菜单
Self-review before push — read the diff as a reader, scan for vixen footguns (token leaks, PII, idempotency, captcha asset overwrites), run validation pipeline, no surprise files. Use before "git push", before opening a PR, or when the user says "ready to commit".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Bump the patch version in server/Cargo.toml or website/package.json after completing a major change. Use when the user asks to bump/release a version, or when CLAUDE.md's rule about version bumps after major changes applies.
Before a non-trivial change, list affected systems — DB schema, API contract, Telegram handlers, jobs, TS types, docs. Catch ripple effects upfront, not after CI fails. Use when planning a feature, migration, refactor, or any cross-module touch.
Write a git commit message for vixen-rs following the project's Conventional Commits convention. Use when the user asks to commit, create a commit, or write a commit message.
Reproduce → bisect → root cause → fix → verify. Don't speculate, don't "add more error handling" as a guess. Use when something is broken, when a test fails intermittently, when the user says "this isn't working" or "investigate why".
Write small, fast, reproducible Dockerfiles for the vixen-rs server (Rust) and website (bun) using multi-stage builds, cache mounts, distroless/alpine runtime images, and non-root users. Use when editing server/Dockerfile, website/Dockerfile, docker-compose.yml, or when the user asks to shrink an image or speed up a Docker build.
Evaluate a 3rd-party Claude skill before importing — source trust, duplicate check, rule extraction, vixen-fit. Reject vague triggers and off-scope content. Use when the user shares a skill URL, asks "should we adopt this skill", or proposes importing from a marketplace.
| name | code-review-self |
| description | Self-review before push — read the diff as a reader, scan for vixen footguns (token leaks, PII, idempotency, captcha asset overwrites), run validation pipeline, no surprise files. Use before "git push", before opening a PR, or when the user says "ready to commit". |
Source: vixen review-pr skill + standard self-review.
Read first: review-pr/SKILL.md, CLAUDE.md Critical Rules.
git diff --staged — read every line. If you don't, the reviewer will./server-check and/or /website-check — depending on what changed.git status — no surprise files staged. Watch for .env, large binaries, node_modules, generated files.do_foo_and_bar, split it.Grep the diff for:
token, bot_token, TELEGRAM_BOT_TOKEN, OPENAI_API_KEY, JWT_SECRET in any new tracing::*! / println! / eprintln! — must use RedactedToken newtype from server/src/utils/redact.rs.init_data / initData in any non-debug! log — initData carries user PII.debug level.INSERT INTO moderation_actions without ON CONFLICT (chat_id, target_user_id, action, message_id) DO NOTHING — breaks idempotency.server/assets/captcha/ overwriting an existing path — captcha assets are immutable; bump the selector version instead.SELECT ... FOR UPDATE then UPDATE.i32 where it should be i64 (any Telegram ID — chat, user, message). Supergroup IDs overflow i32.en only — must be in every locale file under website/i18n/messages/.props.x destructured (const { x } = props) — breaks reactivity.any, enum, default exports outside pages/.feat(scope):, fix(scope):, refactor(scope):, docs(scope):, chore(scope):.server, api, db, auth, bot, captcha, spam, jobs, reports, config, website, ui, i18n, docker, ci, deps.User-visible change → entry under [Unreleased] with (server) / (website) / (infra) tag, grouped under Added / Changed / Fixed / Removed / Security. See bump-version/SKILL.md.
Skip CHANGELOG only for trivial internal changes (formatting, comment tweaks, refactors with no observable effect).
State explicitly before declaring ready:
Ran
/server-check, all green. No footguns: no token in logs, no overwritten captcha asset, idempotent insert. CHANGELOG updated under[Unreleased](server).
If you can't say that sentence, you're not ready.
commit-message — Conventional Commits format details.review-pr — what an external reviewer will check.verifiable-goal — proves the change works.bump-version — patch / minor / major + CHANGELOG.