菜单
Review backend and frontend template code for real defects, boundary violations, security gaps, and missing tests. Auto-invoke for code reviews or bug investigations. Triggers: "bug review", "review code", "find bugs", "security audit", "check defects".
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Build or change API behavior in api/ using Express routers, middleware, CustomError, model instances, and camelCase JSON responses.
Implement OOP API entities in api/model/ using the shared Model base class and relation helper.
Maintain the api/helpers/postgres.js SQL boundary, CRUD helper surface, and safe filter conventions.
Update project-local agent guidance when architecture, workflows, commands, or conventions change. Auto-invoke when user or agent output indicates a reusable workflow or durable rule. Triggers: "update docs", "update skill", "create new skill", "update agent instructions", "document recurring pattern", "capture reusable workflow".
Add accurate JSDoc and focused comments when changing template code. Auto-invoke during code writing or refactoring. Triggers: "document code", "jsdoc", "code comments", "add comments", "explain logic".
Keep human docs, agent guidance, and touched code comments aligned with the real web/api implementation, compose workflow, and validation commands. Auto-invoke when auditing docs or after major architectural changes. Triggers: "audit docs", "check context", "documentation maintenance", "audit documentation", "verify docs".
| name | bug-review |
| description | Review backend and frontend template code for real defects, boundary violations, security gaps, and missing tests. Auto-invoke for code reviews or bug investigations. Triggers: "bug review", "review code", "find bugs", "security audit", "check defects". |
| argument-hint | Target directory, file, or bug report scope |
| user-invocable | true |
Use this skill for code reviews, security audits, or defect investigations.
web/ (Mustache SSR, components, DOM) and api/ (Express routes, models, MySQL helpers) responsibilities remain strictly decoupled.api/helpers/postgres.js use parameterized statements and safe filter builders to prevent SQL injection.web/src/js/components/ and no domain data is stored in data-* attributes.Lead with findings ordered by severity (Critical, High, Medium, Low), including file and line citations (file:///path/to/file#L12-L34). If no issues are found, state that clearly and document any remaining automated test gaps.