@tinkcarlos/skillora 0.2.0

package/.claude/skills/code-review/references/review-dimensions.md

@@ -0,0 +1,311 @@
+# Review Dimensions - Detailed Criteria
+
+Deep dive into each review dimension with specific patterns to identify.
+
+## 1. Correctness
+
+### Logic Verification
+- **Control flow** - All branches reachable and correct?
+- **Loop termination** - Infinite loop risks?
+- **Null safety** - Null/undefined handling complete?
+- **Type safety** - Type coercion issues?
+- **Edge cases** - Empty arrays, zero values, max values?
+
+### Common Bugs to Catch
+```typescript
+// Off-by-one errors
+for (let i = 0; i <= arr.length; i++)  // 🚫 Should be <
+
+// Mutation of shared state
+const defaults = { a: 1 };
+function init(opts) {
+  Object.assign(defaults, opts);  // 🚫 Mutates shared object
+}
+
+// Async race conditions
+let data;
+async function load() {
+  data = await fetch();  // 🚫 Race if called multiple times
+}
+
+// Floating point comparison
+if (0.1 + 0.2 === 0.3)  // 🚫 False due to floating point
+```
+
+### Verification Questions
+1. What happens with empty input?
+2. What happens with null/undefined?
+3. What happens at boundaries (0, -1, MAX_INT)?
+4. What happens with concurrent access?
+5. What happens if dependencies fail?
+
+## 2. Security
+
+### OWASP Top 10 Checks
+
+| Vulnerability | What to Look For |
+|--------------|------------------|
+| Injection | Unsanitized input in queries/commands |
+| Broken Auth | Missing/weak session management |
+| Sensitive Data | Plaintext storage, weak encryption |
+| XXE | External entity processing enabled |
+| Access Control | Missing authorization checks |
+| Misconfig | Debug enabled, default credentials |
+| XSS | Unescaped user input in output |
+| Deserialization | Untrusted data deserialization |
+| Components | Known vulnerable dependencies |
+| Logging | Insufficient audit trails |
+
+### Security Anti-Patterns
+```typescript
+// SQL Injection
+db.query(`SELECT * FROM users WHERE id = ${userId}`);  // 🚫
+
+// Command Injection  
+exec(`ls ${userPath}`);  // 🚫
+
+// XSS
+element.innerHTML = userInput;  // 🚫
+
+// Hardcoded secrets
+const API_KEY = "sk-1234567890";  // 🚫
+
+// Weak crypto
+crypto.createHash('md5');  // 🚫 Use SHA-256+
+
+// Missing auth check
+app.get('/admin/users', (req, res) => {
+  // 🚫 No authorization check
+  return getAllUsers();
+});
+```
+
+## 3. Performance
+
+### Time Complexity Red Flags
+```typescript
+// O(n²) when O(n) possible
+arr.filter(x => arr2.includes(x));  // 🚫 Use Set
+
+// O(n) when O(1) possible
+if (largeArray.length > 0)  // ✅ O(1)
+if (largeArray.find(x => x))  // 🚫 O(n)
+
+// Repeated expensive operations
+items.map(i => expensiveOp(i)).filter(Boolean).map(transform);  
+// 🚫 Should combine into single pass
+```
+
+### Database Performance
+```typescript
+// N+1 Query
+users.forEach(async u => {
+  u.posts = await db.posts.find({ userId: u.id });  // 🚫
+});
+// ✅ Batch: const posts = await db.posts.find({ userId: { $in: userIds } })
+
+// Missing index usage
+db.find({ createdAt: { $gt: date }, status: 'active' });
+// Check: Is there a compound index on (createdAt, status)?
+
+// Over-fetching
+const user = await db.users.findOne(id);  // Fetches all fields
+// ✅ const user = await db.users.findOne(id, { select: ['name', 'email'] })
+```
+
+### React Performance
+```typescript
+// Missing dependency in useEffect
+useEffect(() => { fetch(url) }, []);  // 🚫 Missing url
+
+// Inline object causing re-renders
+<Component style={{ color: 'red' }} />  // 🚫 New object every render
+
+// Missing React.memo for expensive components
+export function ExpensiveList({ items }) {  // 🚫 Should memoize
+
+// State updates in render
+function Component() {
+  setCount(count + 1);  // 🚫 Infinite loop
+}
+```
+
+## 4. Maintainability
+
+### Code Smells
+| Smell | Indicator | Solution |
+|-------|-----------|----------|
+| Long Function | >50 lines | Extract into smaller functions |
+| Deep Nesting | >3 levels | Guard clauses, early returns |
+| God Class | Too many responsibilities | Split by domain |
+| Feature Envy | Method uses other class more | Move method |
+| Magic Values | Unexplained literals | Named constants |
+| Dead Code | Unreachable/unused code | Remove |
+| Duplicate Code | Copy-paste patterns | Extract and reuse |
+
+### Naming Quality
+```typescript
+// Bad naming
+const d = new Date();  // 🚫 What date?
+const arr = [];  // 🚫 Array of what?
+function process(data) {}  // 🚫 Process how?
+
+// Good naming
+const registrationDeadline = new Date();  // ✅
+const pendingOrders = [];  // ✅
+function validateAndSubmitOrder(orderData) {}  // ✅
+```
+
+### Error Handling
+```typescript
+// Swallowed errors
+try { riskyOp() } catch (e) {}  // 🚫
+
+// Generic catch without context
+catch (error) { throw error; }  // 🚫 Add context
+
+// Missing error types
+throw new Error('Failed');  // 🚫 Use specific error class
+
+// ✅ Good error handling
+try {
+  await submitOrder(order);
+} catch (error) {
+  logger.error('Order submission failed', { orderId: order.id, error });
+  throw new OrderSubmissionError(order.id, error);
+}
+```
+
+## 5. Architecture
+
+### SOLID Principles Check
+
+| Principle | Question |
+|-----------|----------|
+| **S**ingle Responsibility | Does this class/function do one thing? |
+| **O**pen/Closed | Can we extend without modifying? |
+| **L**iskov Substitution | Can subtypes replace base types? |
+| **I**nterface Segregation | Are interfaces minimal and focused? |
+| **D**ependency Inversion | Do we depend on abstractions? |
+
+### Layer Violations
+```
+Correct: UI → Service → Repository → Database
+Wrong:   UI → Database (bypasses service layer)
+Wrong:   Repository → UI (reverse dependency)
+```
+
+### Dependency Direction
+```typescript
+// 🚫 Feature depending on feature
+import { PaymentService } from '../payment/service';
+
+// ✅ Both depend on shared interface
+import { IPaymentProvider } from '../shared/interfaces';
+```
+
+## 6. Cross-Module Side Effects
+
+### Questions to Ask
+1. Does this change any shared state?
+2. Does this modify any global configuration?
+3. Does this change any event contracts?
+4. Does this affect any cached data?
+5. Does this change any database schemas?
+6. Does this change any API contracts?
+7. Does this affect any background jobs?
+8. Does this change any feature flags?
+
+### Impact Categories
+| Category | What to Check |
+|----------|--------------|
+| State | Redux/Zustand stores, context |
+| Events | Event bus, WebSocket messages |
+| Cache | Redis, local storage, memoization |
+| Database | Schema changes, migrations |
+| API | Request/response shapes, status codes |
+| Config | Environment variables, feature flags |
+| Jobs | Cron jobs, queue processors |
+| External | Third-party integrations |
+
+## 7. Test Quality Review
+
+Beyond "does it have tests", evaluate **test quality** to catch hidden bugs.
+
+### Test Quality Dimensions
+
+| Dimension | Good Test | Bad Test | Why It Matters |
+|-----------|-----------|----------|----------------|
+| **Target** | Behavior/Output | Internal state/implementation | Implementation tests break on refactor |
+| **Naming** | Describes expected behavior | Describes implementation steps | Readable tests serve as documentation |
+| **Independence** | No shared state between tests | Tests depend on execution order | Flaky tests, hard to debug |
+| **Assertion** | User-visible results | Component internals | Tests should verify what users see |
+| **Determinism** | Same result every run | Depends on time/random/network | Flaky tests waste debugging time |
+
+### Test Anti-Patterns to Catch
+
+```typescript
+// 🚫 Testing implementation details
+test('increments counter variable', () => {
+    const component = render(<Counter />);
+    fireEvent.click(component.getByRole('button'));
+    expect(component.state.counter).toBe(1);  // 💀 Testing internal state
+});
+
+// ✅ Testing behavior
+test('displays incremented count when clicked', () => {
+    render(<Counter />);
+    fireEvent.click(screen.getByRole('button', { name: /increment/i }));
+    expect(screen.getByText('Count: 1')).toBeInTheDocument();  // ✅ What user sees
+});
+
+// 🚫 Overly coupled to implementation
+test('calls setState with correct value', () => {
+    const setStateSpy = jest.spyOn(Component.prototype, 'setState');
+    // 💀 Breaks if refactored to hooks
+});
+
+// 🚫 Tests that depend on order
+let sharedData;
+test('first test sets data', () => {
+    sharedData = createData();  // 💀 Pollutes other tests
+});
+test('second test uses data', () => {
+    expect(sharedData).toBeDefined();  // 💀 Fails if run alone
+});
+```
+
+### Test Coverage Quality Checklist
+
+```markdown
+## Test Quality Checklist
+
+### Coverage Quality (not just %)
+- [ ] Happy path tested
+- [ ] Edge cases covered (empty, null, max values)
+- [ ] Error cases tested (network failure, invalid input)
+- [ ] Boundary conditions verified
+- [ ] Async behavior tested correctly
+
+### Test Design
+- [ ] Tests describe behavior, not implementation
+- [ ] Test names are clear and descriptive
+- [ ] Each test verifies ONE thing
+- [ ] Tests are independent (no shared mutable state)
+- [ ] Tests can run in any order
+- [ ] No flaky tests (time/random/network dependent)
+
+### Assertion Quality
+- [ ] Assertions verify user-visible outcomes
+- [ ] Error messages are helpful when tests fail
+- [ ] No overly broad assertions (e.g., `expect(result).toBeTruthy()`)
+```
+
+### Questions for Test Review
+
+1. If this test passes, can we be confident the feature works?
+2. If implementation changes but behavior stays same, will test still pass?
+3. If test fails, will the error message tell us what went wrong?
+4. Can this test ever flake? (time, random, network, order)
+5. Is this testing our code or testing the framework?
+

package/.claude/skills/code-review/references/review-guide.md

@@ -0,0 +1,202 @@
+# Code Review Universal Guide
+
+This document provides cross-project code review patterns, detection methods, and recommendations. Updated periodically by extracting patterns from project-level review records.
+
+---
+
+## Common Issue Pattern Library
+
+### Category 1: Error Handling Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **Silent catch** | Exception caught but not logged/handled | Search for empty catch blocks | Log error context, then handle or rethrow |
+| **Error swallowing** | Returns null/default without indicating failure | Check return paths in error handlers | Use Result type or throw meaningful errors |
+| **Missing error boundary** | UI crashes on component error | Check for error boundaries in React | Wrap risky components with error boundary |
+| **Inconsistent error format** | Different error shapes across APIs | Compare error responses | Standardize error response schema |
+
+### Category 2: Security Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **Missing auth check** | Endpoint accessible without authentication | Check middleware/guards on routes | Add auth middleware to all protected routes |
+| **Insufficient authz** | User can access others' resources | Check resource ownership validation | Verify ownership before operations |
+| **Input not sanitized** | User input used directly in queries/commands | Trace user input flow | Validate and sanitize at entry points |
+| **Secrets in code** | API keys, passwords in source | Search for secret patterns | Use environment variables or secret manager |
+| **Excessive logging** | PII or secrets in log output | Review log statements | Redact sensitive data before logging |
+
+### Category 3: Concurrency Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **Unawaited promise** | Async operation not awaited | Search for promises without await | Ensure all async operations are awaited |
+| **Race condition** | Shared state modified concurrently | Check for shared mutable state | Use locks, queues, or immutable patterns |
+| **Stale closure** | Callback captures old state value | Check useEffect deps, event handlers | Include dependencies, use refs if needed |
+| **Missing cleanup** | Subscriptions/timers not cancelled | Check component unmount handling | Return cleanup function from useEffect |
+
+### Category 4: Data Integrity Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **Missing validation** | Data accepted without checks | Check input boundaries | Validate at system boundaries |
+| **Type coercion bug** | String/number confusion | Check comparison operators | Use strict equality, explicit conversion |
+| **Null dereference** | Access property on null/undefined | Check optional chaining usage | Add null checks or use optional chaining |
+| **State inconsistency** | Related data out of sync | Check transaction boundaries | Use transactions for related changes |
+
+### Category 5: API Contract Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **Breaking change** | Field removed/renamed | Compare before/after API shapes | Version API, deprecate before removal |
+| **Missing field** | Required field not returned | Check API response completeness | Validate response against schema |
+| **Wrong type** | Field type changed | Compare type definitions | Use TypeScript/schema validation |
+| **Undocumented behavior** | Implicit assumptions | Check API documentation | Document all behaviors explicitly |
+
+### Category 6: Performance Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **N+1 query** | Separate query per item in loop | Check database queries in loops | Use batch queries, eager loading |
+| **Missing index** | Slow queries on large tables | Check query plans | Add indexes for filtered/sorted columns |
+| **Unnecessary rerender** | Component rerenders too often | Check React DevTools profiler | Memoize components, optimize deps |
+| **Large bundle** | Importing entire libraries | Check bundle analyzer | Use tree-shaking, dynamic imports |
+
+### Category 7: Resource Management Issues
+
+| Pattern | Typical Finding | Detection | Recommendation |
+|---------|-----------------|-----------|----------------|
+| **Connection leak** | Database connections not closed | Check connection lifecycle | Use connection pools, close in finally |
+| **Memory leak** | Objects retained beyond lifetime | Check for growing memory usage | Clear references, use weak references |
+| **File handle leak** | Files opened but not closed | Check file operations | Use try-finally or with statements |
+| **Event listener leak** | Listeners added but not removed | Check addEventListener calls | Remove listeners on cleanup |
+
+---
+
+## High-Frequency Missed Issues (Top 10)
+
+1. **Unawaited async operations**: Promise started but not awaited
+2. **Missing null checks**: Accessing properties on potentially null values
+3. **Silent error handling**: Catching errors without logging or handling
+4. **Insufficient input validation**: Trusting user input without checks
+5. **Missing authorization checks**: Assuming authentication = authorization
+6. **Stale state in callbacks**: Closures capturing old state values
+7. **Missing cleanup on unmount**: Timers, subscriptions not cancelled
+8. **Breaking API changes**: Removing/renaming fields without versioning
+9. **N+1 database queries**: Per-item queries instead of batch
+10. **Secrets in logs**: Logging sensitive data accidentally
+
+---
+
+## Review Priority Matrix
+
+| Area | Priority | Why |
+|------|----------|-----|
+| **Security** | Highest | Breaches are catastrophic |
+| **Data Integrity** | High | Corruption is hard to recover |
+| **Error Handling** | High | Silent failures mask issues |
+| **API Contracts** | High | Breaking changes affect consumers |
+| **Concurrency** | High | Race conditions are hard to debug |
+| **Performance** | Medium | Usually fixable later |
+| **Resource Management** | Medium | Leaks accumulate over time |
+| **Code Quality** | Lower | Important but not urgent |
+
+---
+
+## Universal Review Checklist
+
+### Quick Check (Every Review)
+
+- [ ] **No security holes**: Auth, authz, input validation, secrets
+- [ ] **No silent failures**: Errors logged and handled
+- [ ] **No null dereferences**: Null checks or optional chaining
+- [ ] **No async bugs**: All promises awaited
+- [ ] **No breaking changes**: API backward compatible
+
+### Deep Check (Complex Changes)
+
+- [ ] **Transaction boundaries**: Related changes atomic
+- [ ] **Cleanup paths**: Resources released on all paths
+- [ ] **Concurrency safety**: No race conditions
+- [ ] **Performance impact**: No N+1, no large imports
+- [ ] **Test coverage**: Critical paths tested
+
+### Integration Check (Cross-System)
+
+- [ ] **API contract matches**: Request/response shapes correct
+- [ ] **Error propagation**: Errors surface correctly
+- [ ] **Timeout handling**: External calls have timeouts
+- [ ] **Retry logic**: Transient failures handled
+
+---
+
+## Pattern Extraction Guide
+
+When you have 5-10 review records in your project's `code-review-record.md`, extract common patterns:
+
+### Step 1: Identify Recurring Themes
+
+Group findings by:
+- Category (security, performance, error handling, etc.)
+- Component/module (auth, API, database, etc.)
+- Root cause (knowledge gap, oversight, complexity)
+
+### Step 2: Abstract to Universal Pattern
+
+Transform project-specific details to generic patterns:
+
+| Project-Specific | Universal Pattern |
+|------------------|-------------------|
+| "Missing authz check in UserController" | "Authorization bypass: endpoint checks auth but not ownership" |
+| "useState not updated in onClick" | "Stale closure: callback captures old state value" |
+| "SQL query in forEach loop" | "N+1 query: per-item database queries instead of batch" |
+
+### Step 3: Document in This Guide
+
+Add new patterns to the appropriate category table above with:
+- Pattern name
+- Typical finding
+- Detection method
+- Recommendation
+
+### Step 4: Update Review Checklist
+
+If the pattern reveals a new check, add it to the appropriate checklist section.
+
+---
+
+## Anti-Patterns in Code Review
+
+| Anti-Pattern | Why It's Harmful | Better Approach |
+|--------------|------------------|-----------------|
+| **Style wars** | Wastes time on preferences | Use automated formatters |
+| **Rubber stamping** | Misses real issues | Follow structured checklist |
+| **Nitpicking only** | Ignores important issues | Prioritize by severity |
+| **Blocking on P3** | Delays valuable changes | Allow P3 as follow-up |
+| **No evidence** | Claims without proof | Quote code with line numbers |
+| **Personal attacks** | Damages team dynamics | Focus on code, not author |
+
+---
+
+## Quick Reference
+
+### When Same Issue Keeps Appearing
+
+1. Check if it's in this guide already
+2. Add to project's code-review-record.md if not
+3. Consider adding to team's review checklist
+4. Discuss in team to address root cause (training, tooling)
+
+### When Unsure if Issue Matters
+
+1. Ask: "What's the worst that could happen?"
+2. Security/data issues → P0/P1
+3. Functionality issues → P1/P2
+4. Style/preference → P3 or skip
+
+### When Author Disagrees
+
+1. Cite evidence (code, docs, standards)
+2. For P0/P1: Escalate if needed
+3. For P2/P3: Document and move on
+4. Focus on impact, not preferences
+