review
Comprehensive code review: security, edge cases, performance, maintainability. Use before public release, major versions, or production deployment. Triggers: "レビュー", "review", "セキュリティ監査", "公開前チェック", "リリース準備", "コードレビューして".
来源信息
- 仓库
- t2hnd/skills
- 最近来源活动
- 2026年2月7日 11:36
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 0
- Forks
- 0
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- review
- description
- Comprehensive code review: security, edge cases, performance, maintainability. Use before public release, major versions, or production deployment. Triggers: "レビュー", "review", "セキュリティ監査", "公開前チェック", "リリース準備", "コードレビューして".
# Review Skill
Comprehensive code review. Replicates the successful "Rigorous Pre-Release Quality Review" pattern.
## Workflow
Execute this review **autonomously** without asking questions:
### Phase 1: Security Audit
**1. Framework Security:**
- Electron: `nodeIntegration: false`, `contextIsolation: true`, `sandbox: true`
- Web: CORS config, CSP headers, HTTPS
- API: Authentication, rate limiting
**2. Injection Vulnerabilities:**
- SQL injection (parameterized queries?)
- Command injection (shell exec with user input?)
- XSS (`dangerouslySetInnerHTML`, `innerHTML`)
**3. Secrets:**
- Hardcoded API keys or passwords
- `.env` in `.gitignore`?
- Secrets in console logs
**4. Dependencies:**
- `npm audit` for known vulnerabilities
- Outdated packages with CVEs
### Phase 2: Correctness & Edge Cases
**5. Error Handling:**
- `JSON.parse()` without try-catch
- Fetch/API calls without `.catch()`
- Backend endpoints without error handling
- Missing React Error Boundaries
**6. Index & Boundary:**
- Array access without bounds checking
- Off-by-one errors in loops
**7. Null/Undefined:**
- Chained property access without `?.`
- Missing null checks before `.map()`, `.filter()`
**8. Type Safety:**
- Run `tsc --noEmit --strict`
- Flag `any` types in critical paths
- Flag unsafe type assertions
### Phase 3: Performance
**9. Memory Leaks:**
- Event listeners without cleanup
- `useEffect` without cleanup return
- Timers without `clearTimeout`/`clearInterval`
**10. Bundle Size:**
- Large unoptimized assets
- Code splitting opportunities
### Phase 4: Code Quality
**11. Documentation:**
- LICENSE file exists?
- README complete?
- Setup instructions work?
**12. Dead Code:**
- Unused imports and exports
- Commented-out code blocks
**13. Test Coverage:**
- Run coverage report
- Critical paths tested?
### Phase 5: Report
Categorize all issues:
```markdown
## P0 (MUST FIX before release)
- [ ] Security: contextIsolation disabled
- [ ] Hardcoded API key in src/config.ts:12
## P1 (SHOULD FIX)
- [ ] Missing error boundary in App.tsx
- [ ] Unhandled promise rejection in api.ts:45
## P2 (NICE TO FIX)
- [ ] Test coverage 30%
- [ ] 5 unused imports
```
After reporting, offer to auto-fix P0 issues.
### Phase 6: Verification
After fixes:
```bash
npm run build
npm run typecheck
npm test
npm audit
```
## Important Rules
- **DO prioritize issues** (P0 > P1 > P2)
- **DO provide file paths and line numbers** for every issue
- **DO offer to auto-fix P0 issues** after reporting
- **NEVER fix issues without reporting first** — user should see the audit
- **NEVER skip security checks** — critical for public release
在 GitHub 查看