angular frontend security best practices for building secure, production-grade applications. Use when writing or reviewing security-sensitive Angular code, configuring authentication, handling user input, setting up CSP, securing Angular SSR, or hardening an Angular application. Covers OWASP 2025, XSS prevention, DomSanitizer, template injection, CSRF/XSRF, HttpClient security, Angular SSR vulnerabilities (CVE-2025-59052), XSRF token leakage (CVE-2025-66035), stored XSS via SVG (CVE-2025-66412), AutoCSP, Trusted Types, zoneless Angular, functional guards/interceptors, NgRx security, supply chain, and deployment hardening. Keywords: Angular security, XSS, CSRF, CSP, DomSanitizer, bypassSecurityTrust, template injection, AOT, Angular SSR, HttpClient, XSRF, route guards, NgRx, signals, zoneless. (updated 2026-03-28)

Angular enterprise architecture guidelines for structuring scalable, production-grade applications. Use when scaffolding a new Angular project, reviewing project structure, setting up feature slices, choosing state management, configuring data fetching, or making architectural decisions in an Angular/TypeScript codebase. Covers folder structure, signals, standalone components, new control flow, deferrable views, zoneless change detection, NgRx SignalStore, httpResource, functional guards/interceptors, typed reactive forms, esbuild + Vite, Vitest, Playwright, Tailwind v4, SSR with incremental hydration, and Nx monorepos. Keywords: Angular architecture, project structure, feature slices, DDD, enterprise Angular, folder layout, monorepo, Nx, signals, standalone, zoneless. (updated 2026-03-30)

Angular/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with Angular version-aware rules. Trigger when reviewing Angular components, services, directives, pipes, guards, resolvers, NgRx stores/effects, RxJS streams, Apollo Angular GraphQL, HttpClient calls, SSR (Angular Universal), or any .ts/.html file in an Angular project. Keywords: Angular, standalone, component, NgRx, signal, computed, effect, RxJS, Observable, HttpClient, inject(), OnPush, @if, @for, router, guard, resolver, lazy loading, Angular Material, SSR, hydration. Do NOT trigger for Node.js backend code in the same monorepo (use code-reviewer-node for that) or for plain TypeScript utilities with no Angular imports. (updated 2026-03-28)

Django/Python-specific code review overlay. Extends the universal code-reviewer skill with Django and Python version-aware rules. Trigger when reviewing Django views, models, serializers, forms, URLs, settings, migrations, Celery tasks, or any .py file in a Django project. Keywords: Django, DRF, ORM, QuerySet, serializer, viewset, model, migration, WSGI, ASGI, Celery, pytest-django. Do NOT trigger for pure Python scripts unrelated to Django, or for frontend code in the same project (use code-reviewer-react or code-reviewer-node for those). (updated 2026-03-28)

Node.js/Express/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with Node.js version-aware rules. Trigger when reviewing Express route handlers, middleware, REST controllers, GraphQL resolvers, Apollo Server setup, JWT/OAuth middleware, Bull/BullMQ job processors, or any .ts/.js file in a Node.js backend project. Keywords: Express, REST API, GraphQL, Apollo, JWT, OAuth, BullMQ, Bull, queue, middleware, TypeScript strict, tsconfig, req, res, next, router. Do NOT trigger for frontend React/Vue/Angular code in the same repo (use code-reviewer-react for those) or for infrastructure/IaC files. (updated 2026-03-28)

React/TypeScript-specific code review overlay. Extends the universal code-reviewer skill with React version-aware rules. Trigger when reviewing React components, hooks, context, Suspense boundaries, Server Components, Client Components, React Router, TanStack Query, Zustand, Redux, React Hook Form, or any .tsx/.jsx file in a React project. Keywords: React, useState, useEffect, useCallback, useMemo, useRef, useContext, useReducer, useTransition, Suspense, memo, RSC, Server Component, Client Component, TanStack Query, Zustand, React Hook Form, Next.js, Vite, prop drilling, key prop. Do NOT trigger for Angular or Vue files in the same monorepo. (updated 2026-03-28)

Conducts structured, senior-level code reviews with categorized, actionable feedback — and fixes issues before presenting output to the user. Trigger when user says "review this code", "check my PR", "look over this function", "give me feedback on this implementation", "audit this before deploy", "simplify this", or "review these changes". Covers correctness, security (OWASP 2025), performance, maintainability, DRY violations, test coverage, and technical debt. The review loop runs before output is shown — the user receives the second draft, not the first. Produces output with blocking issues clearly separated from suggestions. Do NOT trigger for architecture-only discussions (use architect-reviewer) or security-only audits (use security-auditor). (updated 2026-03-28)

Graphene-Django best practices, N+1 prevention, query optimization, schema design, security, caching, and testing. Load when working with graphene-django GraphQL APIs.

PostgreSQL best practices, query optimization, schema design, security, operations, and performance tuning. Load when working with Postgres databases.

React frontend security best practices for building secure, production-grade applications. Use when writing or reviewing security-sensitive React code, configuring authentication, handling user input, setting up CSP, securing Server Components/Actions, or hardening a React/Next.js application. Covers OWASP 2025, XSS prevention, CSRF, auth patterns, token storage, Server Components security (CVE-2025-55182), Next.js middleware/proxy hardening, supply chain security, CSP with Vite 6/Next.js 16, Zustand/ TanStack Query security, DOMPurify sanitization, and deployment hardening. Keywords: React security, XSS, CSRF, CSP, authentication, authorization, Server Actions, Server Components, OWASP, supply chain, npm audit, DOMPurify, Content-Security-Policy, HttpOnly cookies. (updated 2026-03-28)

React enterprise architecture guidelines for structuring scalable, production-grade applications. Use when scaffolding a new React project, reviewing project structure, setting up feature slices, choosing state management, configuring data fetching, or making architectural decisions in a React/TypeScript codebase. Covers folder structure, routing (TanStack Router, React Router v7, Next.js App Router), TanStack Query v5, Zustand, React Compiler, Vite 6, Turbopack, Vitest, Playwright, Tailwind v4, and Server Components. Keywords: React architecture, project structure, feature slices, DDD, enterprise React, folder layout, monorepo, Nx, Turborepo. (updated 2026-03-28)

Proactive secure coding companion that embeds security controls while writing code — not after. Trigger when user says "write secure", "build with security", "implement authentication", "add authorization", "handle user input", "create API endpoint", "set up session management", "encrypt", "hash password", "secure this endpoint", "add rate limiting", "implement RBAC", "handle file upload", "store secrets", "set up CORS", "add CSRF protection", "validate input", "sanitize output", "secure defaults", "harden this", "zero trust", or when writing any code that touches authentication, authorization, user input, cryptography, sessions, file I/O, external calls, or sensitive data. Do NOT replace security-auditor (post-hoc vulnerability hunting) — this skill builds security in from the start. Do NOT replace code-reviewer security pillar — this skill is for writing, not reviewing. (updated 2026-03-28)

Dedicated security audit skill. Use when security is the PRIMARY concern, not a side pillar of a general code review. Trigger explicitly on: "security audit", "pentest", "pen test", "vulnerability scan", "audit this before deploy", "security review", "harden this", "check for vulnerabilities", "OWASP review", "can a user access another user's data", "multi-tenancy isolation", "privilege escalation", "IDOR", "SSRF", "injection", "CVE check", "dependency audit", "secrets scan", "threat model". Covers three layers: (1) Static code analysis, (2) Access control & authorization audit, (3) Pen test pattern recognition. Do NOT replace the security sections in code-reviewer or its overlays — this skill goes deeper and is invoked on-demand for dedicated security work. (updated 2026-03-28)

Strawberry-Django best practices — DjangoOptimizerExtension, DataLoader, type-hint-first schemas, CRUD mutations, filters/pagination/Relay, permission extensions, security hardening, async/subscriptions, and testing. Load when working with strawberry-graphql-django.