菜单
Backend code review for src/server/. 3 parallel agents: architecture, security+performance, engineering+scalability. Supports diff mode. Trigger: "review server", "review backend".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Mandatory Prismix browser verification for web UI changes. Use when modifying or reviewing frontend-rendered behavior, including src/web files, shared UI components, routes, layouts, CSS/Tailwind classes, visual assets, displayed i18n strings, browser auth flows, or frontend-visible API behavior.
Review and accept external modifications to the working tree (Codex, linters, collaborators). Diff, assess, flag issues. Trigger: "review changes", "review external", "check what changed".
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Guide for implementing smooth, native-feeling animations using React's View Transition API (`<ViewTransition>` component, `addTransitionType`, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route changes, create shared element animations, animate enter/exit of components, animate list reorder, implement directional (forward/back) navigation animations, or integrate view transitions in Next.js. Also use when the user mentions view transitions, `startViewTransition`, `ViewTransition`, transition types, or asks about animating between UI states in React without third-party animation libraries.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Frontend code review for src/web/. 3 parallel agents: performance, architecture, engineering. Supports diff mode. Trigger: "review web", "review frontend".
基于 SOC 职业分类
| name | review-server |
| description | Backend code review for src/server/. 3 parallel agents: architecture, security+performance, engineering+scalability. Supports diff mode. Trigger: "review server", "review backend". |
| metadata | {"argument-hint":"[diff] [architecture|security|engineering]"} |
Audit src/server/ + src/blockchain/ + src/shared/ with 3 parallel agents. Plan only — no code changes. Output: docs/server-refactor-plan.md.
Modes: diff = only changed files vs main. Focus arg = single agent. Combinable: /review-server diff security.
Scope: src/server/, src/blockchain/, src/shared/ only. Grep-first, Read only for context.
Context (embed in each agent):
Node.js + Hono + Drizzle ORM (PostgreSQL) + ioredis + pino. Domain modules: gateway, merchant, admin, auth, messaging.
Strategy pattern: db, cache, queue, rate-limit, events (interface + impl + barrel).
Rules: ts-pattern 3+ branches, lodash-es, @/shared/number.ts, pino only (no console.log),
repos only (no direct @/server/db), FK split (management=CASCADE, hot-path=no FK), updatedAt in every .set().
Glob large files. Check: files > 300 lines (god files), switch( (ts-pattern), console.log/error/warn, .sort(/.toFixed( (lodash-es/number.ts), cross-domain imports, route importing @/server/db directly, 3+ repeated CRUD patterns across routes, over-abstraction (single-impl interfaces). Max 15 findings.
Grep vulnerability patterns. Check: routes missing auth session check, POST/PUT without parseBody, Number(/parseInt( without NaN check, z.any() in request schemas, hardcoded secret-like strings, fetch( with user URLs (SSRF), eval(/new Function(, await inside loops (N+1), .findAll() without limit, unbounded in-memory Maps/Sets. Read gateway handler for sequential await chains. Max 15 findings.
Grep-first. Check: : any/as any/@ts-ignore, JSON.parse( without Zod, empty catch blocks, .set( missing updatedAt, dead exports never imported, commented-out code > 5 lines, in-memory state that breaks multi-instance (verify Redis fallback), fire-and-forget .catch() swallowing errors, non-idempotent background jobs. Max 15 findings.
Deduplicate → classify P0 (security/data loss) / P1 (performance/architecture) / P2 (code quality) → if previous plan exists mark NEW vs RECURRING → write docs/server-refactor-plan.md → present summary, wait for confirmation.