@simplysm/sd-claude 13.0.60 → 13.0.61
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/claude/agents/sd-api-reviewer.md +7 -6
- package/claude/agents/sd-code-simplifier.md +0 -3
- package/claude/agents/sd-security-reviewer.md +14 -3
- package/claude/refs/sd-angular.md +127 -0
- package/claude/refs/sd-orm-v12.md +81 -0
- package/claude/refs/sd-orm.md +7 -1
- package/claude/refs/sd-solid.md +8 -0
- package/claude/rules/sd-refs-linker.md +41 -9
- package/claude/skills/sd-api-name-review/SKILL.md +6 -6
- package/claude/skills/sd-brainstorm/SKILL.md +4 -0
- package/claude/skills/sd-check/SKILL.md +10 -10
- package/claude/skills/sd-check/baseline-analysis.md +24 -3
- package/claude/skills/sd-check/test-scenarios.md +34 -1
- package/claude/skills/sd-commit/SKILL.md +11 -5
- package/claude/skills/sd-debug/SKILL.md +26 -17
- package/claude/skills/sd-debug/condition-based-waiting.md +17 -12
- package/claude/skills/sd-debug/defense-in-depth.md +14 -8
- package/claude/skills/sd-debug/root-cause-tracing.md +18 -4
- package/claude/skills/sd-debug/test-baseline-pressure.md +10 -8
- package/claude/skills/sd-discuss/SKILL.md +17 -13
- package/claude/skills/sd-eml-analyze/SKILL.md +8 -7
- package/claude/skills/sd-explore/SKILL.md +2 -0
- package/claude/skills/sd-plan/SKILL.md +9 -3
- package/claude/skills/sd-plan-dev/SKILL.md +7 -2
- package/claude/skills/sd-plan-dev/code-quality-reviewer-prompt.md +2 -0
- package/claude/skills/sd-plan-dev/final-review-prompt.md +2 -2
- package/claude/skills/sd-readme/SKILL.md +22 -16
- package/claude/skills/sd-review/SKILL.md +22 -21
- package/claude/skills/sd-skill/SKILL.md +94 -35
- package/claude/skills/sd-skill/anthropic-best-practices.md +174 -148
- package/claude/skills/sd-skill/examples/CLAUDE_MD_TESTING.md +11 -0
- package/claude/skills/sd-skill/persuasion-principles.md +39 -6
- package/claude/skills/sd-skill/testing-skills-with-subagents.md +46 -26
- package/claude/skills/sd-tdd/SKILL.md +54 -36
- package/claude/skills/sd-tdd/testing-anti-patterns.md +40 -22
- package/claude/skills/sd-use/SKILL.md +22 -22
- package/claude/skills/sd-worktree/SKILL.md +1 -0
- package/claude/skills/sd-worktree/sd-worktree.mjs +1 -1
- package/package.json +1 -1
- package/claude/skills/sd-check/run-checks.mjs +0 -54
|
@@ -9,16 +9,16 @@ You are helping debug a test failure. The test has been failing intermittently f
|
|
|
9
9
|
The failing test code:
|
|
10
10
|
|
|
11
11
|
```typescript
|
|
12
|
-
test(
|
|
13
|
-
await page.goto(
|
|
14
|
-
await page.fill(
|
|
15
|
-
await page.fill(
|
|
16
|
-
await page.click(
|
|
12
|
+
test("user login flow", async () => {
|
|
13
|
+
await page.goto("/login");
|
|
14
|
+
await page.fill("#username", "testuser");
|
|
15
|
+
await page.fill("#password", "testpass");
|
|
16
|
+
await page.click("#submit");
|
|
17
17
|
|
|
18
|
-
await new Promise(r => setTimeout(r, 5000)); // Already increased twice
|
|
18
|
+
await new Promise((r) => setTimeout(r, 5000)); // Already increased twice
|
|
19
19
|
|
|
20
|
-
const welcome = await page.textContent(
|
|
21
|
-
expect(welcome).toBe(
|
|
20
|
+
const welcome = await page.textContent(".welcome");
|
|
21
|
+
expect(welcome).toBe("Welcome, testuser!");
|
|
22
22
|
});
|
|
23
23
|
```
|
|
24
24
|
|
|
@@ -40,6 +40,7 @@ at test/login.spec.ts:12:3
|
|
|
40
40
|
## Expected Baseline Behavior (WITHOUT sd-debug skill)
|
|
41
41
|
|
|
42
42
|
The agent will likely:
|
|
43
|
+
|
|
43
44
|
- Jump directly to implementing one of the suggested solutions
|
|
44
45
|
- Rationalize: "User asked for this specific fix"
|
|
45
46
|
- Rationalize: "It's just a timing issue, timeout should work"
|
|
@@ -53,6 +54,7 @@ Run this scenario with a haiku subagent WITHOUT the sd-debug skill loaded.
|
|
|
53
54
|
Ask the agent: "How would you fix this test failure?"
|
|
54
55
|
|
|
55
56
|
Document:
|
|
57
|
+
|
|
56
58
|
1. Does agent propose fix immediately or investigate first?
|
|
57
59
|
2. What rationalizations does agent use?
|
|
58
60
|
3. Does agent ask any diagnostic questions?
|
|
@@ -15,6 +15,7 @@ Facilitate balanced, evidence-based technical discussions by researching industr
|
|
|
15
15
|
### 1. Understand the Question
|
|
16
16
|
|
|
17
17
|
Ask ONE question to understand the user's motivation:
|
|
18
|
+
|
|
18
19
|
- What problem triggered this question?
|
|
19
20
|
- What constraints matter most?
|
|
20
21
|
|
|
@@ -23,11 +24,13 @@ Ask ONE question to understand the user's motivation:
|
|
|
23
24
|
**MANDATORY before forming any opinion:**
|
|
24
25
|
|
|
25
26
|
**Project research** (Read/Grep tools):
|
|
27
|
+
|
|
26
28
|
- Read the actual source code related to the question
|
|
27
29
|
- Check CLAUDE.md for project conventions
|
|
28
30
|
- Find similar patterns in the codebase
|
|
29
31
|
|
|
30
32
|
**Industry research** (WebSearch tool):
|
|
33
|
+
|
|
31
34
|
- Search for current community consensus and trends
|
|
32
35
|
- Check relevant specifications (TC39, W3C, RFCs)
|
|
33
36
|
- Find recent benchmarks, migration case studies, or survey data
|
|
@@ -38,6 +41,7 @@ Ask ONE question to understand the user's motivation:
|
|
|
38
41
|
Present each option as if you were **advocating FOR it**. Equal depth, equal effort.
|
|
39
42
|
|
|
40
43
|
For each option:
|
|
44
|
+
|
|
41
45
|
- **Industry support**: Libraries, standards, and projects that use this approach (with sources)
|
|
42
46
|
- **Technical advantages**: Concrete benefits with evidence
|
|
43
47
|
- **When this wins**: Specific scenarios where this is clearly better
|
|
@@ -52,12 +56,12 @@ For each option:
|
|
|
52
56
|
|
|
53
57
|
Provide a decision matrix — NOT a single recommendation:
|
|
54
58
|
|
|
55
|
-
| Criteria
|
|
56
|
-
|
|
57
|
-
| Industry alignment
|
|
58
|
-
| Project consistency | ...
|
|
59
|
-
| Migration cost
|
|
60
|
-
| Long-term trend
|
|
59
|
+
| Criteria | Option A | Option B |
|
|
60
|
+
| ------------------- | -------- | -------- |
|
|
61
|
+
| Industry alignment | ... | ... |
|
|
62
|
+
| Project consistency | ... | ... |
|
|
63
|
+
| Migration cost | ... | ... |
|
|
64
|
+
| Long-term trend | ... | ... |
|
|
61
65
|
|
|
62
66
|
Then ask: "Which criteria matter most to you?"
|
|
63
67
|
|
|
@@ -79,10 +83,10 @@ Then ask: "Which criteria matter most to you?"
|
|
|
79
83
|
|
|
80
84
|
## Common Mistakes
|
|
81
85
|
|
|
82
|
-
| Mistake
|
|
83
|
-
|
|
84
|
-
| Jump to recommendation
|
|
85
|
-
| "Industry standard is X" without sources | WebSearch for actual data and citations
|
|
86
|
-
| Ignoring project context
|
|
87
|
-
| Monologue instead of discussion
|
|
88
|
-
| Treating "modern" as "better"
|
|
86
|
+
| Mistake | Fix |
|
|
87
|
+
| ---------------------------------------- | ------------------------------------------- |
|
|
88
|
+
| Jump to recommendation | Research first, present balanced options |
|
|
89
|
+
| "Industry standard is X" without sources | WebSearch for actual data and citations |
|
|
90
|
+
| Ignoring project context | Read codebase patterns before discussing |
|
|
91
|
+
| Monologue instead of discussion | Ask about user's priorities and constraints |
|
|
92
|
+
| Treating "modern" as "better" | Evaluate on actual trade-offs, not trends |
|
|
@@ -26,19 +26,20 @@ First run auto-installs: `pdfminer.six`, `python-pptx`, `openpyxl`.
|
|
|
26
26
|
## Output Format
|
|
27
27
|
|
|
28
28
|
Markdown report with sections:
|
|
29
|
+
|
|
29
30
|
1. **Mail info table**: Subject, From, To, Cc, Date, attachment count
|
|
30
31
|
2. **Body text**: Plain text (HTML stripped if no plain text)
|
|
31
32
|
3. **Attachment analysis**: Summary table + extracted text per file
|
|
32
33
|
|
|
33
34
|
## Supported Attachments
|
|
34
35
|
|
|
35
|
-
| Format
|
|
36
|
-
|
|
37
|
-
| PDF
|
|
38
|
-
| XLSX/XLS
|
|
39
|
-
| PPTX
|
|
40
|
-
| Text files (.txt, .csv, .json, .xml, .html, .md) | UTF-8/CP949 decode
|
|
41
|
-
| Images
|
|
36
|
+
| Format | Method |
|
|
37
|
+
| ------------------------------------------------ | --------------------------------------- |
|
|
38
|
+
| PDF | pdfminer.six text extraction |
|
|
39
|
+
| XLSX/XLS | openpyxl cell data as markdown table |
|
|
40
|
+
| PPTX | python-pptx slide text + tables + notes |
|
|
41
|
+
| Text files (.txt, .csv, .json, .xml, .html, .md) | UTF-8/CP949 decode |
|
|
42
|
+
| Images | Filename and size only |
|
|
42
43
|
|
|
43
44
|
## Common Mistakes
|
|
44
45
|
|
|
@@ -14,6 +14,7 @@ You are an expert code analyst specializing in tracing and understanding feature
|
|
|
14
14
|
## Target Selection
|
|
15
15
|
|
|
16
16
|
**When invoked with `$ARGUMENTS`:**
|
|
17
|
+
|
|
17
18
|
- If path is provided → **Immediately start analysis** (don't ask clarifying questions)
|
|
18
19
|
- If path is a package directory → Trace all major features, architecture, and patterns
|
|
19
20
|
- If path is a single file → Trace its role, dependencies, and usage
|
|
@@ -25,6 +26,7 @@ You are an expert code analyst specializing in tracing and understanding feature
|
|
|
25
26
|
Provide a complete understanding of how the target code works by tracing its implementation from entry points to data storage, through all abstraction layers. **Analysis only — no code modifications.**
|
|
26
27
|
|
|
27
28
|
When analyzing a package/directory, cover:
|
|
29
|
+
|
|
28
30
|
- Overall architecture and design patterns
|
|
29
31
|
- Major features and entry points
|
|
30
32
|
- Key abstractions and interfaces
|
|
@@ -15,11 +15,13 @@ Turn a design doc into a step-by-step implementation plan through codebase explo
|
|
|
15
15
|
## The Process
|
|
16
16
|
|
|
17
17
|
**Exploring the codebase:**
|
|
18
|
+
|
|
18
19
|
- Read the design doc, then explore relevant files, patterns, dependencies
|
|
19
20
|
- Ask questions one at a time as they arise during planning, with your recommendation
|
|
20
21
|
- Don't batch questions upfront — real questions emerge while deep in the details
|
|
21
22
|
|
|
22
23
|
**Ask about anything you're not 100% confident about.** Examples:
|
|
24
|
+
|
|
23
25
|
- Dependency choices (add library vs implement directly)
|
|
24
26
|
- Conflicts with existing codebase patterns
|
|
25
27
|
- Implementation choices the design didn't specify
|
|
@@ -28,11 +30,13 @@ Turn a design doc into a step-by-step implementation plan through codebase explo
|
|
|
28
30
|
- If in doubt, ask. The cost of asking is low; the cost of a wrong assumption is high.
|
|
29
31
|
|
|
30
32
|
**Don't ask — just decide:**
|
|
33
|
+
|
|
31
34
|
- Internal details covered by project conventions (file naming, export patterns)
|
|
32
35
|
- YAGNI decisions (not mentioned = don't add)
|
|
33
36
|
- Implementation details with only one reasonable option
|
|
34
37
|
|
|
35
38
|
**Writing the plan:**
|
|
39
|
+
|
|
36
40
|
- Break into independent tasks
|
|
37
41
|
- Include exact file paths, complete code, exact commands with expected output
|
|
38
42
|
- Never write "add validation" — write the actual validation code
|
|
@@ -61,6 +65,7 @@ Turn a design doc into a step-by-step implementation plan through codebase explo
|
|
|
61
65
|
### Task N: [Component Name]
|
|
62
66
|
|
|
63
67
|
**Files:**
|
|
68
|
+
|
|
64
69
|
- Create: `exact/path/to/file.ts`
|
|
65
70
|
- Modify: `exact/path/to/existing.ts:123-145`
|
|
66
71
|
- Test: `exact/path/to/test.spec.ts`
|
|
@@ -76,7 +81,7 @@ test("specific behavior", () => {
|
|
|
76
81
|
|
|
77
82
|
**Step 2: Run test to verify it fails**
|
|
78
83
|
|
|
79
|
-
Run: `
|
|
84
|
+
Run: `npx vitest exact/path/to/test.spec.ts --project=node`
|
|
80
85
|
Expected: FAIL with "fn is not defined"
|
|
81
86
|
|
|
82
87
|
**Step 3: Write minimal implementation**
|
|
@@ -89,7 +94,7 @@ export function fn(input: string): string {
|
|
|
89
94
|
|
|
90
95
|
**Step 4: Run test to verify it passes**
|
|
91
96
|
|
|
92
|
-
Run: `
|
|
97
|
+
Run: `npx vitest exact/path/to/test.spec.ts --project=node`
|
|
93
98
|
Expected: PASS
|
|
94
99
|
|
|
95
100
|
**Step 5: Commit**
|
|
@@ -134,8 +139,9 @@ You can start from any step or skip steps as needed.
|
|
|
134
139
|
- Do NOT auto-proceed. Wait for user's choice.
|
|
135
140
|
|
|
136
141
|
**Yolo mode:** Execute all steps sequentially.
|
|
142
|
+
|
|
137
143
|
- Each `/sd-*` step MUST be invoked via the Skill tool
|
|
138
|
-
- NEVER execute underlying commands (git,
|
|
144
|
+
- NEVER execute underlying commands (git, npm, etc.) directly, even if you know what the skill does internally
|
|
139
145
|
- If a step fails, stop and report — do not attempt manual recovery
|
|
140
146
|
|
|
141
147
|
**Yolo sd-check:** NEVER check only modified packages. Trace reverse dependencies and include all affected paths.
|
|
@@ -240,8 +240,8 @@ Done!
|
|
|
240
240
|
Between batches, run targeted verification on affected packages before starting the next batch:
|
|
241
241
|
|
|
242
242
|
```bash
|
|
243
|
-
|
|
244
|
-
|
|
243
|
+
npm run typecheck [affected packages]
|
|
244
|
+
npm run lint [affected packages]
|
|
245
245
|
```
|
|
246
246
|
|
|
247
247
|
This catches cross-task integration issues early — especially when the next batch depends on the current batch's output. Do NOT skip this even if individual task reviews passed.
|
|
@@ -249,6 +249,7 @@ This catches cross-task integration issues early — especially when the next ba
|
|
|
249
249
|
## Red Flags
|
|
250
250
|
|
|
251
251
|
**Never:**
|
|
252
|
+
|
|
252
253
|
- Start implementation on main/master without explicit user consent
|
|
253
254
|
- Skip reviews (spec compliance OR code quality)
|
|
254
255
|
- Proceed with unfixed issues
|
|
@@ -262,16 +263,19 @@ This catches cross-task integration issues early — especially when the next ba
|
|
|
262
263
|
- Use `run_in_background: true` on Task calls (use foreground parallel instead)
|
|
263
264
|
|
|
264
265
|
**If task agent returns questions:**
|
|
266
|
+
|
|
265
267
|
- Answer clearly and completely
|
|
266
268
|
- Re-launch that agent with answers included
|
|
267
269
|
- Other parallel agents continue unaffected
|
|
268
270
|
|
|
269
271
|
**If reviewers find issues:**
|
|
272
|
+
|
|
270
273
|
- Task agent fixes all issues from both reviewers at once
|
|
271
274
|
- Re-review only the failed aspects (parallel sub-Tasks)
|
|
272
275
|
- Repeat until both approved
|
|
273
276
|
|
|
274
277
|
**If task agent fails or times out:**
|
|
278
|
+
|
|
275
279
|
- Do NOT silently proceed — the affected files may be in an indeterminate state
|
|
276
280
|
- Check if other tasks in the same batch depend on the failed task's output
|
|
277
281
|
- Independent tasks' results still stand
|
|
@@ -281,6 +285,7 @@ This catches cross-task integration issues early — especially when the next ba
|
|
|
281
285
|
## Integration
|
|
282
286
|
|
|
283
287
|
**Related skills:**
|
|
288
|
+
|
|
284
289
|
- **sd-plan** — creates the plan this skill executes
|
|
285
290
|
- **sd-tdd** — task agents follow TDD
|
|
286
291
|
- **sd-worktree** — branch isolation for worktree-based workflows
|
|
@@ -14,7 +14,9 @@ You are reviewing code quality for a completed implementation.
|
|
|
14
14
|
|
|
15
15
|
Use git diff to review only what changed:
|
|
16
16
|
```
|
|
17
|
+
|
|
17
18
|
git diff [BASE_SHA]..[HEAD_SHA]
|
|
19
|
+
|
|
18
20
|
```
|
|
19
21
|
BASE_SHA: [commit before task started]
|
|
20
22
|
HEAD_SHA: [implementer's commit SHA from report]
|
|
@@ -38,8 +38,8 @@ Individual tasks already passed spec and quality reviews. Focus on cross-task in
|
|
|
38
38
|
### Verification
|
|
39
39
|
|
|
40
40
|
Run and report results:
|
|
41
|
-
- `
|
|
42
|
-
- `
|
|
41
|
+
- `npm run typecheck [affected packages]`
|
|
42
|
+
- `npm run lint [affected packages]`
|
|
43
43
|
|
|
44
44
|
### Report
|
|
45
45
|
|
|
@@ -39,7 +39,9 @@ README.md is the **sole API documentation source for Claude Code**. When Claude
|
|
|
39
39
|
## Installation
|
|
40
40
|
|
|
41
41
|
## Main Modules
|
|
42
|
+
|
|
42
43
|
### {Category matching index.ts #region}
|
|
44
|
+
|
|
43
45
|
- Description + code examples per export
|
|
44
46
|
|
|
45
47
|
## Types
|
|
@@ -50,6 +52,7 @@ README.md is the **sole API documentation source for Claude Code**. When Claude
|
|
|
50
52
|
### docs/ Subfolder Rules
|
|
51
53
|
|
|
52
54
|
When README exceeds ~500 lines, split detailed documentation into `docs/`:
|
|
55
|
+
|
|
53
56
|
- README.md becomes an **overview/index** with links: `[functionName](docs/category.md#anchor)`
|
|
54
57
|
- docs/ files contain detailed descriptions, full code examples, parameter tables
|
|
55
58
|
- File organization follows index.ts `#region` (e.g., `docs/types.md`, `docs/utils.md`)
|
|
@@ -83,14 +86,15 @@ Map each documented item to its current documentation content.
|
|
|
83
86
|
|
|
84
87
|
Compare export map (Step 2) against documentation map (Step 3):
|
|
85
88
|
|
|
86
|
-
| Status
|
|
87
|
-
|
|
88
|
-
| **ADDED**
|
|
89
|
-
| **REMOVED** | In README but no longer exported
|
|
89
|
+
| Status | Meaning |
|
|
90
|
+
| ----------- | ------------------------------------ |
|
|
91
|
+
| **ADDED** | Exported in source but not in README |
|
|
92
|
+
| **REMOVED** | In README but no longer exported |
|
|
90
93
|
| **CHANGED** | Both exist but API signature differs |
|
|
91
|
-
| **OK**
|
|
94
|
+
| **OK** | Documentation matches source |
|
|
92
95
|
|
|
93
96
|
**Report to user before editing:**
|
|
97
|
+
|
|
94
98
|
```
|
|
95
99
|
ADDED (3):
|
|
96
100
|
- strToCamelCase (from utils/str.ts)
|
|
@@ -131,6 +135,7 @@ When `$ARGUMENTS` is empty:
|
|
|
131
135
|
2. Launch **parallel subagents** (`subagent_type: "general-purpose"`, `model: "sonnet"`) — one per package + one for project root:
|
|
132
136
|
|
|
133
137
|
**Per-package subagent prompt template:**
|
|
138
|
+
|
|
134
139
|
```
|
|
135
140
|
Update README.md for package {pkg-name} at {pkg-path}.
|
|
136
141
|
|
|
@@ -160,6 +165,7 @@ STEPS:
|
|
|
160
165
|
```
|
|
161
166
|
|
|
162
167
|
**Project root subagent prompt:**
|
|
168
|
+
|
|
163
169
|
```
|
|
164
170
|
Update the project root README.md at {project-root}/README.md.
|
|
165
171
|
Read CLAUDE.md for project context.
|
|
@@ -172,14 +178,14 @@ Report what was changed.
|
|
|
172
178
|
|
|
173
179
|
## Common Mistakes
|
|
174
180
|
|
|
175
|
-
| Mistake
|
|
176
|
-
|
|
177
|
-
| Skipping exports with @internal JSDoc | Document ALL exports — Claude Code doesn't read JSDoc
|
|
178
|
-
| Rewriting OK sections
|
|
179
|
-
| Ignoring existing docs/ structure
|
|
180
|
-
| Arbitrary section reorganization
|
|
181
|
-
| Missing import paths in examples
|
|
182
|
-
| Writing in Korean
|
|
183
|
-
| Adding changelog sections
|
|
184
|
-
| Editing before reporting diff
|
|
185
|
-
| Destroying docs/ link format
|
|
181
|
+
| Mistake | Fix |
|
|
182
|
+
| ------------------------------------- | ------------------------------------------------------------------- |
|
|
183
|
+
| Skipping exports with @internal JSDoc | Document ALL exports — Claude Code doesn't read JSDoc |
|
|
184
|
+
| Rewriting OK sections | Only touch ADDED/REMOVED/CHANGED items |
|
|
185
|
+
| Ignoring existing docs/ structure | If docs/ exists, update those files too |
|
|
186
|
+
| Arbitrary section reorganization | Follow index.ts `#region` structure |
|
|
187
|
+
| Missing import paths in examples | Always: `import { X } from "@simplysm/..."` |
|
|
188
|
+
| Writing in Korean | README must be in English |
|
|
189
|
+
| Adding changelog sections | Never add version history |
|
|
190
|
+
| Editing before reporting diff | Always report ADDED/REMOVED/CHANGED and wait for confirmation |
|
|
191
|
+
| Destroying docs/ link format | If README uses `[name](docs/file.md#anchor)`, preserve that pattern |
|
|
@@ -23,6 +23,7 @@ Analyzes code via the `sd-explore` skill, then runs up to 4 subagents in paralle
|
|
|
23
23
|
- When onboarding to unfamiliar code and want a quality overview
|
|
24
24
|
|
|
25
25
|
**When NOT to use:**
|
|
26
|
+
|
|
26
27
|
- Single-file or trivial changes (typo, config tweak)
|
|
27
28
|
- When you need code modifications (sd-review is analysis-only)
|
|
28
29
|
|
|
@@ -37,12 +38,12 @@ Analyzes code via the `sd-explore` skill, then runs up to 4 subagents in paralle
|
|
|
37
38
|
|
|
38
39
|
Run subagents in parallel via the Task tool:
|
|
39
40
|
|
|
40
|
-
| Agent Type
|
|
41
|
-
|
|
42
|
-
| `sd-code-reviewer`
|
|
43
|
-
| `sd-code-simplifier`
|
|
44
|
-
| `sd-api-reviewer`
|
|
45
|
-
| `sd-security-reviewer`
|
|
41
|
+
| Agent Type | Role | Condition |
|
|
42
|
+
| ---------------------- | --------------------------------------------------- | ---------------------------------------------------------- |
|
|
43
|
+
| `sd-code-reviewer` | Bugs, security, logic errors, convention issues | Always |
|
|
44
|
+
| `sd-code-simplifier` | Complexity, duplication, readability issues | Always |
|
|
45
|
+
| `sd-api-reviewer` | DX/usability, naming, type hints | Always |
|
|
46
|
+
| `sd-security-reviewer` | ORM SQL injection, input validation vulnerabilities | When target path contains ORM queries or service endpoints |
|
|
46
47
|
|
|
47
48
|
## Workflow
|
|
48
49
|
|
|
@@ -69,7 +70,7 @@ Run subagents **in parallel** via the Task tool. Include the sd-explore analysis
|
|
|
69
70
|
- **sd-code-reviewer**: Based on the analysis, find bugs, security vulnerabilities, logic errors, and convention issues. Each finding must include **file:line** and **evidence**.
|
|
70
71
|
- **sd-code-simplifier**: Based on the analysis, find unnecessary complexity, code duplication, and readability issues. Each finding must include **file:line** and **evidence**. **No code modifications.**
|
|
71
72
|
- **sd-api-reviewer**: Based on the analysis, review API intuitiveness, naming consistency, type hints, error messages, and configuration complexity. Each finding must include **file:line** and **evidence**.
|
|
72
|
-
- **sd-security-reviewer**
|
|
73
|
+
- **sd-security-reviewer** _(conditional)_: If the sd-explore analysis reveals ORM queries (`orm-common`, `orm-node`, query builders, `expr.eq`, `.where()`, `.result()`) or service endpoints (`ServiceServer`, RPC handlers), also dispatch this agent. Based on the analysis, find SQL injection risks, missing input validation, and unvalidated user input reaching ORM queries. Each finding must include **file:line** and **evidence**.
|
|
73
74
|
|
|
74
75
|
### Step 3: Verify Issues
|
|
75
76
|
|
|
@@ -86,15 +87,15 @@ Compile only **verified findings** into a comprehensive report.
|
|
|
86
87
|
|
|
87
88
|
### Report Structure
|
|
88
89
|
|
|
89
|
-
| Section
|
|
90
|
-
|
|
91
|
-
| **Architecture Summary**
|
|
92
|
-
| **Critical Issues**
|
|
93
|
-
| **Security Issues**
|
|
94
|
-
| **Quality Issues**
|
|
95
|
-
| **DX/Usability Issues**
|
|
96
|
-
| **Simplification Opportunities** | P3
|
|
97
|
-
| **Convention Issues**
|
|
90
|
+
| Section | Priority | Source |
|
|
91
|
+
| -------------------------------- | -------- | --------------------------------------------------------------- |
|
|
92
|
+
| **Architecture Summary** | — | sd-explore analysis |
|
|
93
|
+
| **Critical Issues** | P0 | Bugs, security vulnerabilities |
|
|
94
|
+
| **Security Issues** | P0 | SQL injection, input validation (when sd-security-reviewer ran) |
|
|
95
|
+
| **Quality Issues** | P1 | Logic errors, missing error handling, performance |
|
|
96
|
+
| **DX/Usability Issues** | P2 | API intuitiveness, naming, type hints |
|
|
97
|
+
| **Simplification Opportunities** | P3 | Complexity removal, duplicate code, abstractions |
|
|
98
|
+
| **Convention Issues** | P4 | Project convention mismatches |
|
|
98
99
|
|
|
99
100
|
Each issue includes **file:line**, **description**, and **suggestion**.
|
|
100
101
|
|
|
@@ -102,11 +103,11 @@ Optionally include an **Invalid Findings Summary** appendix showing which findin
|
|
|
102
103
|
|
|
103
104
|
## Common Mistakes
|
|
104
105
|
|
|
105
|
-
| Mistake
|
|
106
|
-
|
|
107
|
-
| Using git diff to limit review scope | Review ALL source files under target path
|
|
108
|
-
| Skipping verification step
|
|
109
|
-
| Reporting unverified issues
|
|
106
|
+
| Mistake | Fix |
|
|
107
|
+
| ------------------------------------ | --------------------------------------------------- |
|
|
108
|
+
| Using git diff to limit review scope | Review ALL source files under target path |
|
|
109
|
+
| Skipping verification step | Always verify subagent findings against actual code |
|
|
110
|
+
| Reporting unverified issues | Only include verified findings in final report |
|
|
110
111
|
|
|
111
112
|
## Completion Criteria
|
|
112
113
|
|