@bd7pil/reeve 0.0.0-stage → 0.1.0

package/skills/review/SKILL.md

@@ -0,0 +1,116 @@
+---
+name: review
+description: >
+  代码审查的规则与输出契约。在审查代码 diff 时使用：五维 rubric（正确性 / 安全 / 性能 / 可维护性 /
+  测试覆盖）、按语言选规则文档、结构化输出契约（severity 与 category 必填，外加 path、行号、
+  existing_code 锚点片段、suggestion_code）、多轮评审时撤掉计划的做法、以及最后一轮的误报过滤。
+  不用于审查实施计划（那是 critic 的活）。
+license: Apache-2.0
+metadata:
+  source: alibaba/open-code-review
+  source-tag: v1.13.1
+  rubrics: default.md ts_js_tsx_jsx.md python.md go.md yaml.md json.md package_json.md
+---
+
+# 审查层 —— 规则与输出契约
+
+> **给 `reviewer` agent 用。** 审查对象是**代码 diff**（不是计划——那是 `critic` 的活）。
+>
+> **来源**：规则文档抄自 [`alibaba/open-code-review`](https://github.com/alibaba/open-code-review)
+> （**Apache-2.0**，`Copyright 2026 Alibaba`，tag `v1.13.1`），见 `licenses/open-code-review.LICENSE`。
+> **我们只吸收规则与契约，不装 OCR 工具**（理由见 [../../docs/PLAN.md](../../docs/PLAN.md) §6）。
+>
+> **为什么本文件叫 `SKILL.md`**：opencode v2 的 skill 发现规则是
+> `scan("{*.md,**/SKILL.md}")`，且要求目录里有 **`SKILL.md`** 或 **`<目录名>.md`**。
+> 叫 `README.md` 的话**不会被当成 skill**（只能靠 `read` 硬读文件）——实测踩过。
+
+---
+
+## 1. 五个维度（`default.md` 是总纲）
+
+| 维度 | 要问的问题 |
+|---|---|
+| **正确性** | 逻辑对吗？边界条件漏了吗？异常处理了吗？并发下线程安全吗？ |
+| **安全** | 有注入/XSS 之类的漏洞吗？敏感信息处理对吗？权限校验完整吗？ |
+| **性能** | 有 N+1、无谓循环之类的问题吗？资源正确释放了吗？ |
+| **可维护性** | 代码清楚吗？命名表达了意图吗？遵循项目既有的风格与架构模式吗？ |
+| **测试覆盖** | 关键逻辑路径有测试吗？边界条件覆盖了吗？ |
+
+## 2. 按语言取用
+
+| 文件 | 用于 |
+|---|---|
+| `default.md` | **总纲，任何语言都先读它** |
+| `ts_js_tsx_jsx.md` | TypeScript / JavaScript / TSX / JSX（REEVE 自己的代码） |
+| `python.md` | Python |
+| `go.md` | Go |
+| `yaml.md` / `json.md` / `package_json.md` | 配置文件 |
+
+**不在表里**：认不出语言就只用 `default.md` 的五维，**不要硬套别的语言的规则**。
+
+## 3. 输出契约（每条评论**必填**）
+
+| 字段 | 取值 / 说明 |
+|---|---|
+| `severity` | `critical` \| `high` \| `medium` \| `low` |
+| `category` | `bug` \| `security` \| `performance` \| `maintainability` \| `test` \| `style` \| `documentation` \| `other` |
+| `path` | 文件路径 |
+| 行号 | 起始与结束 |
+| `existing_code` | **锚点片段**（原文，用于定位） |
+| `suggestion_code` | 建议改成什么 |
+
+**必填字段是硬要求**——**说不出行号和锚点片段的结论，就不要写**。
+这是"证据而非自述"的一部分：必填字段迫使评审给出**可定位**的结论。
+
+**行号对不上怎么办**：**诚实标"未锚定"**，不要硬凑一个数字。
+（OCR 的做法是标 `0` 表示 unanchored；我们照此。）
+
+## 4. 多轮：后续轮要**撤掉计划**
+
+后续轮次把**已经确认的发现**作为 `{{confirmed_comments}}` 注入，
+**并且不再提供"计划"**。
+
+> 原文理由（转述）：*计划在明显的问题被找到之后，会变成一个覆盖上限* ——
+> 它会让人围着计划打转，而不再去找计划没覆盖到的地方。
+
+**每一轮聚焦不同的维度**（正确性 / 安全 / 性能 / 可维护性 / 测试覆盖），
+不要在轮内混着谈。
+
+## 5. 误报过滤
+
+最后单跑一轮**专门删掉"可以被证明是错的"评论**。
+这一轮的任务不是找新问题，是**杀掉**已有的误报。
+**并记录你删了什么、为什么删**——这本身就是"证据而非自述"的一部分。
+
+## 6. 门禁策略
+
+**一开始都不卡流程**（`critical` / `high` 也只报告、不阻塞）。
+
+理由：这套规则有**Java 企业栈的指纹**（MyBatis / Maven / FreeMarker / NPE / 线程安全），
+在自有代码上直接当门禁很可能天天误报。**跑两周统计误报率**，再决定把哪些 severity 升级成门禁。
+
+**升级路径**：若评审实测**噪声大或定位不准**，**再**把 OCR 当第二道门禁装上
+（那时才值得解决它 `git >= 2.41` 的硬门禁——被控端 EL7 自带 1.8.3）。
+
+---
+
+## 7. 我们会失去什么（如实）
+
+不装 OCR 工具意味着失去：**行号锚定的滑动窗口算法**、按元数据的**语义分组**、
+**token 预算管理**、以及 54 份规则文档的**自动匹配**（改用本目录让 agent 自己取用）。
+
+这些在"每天数千 PR"的量级才成为必需；在"orchestrator 审一次改动"的量级可以接受。
+
+---
+
+## 8. 来源与许可
+
+- 上游：`alibaba/open-code-review`（Apache-2.0，`Copyright 2026 Alibaba`），tag **v1.13.1**
+- 本目录下其余 `.md` 是**上游 `internal/config/rules/rule_docs/` 的原样副本**
+- 许可原文：[`licenses/open-code-review.LICENSE`](../../licenses/open-code-review.LICENSE)
+- 结构化输出契约的枚举取自上游 `internal/model/review.go`
+  （`Category`：bug / security / performance / maintainability / test / style / documentation / other；
+  `Severity`：critical / high / medium / low）
+
+**未引入**：OCR 的 Go 代码、它的 CLI 二进制、它的 npm 包装器。
+**未引入** `oh-my-openagent`(omo) 的任何代码或 prompt 字面（SUL-1.0，永久禁止）。

package/skills/review/default.md

@@ -0,0 +1,22 @@
+#### Correctness
+Is the logic correct? Are there missing boundary conditions?
+Are exceptions handled properly?
+Is it thread-safe in concurrent scenarios?
+
+#### Security
+Are there security vulnerabilities such as SQL injection or XSS?
+Is sensitive information handled correctly?
+Is permission validation complete?
+
+#### Performance
+Are there obvious performance issues (e.g., N+1 queries, unnecessary loops)?
+Are resources properly released?
+
+#### Maintainability
+Is the code clear and easy to understand?
+Do names accurately express intent?
+Does it follow the project’s existing code style and architecture patterns?
+
+#### Test Coverage
+Do critical logic paths have corresponding test cases?
+Do test cases cover boundary conditions?

package/skills/review/go.md

@@ -0,0 +1,69 @@
+#### Go Review Principles
+> Favor precision over recall: report only defects that are likely real in the changed code and its reachable context. A false positive costs reviewer trust. Treat correctness and security findings as blocking; style-only suggestions are non-blocking. Focus on language-specific risks that ordinary formatting and deterministic tooling do not already cover.
+
+Before reporting a non-local claim, use `file_read` and `code_search` to establish the relevant call sites, ownership, synchronization, and input boundaries. Do not infer concurrent invocation, attacker control, resource ownership, or an error contract solely from a function name or package import. Do not duplicate findings that `go vet`, Staticcheck, `go test -race`, the compiler, or `gofmt` can determine reliably unless the diff shows a concrete user-visible consequence those tools will not express.
+
+#### Errors, Panics, and API Contracts
+- Errors returned from calls that are ignored, overwritten, or converted into success/default values that hide a failed operation. A deliberately best-effort operation is acceptable only when the ignored failure is safe and documented or evident from the context.
+- Error wrapping that loses the original cause (`fmt.Errorf("...: %v", err)` when callers need `errors.Is`/`errors.As`), wraps nil, returns a misleading sentinel, or exposes internal/sensitive details at a public boundary. Prefer `%w` when preserving identity is required.
+- `panic`, `log.Fatal`, `os.Exit`, or a must-style helper in request, worker, library, or cleanup paths where a recoverable error can be returned. Do not flag an impossible internal invariant or documented programmer contract.
+- Deferred cleanup that overwrites a primary error, drops a meaningful `Close`/`Commit`/`Rollback` error, or returns success after cleanup makes the result invalid.
+
+#### Nil, Interfaces, and Value Semantics
+- A typed nil pointer, map, slice, function, channel, or error stored in a non-nil interface and later treated as absent. Check the concrete assignment and all interface checks first.
+- Nil maps written to, nil channels used unintentionally (which block forever), or nil pointers dereferenced on paths inputs or constructors can actually produce.
+- Copying a value after first use when it contains `sync.Mutex`, `sync.RWMutex`, `sync.Once`, `sync.Pool`, `atomic` state, or another non-copyable synchronization primitive. Flag copies through value receivers, assignment, return, append, map values, or serialization only when the value can have been used first.
+- Value receivers or copies that silently mutate only a copy when callers expect shared state, especially for structs holding maps, slices, pointers, locks, or atomic state. Do not flag intentional immutable value objects.
+- `sync.Once` used for work that must retry after failure. `Once.Do` considers its `func()` complete even if it panics; an error captured by that closure also does not make a later `Do` retry it.
+
+#### Context, Goroutines, and Cancellation
+- Request-scoped work started with `context.Background()`/`TODO()` or a fresh context when it should inherit the caller's deadline, cancellation, values, or tracing. Independent background work is valid.
+- `context.Context` stored in a struct or replaced with a custom context interface when it should be passed explicitly as the first parameter. Allow it only where a required external interface fixes the signature or ownership/lifetime is unambiguous.
+- `context.WithCancel`, `WithTimeout`, or `WithDeadline` whose cancel function is not called once the derived context is no longer needed, unless ownership transfer and eventual cancellation are evident.
+- Blocking I/O, waits, retries, selects, or loops on a request/worker path that lack cancellation or deadline where the dependency can stall. Confirm the operation can outlive its caller first.
+- Goroutines that can outlive their owner because they wait forever on a channel, lock, I/O operation, or unbounded retry; lack shutdown; or have no way for errors/completion to be observed when that matters.
+- Fire-and-forget goroutines that capture request-local mutable data, write to a response after the handler returns, panic without recovery at a process boundary, or race with cleanup. Do not require joining independent background work.
+- Loop-variable or mutable outer-variable captures in goroutines/callbacks where a closure can observe a later value. Verify the module's `go` directive and whether a new variable is created per iteration; Go 1.22 language semantics changed range-loop variables while older-module semantics can retain the shared variable.
+
+#### Channels, Locks, and Shared State
+Only report races or deadlocks with evidence that state is reachable concurrently; inspect surrounding call sites where that is not local. Do not flag immutable data, per-goroutine locals, or synchronization guaranteed by ownership.
+
+- Unsynchronized concurrent reads/writes of maps, slices, pointers, counters, caches, or compound state; check-then-act sequences that can interleave.
+- Holding a mutex/RWMutex across blocking I/O, channel operations, callbacks, network/database calls, or long CPU work when another path needs the lock to progress. Check lock ordering before claiming deadlock.
+- `RLock` used while mutating protected data; unlocked mutation of a field whose peers protect it; or atomic and non-atomic access mixed for the same state.
+- Sends/receives that can block indefinitely because a peer may stop, a buffer may fill, or shutdown/cancellation is not selected. Do not flag a synchronous handoff with a proven peer.
+- Multiple possible channel closers, send-on-closed-channel risk, or double-close. Establish sender/owner responsibility first.
+- `select` defaults that busy-spin, drop required work, or bypass cancellation; unbounded retries without backoff/cancellation.
+- WaitGroups with `Add` racing with `Wait`, missing `Done`, copies after first use, or counters that cannot reach completion.
+
+#### Timers, Tickers, and Resource Lifecycle
+- A timer/ticker retained by its owner and left running after work ends, so it can fire, tick, retain reachable state, or keep associated work alive. Do not report missing `Stop` solely as a GC leak: Go 1.23+ can recover unreferenced unstopped timers/tickers; older semantics and `GODEBUG=asynctimerchan=1` differ.
+- `time.After` in a repeated/select loop only with evidence of cost: pre-Go-1.23 semantics with many unexpired timers, a high-frequency allocation path, or retained timer owners. Do not call it a leak by itself on Go 1.23+.
+- Timer reset/stop code that assumes one behavior across Go versions. Channel timers on Go 1.23+ eliminate stale values after `Reset`/`Stop`; older semantics require stop-and-drain coordination. `AfterFunc` reset/stop does not wait for an already-started callback, so callbacks can overlap unless synchronized.
+- `http.Response.Body`, `sql.Rows`, files, sockets, compression readers/writers, transactions, locks, or other closable resources not closed on all reachable paths after acquisition. Do not flag resources handed to a caller/framework that owns closure.
+- `defer` inside a loop whose surrounding function can run many iterations or indefinitely, especially when it delays closing files, response bodies, rows, locks, or transactions until function return. Do not flag small statically bounded loops or helpers returning per iteration.
+- `sql.Rows` iteration that omits `rows.Err()` after the loop, or rows not closed when iteration can stop early.
+- Outbound HTTP calls missing body cleanup, request context, or timeout on a server path that can hang; transactions with a return path after `Begin` lacking rollback/commit.
+
+#### Collections, Slices, Bytes, and Numeric Boundaries
+- Returning, caching, or passing a slice/map/byte buffer whose backing storage is later reused/mutated, changing data observed by another owner. Confirm ownership; zero-copy APIs can be intentional.
+- `append` to a slice that aliases caller/shared backing storage where mutation escapes; retaining a tiny subslice of a huge buffer where retained memory matters.
+- Reachable indexing, slicing, length arithmetic, or capacity assumptions that exceed bounds on empty/boundary input.
+- Integer conversion, narrowing, signed/unsigned comparison, size calculation, allocation, or offset arithmetic that can overflow, truncate, wrap, or turn negative input into huge size. Consider architecture-dependent `int` width.
+- Reusing mutable buffers, encoders, decoders, scanners, or package/global state concurrently or after returned output depends on their lifetime.
+
+#### Security-Sensitive Boundaries
+Confirm attacker control or a trust boundary before reporting. Prefer a concrete exploit path and remediation.
+
+- SQL, shell commands, URLs, paths, headers, templates, regexes, or serialized data assembled from untrusted input without appropriate parameterization, validation, escaping, allowlisting, or scheme/host/path restrictions. `os/exec` argument arrays are safer than a shell but arguments may still need validation.
+- Path traversal, symlink-following, unsafe archive extraction, insecure temp files, or permission/ownership assumptions that expose or overwrite files.
+- `html/template` replaced with `text/template` for HTML, trusted-template types constructed from untrusted content, or context-inappropriate escaping. Do not flag `text/template` for non-HTML output by default.
+- SSRF or credential leakage through outbound URLs: untrusted destinations, absent required allowlists, redirects to internal services, or sensitive headers forwarded cross-host.
+- Secrets, credentials, tokens, authorization headers, private keys, or sensitive personal data logged, returned in errors, or embedded in source/configuration.
+- `math/rand` or `math/rand/v2` used for security-sensitive keys, tokens, session IDs, reset codes, nonces, or salts; require `crypto/rand` or a vetted cryptographic construction. Do not flag simulation, sampling, load-balancing, or tests.
+- `reflect`, `unsafe`, cgo, unsafe pointer conversion, manual memory/layout assumptions, or custom cryptography without narrow documented invariants and required bounds/lifetime checks. Do not flag ordinary reflection alone.
+
+#### Tests and Review Scope
+- Review production Go changes by default. `*_test.go` files remain excluded by OCR's default path filter and are reviewed only when user configuration explicitly includes them.
+- Suggest tests only for concrete changed correctness, concurrency, error, or boundary failure modes. Favor deterministic tests; do not demand flaky timing-based race tests.
+- Do not make formatting, import ordering, naming preferences, simplification, or advice already enforced by `gofmt`, `go vet`, Staticcheck, linters, or the compiler into blocking findings.

package/skills/review/json.md

@@ -0,0 +1 @@
+Check JSON files for spelling errors in json-keys; ignore the content of json-values.

package/skills/review/package_json.md

@@ -0,0 +1,3 @@
+- Avoid introducing dependencies with a version of `latest` or `*`; use specific version numbers instead. Note: ignore this rule when the version number is not on a newly added line of code
+- Dependency conflicts or duplicate declarations: the same dependency exists in both `dependencies` and `devDependencies`
+- Required tool dependencies not declared: tool names such as eslint, jest, or prettier appear in `scripts` but are not listed in `devDependencies`

package/skills/review/python.md

@@ -0,0 +1,77 @@
+> Favor precision over recall: only raise an issue when you are confident it is a real defect, and stay silent when the surrounding context is unclear — a false alarm costs more reviewer trust than a missed minor issue. Treat security and correctness findings as blocking, and style or idiom suggestions as non-blocking.
+
+#### Obvious Typos or Spelling Errors
+- Spelling errors in variable, function, class, or module names at their declaration sites; do not report spelling errors at reference sites, as these are determined by the declaration
+- Strings in log messages or exception messages containing spelling errors that affect readability
+
+#### Dead Code
+- Code blocks that can never be reached (e.g., branches where the condition is always false, code after a `return`, `raise`, `break`, or `continue`)
+- Variables, imports, or function parameters that are declared but never read or referenced
+- Large blocks of commented-out code with no apparent intent to preserve
+- Do not report unused imports, variables, or parameters in `.pyi` stub files; a stub declares an interface it never executes, so re-exported imports, annotation-only declarations, and unreferenced parameter names are expected rather than dead
+
+#### Mutable Default Arguments and Shared State
+- Mutable default arguments such as `def f(x=[])` or `def f(x={})`; the default is created once and shared across every call. Default to `None` and build the value inside the body
+- Class-level mutable attributes shared unintentionally across instances when a per-instance value was intended
+- Module-level mutable globals (lists, dicts, caches) mutated across requests or threads, retaining state in ways that surprise the caller
+- Closures that capture a loop variable by reference and all end up seeing its final value
+- Do not report when the function never mutates the argument, or when the shared default is a deliberate, documented cache or sentinel
+
+#### Boundary and Edge-Case Handling
+- Empty inputs assumed to be non-empty: indexing `xs[0]`, `max()`/`min()`, or slicing without first handling the empty `list`, `str`, `dict`, or iterator
+- Off-by-one and out-of-range access on indices, ranges, or slices, especially at the first/last element
+- `None` reaching code that assumes a value, when an upstream call or default can legitimately return `None` (confirm the data source with `file_read` before flagging)
+- Comparing floats for exact equality with `==`; use `math.isclose` or an explicit tolerance, since floating-point results are not exact
+- Integer/float and division assumptions: unintended truncation with `//`, or `ZeroDivisionError` when a divisor can be zero
+- Heterogeneous or unexpected element types in a collection that the code assumes are uniform (e.g., mixing `None`, numbers, and strings)
+- Dictionary access by key without handling the missing-key case (`d[k]` vs `d.get(k)`), or set/dict operations that assume a key is present
+- Do not report edge cases that a caller or type contract has already ruled out, or inputs that cannot occur given validated boundaries upstream
+
+#### Error Handling and Exceptions
+- Bare `except:` swallows everything, including `KeyboardInterrupt` and `SystemExit`; catch `except Exception` at minimum, and prefer the specific exception types you expect
+- `except Exception` that is still broader than the failure being handled; narrow it to the exceptions actually raised by the guarded call
+- Exceptions caught and silently discarded (`pass`) without logging or re-raising
+- Original traceback lost when re-raising; prefer `raise NewError(...) from err` to preserve the cause
+- Broad `try` blocks that wrap far more than the line that can actually fail, hiding where the error originates
+- `assert` used for runtime validation of external input — assertions are stripped under `python -O`
+
+#### Identity and Equality Comparisons
+- Using `is`/`is not` to compare against literals such as strings, numbers, or tuples; this relies on implementation-specific interning rather than value equality — use `==` (a real correctness risk)
+- Comparing against `True`/`False` with `==`, where a truthy-but-not-`True` value (e.g. `1`, a non-empty container) would compare unequal; prefer a plain truthiness check
+- Reserve `is` for identity checks against singletons and sentinels
+- Comparing against `None` with `==`/`!=` rather than `is`/`is not` is a style preference; report as minor, not blocking
+
+#### Resource Management
+- Files, sockets, locks, or database connections opened without a `with` statement, risking leaks on early return or exception
+- Context managers available but bypassed in favor of manual `open()`/`close()` pairs
+- Resources acquired in a `try` whose `finally` cleanup is missing or incomplete on the error path
+- Iterators or generators holding resources open longer than necessary
+- Do not report short-lived scripts, or handles already managed by an enclosing `with` or framework-managed lifecycle (confirm the surrounding scope with `file_read` before flagging)
+
+#### Performance
+Confirm data scale and that the code is on a hot path before flagging:
+- Building strings with `+=` in a loop instead of accumulating in a list and `"".join(...)`, or using an f-string
+- Repeated membership tests against a `list` where a `set` or `dict` would turn O(n) lookups into O(1)
+- Building a full list when a generator would avoid holding everything in memory
+- Recomputing inside a loop a value that is invariant across iterations (e.g., compiling a regex, attribute lookups in hot paths)
+- Passing an eagerly formatted f-string to `logging` (e.g., `logging.info(f"...")`) instead of `logging.info("%s", value)`, which defeats lazy formatting when the level is disabled
+
+#### Concurrency and Async
+Only flag concurrency issues when there is evidence of multi-threaded, multi-process, or async invocation (confirm the call context before reporting):
+- CPU-bound work parallelized with `threading` under the GIL where `multiprocessing` or a process pool is the right tool (traditional CPython; free-threaded builds excepted); I/O-bound work is the case threads actually help
+- Check-then-act races on shared state without a `Lock`, or non-atomic compound updates assumed to be atomic
+- Blocking calls (synchronous I/O, `time.sleep`, `requests`, CPU-heavy work) inside `async def`, stalling the event loop; use the async equivalent or run them in an executor
+- `asyncio` tasks created and never awaited, so exceptions are swallowed and the work may be garbage-collected before it finishes
+- Shared mutable state across threads or tasks without synchronization or a thread-safe structure
+
+Do not report local variables (each thread has its own), read-only access to shared data, or code with no evidence of concurrent use.
+
+#### Security-Sensitive Code
+Validate the data source before flagging; confirm the input is actually attacker-controlled rather than a trusted constant:
+- `eval`, `exec`, or `compile` on untrusted input; this is arbitrary code execution
+- `subprocess` with `shell=True` built from unsanitized input; pass an argument list and avoid the shell
+- `pickle`, `marshal`, or `yaml.load` (without `SafeLoader`) on untrusted data; deserialization can execute arbitrary code
+- SQL built by string concatenation or f-strings instead of parameterized queries
+- Secrets, tokens, passwords, or PII written to logs or committed in source
+- Weak or misused cryptography (`hashlib.md5`/`sha1` for passwords, `random` for security tokens); use `secrets` and vetted libraries
+- Untrusted file paths joined without validation, allowing path traversal

package/skills/review/ts_js_tsx_jsx.md

@@ -0,0 +1,40 @@
+#### Obvious Typos or Spelling Errors
+- Spelling errors in variable names, function names, component names, or Props property names
+- Strings in log or error messages containing spelling errors that affect readability
+
+#### Dead Code
+- Code blocks that will never be executed (e.g., branches where the condition is always false, code after a return statement)
+- Variables that are declared but never read or referenced
+- Large blocks of commented-out code (with no apparent intent to retain)
+
+#### Code Quality Checks
+- **Duplicate Code**: Check for common logic that can be extracted
+- **Code Comments**: Complex business logic should have clear explanatory comments (avoid commenting obvious code)
+- **Hardcoding**: Business-related hardcoded strings are prohibited, especially URL paths and business numbers; simple UI text may be relaxed
+- **Variable Declarations**: Using `var` is strictly prohibited; use `let` or `const`
+- **Equality Comparisons**: Using `==` and `!=` is prohibited; use strict equality `===` and `!==`
+- **TypeScript Types**: Avoid using `any` type; if necessary, provide a comment explaining the reason
+- **Null Checks**: Perform null checks when accessing values or destructuring to avoid null pointer exceptions
+- **Ternary Expressions**: Nested ternary expressions are not allowed
+
+#### React Best Practices
+- **Hooks Usage**: Verify compliance with Hooks rules (only call at the top level, only call in React functions)
+- **State Management**: Ensure state is placed at the appropriate level; avoid unnecessary state lifting
+- **Side Effect Handling**: Verify useEffect correctly handles dependencies and cleanup functions
+- **Performance Optimization**: Verify proper use of React.memo, useMemo, useCallback (based on performance analysis; avoid over-optimization)
+- **Render Side Effects**: Side effects in React component render methods are strictly prohibited (e.g., API calls, DOM manipulation)
+- **Inline Styles**: Avoid using inline `style` attributes, except for dynamic styles
+- **Inner Components**: Declaring new components inside a component is prohibited; use render methods instead (e.g., `renderItem`, not `<Item/>`)
+
+#### Async Handling Standards
+- **Error Handling**: Async functions must include proper error handling with user-friendly error messages
+- **Prefer async/await**: Prefer async/await over Promises; callback hell is prohibited
+- **Async in Loops**: Distinguish between independent async operations (use `Promise.all` for parallelism) and dependent async operations (use sequential execution); prefer `Promise.all` for performance
+
+#### Code Security Checks
+- **XSS Protection**: Verify that user input is properly escaped
+- **innerHTML Safety**: Using innerHTML to directly insert user input is prohibited; use textContent or apply XSS protection
+- **Code Injection Protection**: Using eval(), Function() constructor, and string argument forms of setTimeout/setInterval is strictly prohibited
+- **Dangerous Methods**: Using document.write() is prohibited as it causes page reflow and security issues
+- **Sensitive Information**: Check whether API keys or sensitive data are exposed
+- **Prototype Chain Safety**: Modifying native object prototypes (e.g., Array.prototype, Object.prototype) is prohibited

package/skills/review/yaml.md

@@ -0,0 +1 @@
+Check for spelling errors in yaml-keys within YAML files; ignore the content of yaml-values.