developer-agent-skills 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 Agent Skills Pack Contributors
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,127 @@
1
+ # Developer Agent Skills 🤖⚡
2
+
3
+ A production-ready collection of essential **AI Agent Skills** for software developers and web engineering workflows, designed for dual consumption:
4
+ 1. **As an AI Skills repository** using `npx skills add AdnanIqbalKhan/developer-agent-skills` (Claude Code, Cursor, Antigravity, GitHub Copilot, Codex, etc.).
5
+ 2. **As an NPM package & CLI** via `npm install developer-agent-skills` or `npx developer-agent-skills`.
6
+
7
+ ---
8
+
9
+ ## ⚡ Option 1: Install via AI Skills CLI (`npx skills add`)
10
+
11
+ To install skills directly into your project's AI agent environment using the standard `skills` CLI:
12
+
13
+ ```bash
14
+ # Add all skills from this repository to your project
15
+ npx skills add AdnanIqbalKhan/developer-agent-skills
16
+
17
+ # Add a specific skill from this repository
18
+ npx skills add AdnanIqbalKhan/developer-agent-skills/code-review
19
+ npx skills add AdnanIqbalKhan/developer-agent-skills/figma
20
+ npx skills add AdnanIqbalKhan/developer-agent-skills/git-branch-report
21
+ npx skills add AdnanIqbalKhan/developer-agent-skills/project-docs-sync
22
+ npx skills add AdnanIqbalKhan/developer-agent-skills/ui-visual-feedback-loop
23
+ ```
24
+
25
+ ---
26
+
27
+ ## 📦 Option 2: Install via NPM Package & CLI (`npx developer-agent-skills`)
28
+
29
+ ### Via `npx` (No installation needed):
30
+
31
+ ```bash
32
+ # List all bundled skills
33
+ npx developer-agent-skills list
34
+
35
+ # Install skills into default project folder (.agents/skills)
36
+ npx developer-agent-skills install
37
+
38
+ # Install skills for specific agent targets
39
+ npx developer-agent-skills install --agent claude # installs into .claude/skills
40
+ npx developer-agent-skills install --agent cursor # installs into .cursor/skills
41
+ npx developer-agent-skills install --agent codex # installs into .codex/skills
42
+ npx developer-agent-skills install --agent antigravity # installs into .gemini/skills
43
+
44
+ # Install specific skills only
45
+ npx developer-agent-skills install --skills code-review,git-branch-report
46
+ ```
47
+
48
+ *Binary aliases available*: `npx developer-agent-skills`, `npx developer-skills`, `npx agent-skills`, `npx skills-pack`.
49
+
50
+ ### Via NPM Dependency:
51
+
52
+ ```bash
53
+ npm install developer-agent-skills
54
+ ```
55
+
56
+ ```javascript
57
+ const { getSkills, getSkillPath, installSkills } = require('developer-agent-skills');
58
+
59
+ // Programmatically discover or copy skills
60
+ const skills = getSkills();
61
+ installSkills({ targetDir: './.agents/skills' });
62
+ ```
63
+
64
+ ---
65
+
66
+ ## 🛠 Included Skills Catalog
67
+
68
+ | Skill Name | Description | Location |
69
+ | :--- | :--- | :--- |
70
+ | **`code-review`** | Audits code changes from Git ranges or ticket branches and produces priority-sorted review reports. | `skills/code-review/SKILL.md` |
71
+ | **`figma`** | Inspects Figma URLs directly in Chrome DevTools MCP, extracting layout/tokens without API quota limits. | `skills/figma/SKILL.md` |
72
+ | **`git-branch-report`** | Generates detailed Markdown diff reports for any Git branch compared with a base branch. | `skills/git-branch-report/SKILL.md` |
73
+ | **`project-docs-sync`** | Audits and synchronizes whole-project documentation with the live codebase. | `skills/project-docs-sync/SKILL.md` |
74
+ | **`ui-visual-feedback-loop`** | Unified visual verification loop using Chrome DevTools MCP or automated Playwright screenshot diffing. | `skills/ui-visual-feedback-loop/SKILL.md` |
75
+
76
+ ---
77
+
78
+ ## 📂 Repository Structure
79
+
80
+ ```text
81
+ developer-agent-skills/
82
+ ├── bin/
83
+ │ └── cli.js # Executable CLI tool for npx developer-agent-skills
84
+ ├── skills/ # Root skills directory for npx skills add
85
+ │ ├── code-review/ # Skill folder
86
+ │ │ ├── SKILL.md # Standard YAML frontmatter + instructions
87
+ │ │ ├── references/
88
+ │ │ └── scripts/
89
+ │ ├── figma/
90
+ │ │ ├── SKILL.md
91
+ │ │ └── references/
92
+ │ ├── git-branch-report/
93
+ │ │ ├── SKILL.md
94
+ │ │ └── scripts/
95
+ │ ├── project-docs-sync/
96
+ │ │ ├── SKILL.md
97
+ │ │ └── scripts/
98
+ │ └── ui-visual-feedback-loop/
99
+ │ ├── SKILL.md
100
+ │ ├── references/
101
+ │ └── scripts/
102
+ ├── index.js # Dynamic Node.js module API
103
+ ├── package.json # NPM manifest & bin declarations
104
+ ├── LICENSE # MIT License
105
+ └── README.md # Documentation
106
+ ```
107
+
108
+ ---
109
+
110
+ ## 🚢 Publishing to NPM
111
+
112
+ ```bash
113
+ # Verify package tarball
114
+ npm pack --dry-run
115
+
116
+ # Test publish payload
117
+ npm publish --dry-run
118
+
119
+ # Publish to NPM registry
120
+ npm publish --access public
121
+ ```
122
+
123
+ ---
124
+
125
+ ## 📄 License
126
+
127
+ [MIT](LICENSE) © Developer Agent Skills Contributors
package/bin/cli.js ADDED
@@ -0,0 +1,104 @@
1
+ #!/usr/bin/env node
2
+
3
+ const path = require('path');
4
+ const fs = require('fs');
5
+ const { getSkills, installSkills } = require('../index');
6
+
7
+ const args = process.argv.slice(2);
8
+ const command = args[0] || 'help';
9
+
10
+ function printHelp() {
11
+ console.log(`
12
+ 🤖 Developer AI Agent Skills CLI
13
+
14
+ Usage:
15
+ npx developer-agent-skills <command> [options]
16
+ npx developer-skills <command> [options]
17
+ npx agent-skills <command> [options]
18
+
19
+ Commands:
20
+ list List all packaged skills and their descriptions
21
+ install [target-dir] Install skills into a project directory (default: .agents/skills)
22
+ export <target-dir> Export skills folder to a target directory
23
+ help Show this help message
24
+
25
+ Options:
26
+ --agent <agent-type> Preset directory for specific agents:
27
+ claude -> .claude/skills
28
+ codex -> .codex/skills
29
+ cursor -> .cursor/skills
30
+ antigravity -> .gemini/skills
31
+ all -> .agents/skills (default)
32
+ --skills <name1,name2> Comma-separated list of specific skills to install
33
+
34
+ Examples:
35
+ npx developer-agent-skills list
36
+ npx developer-skills install
37
+ npx developer-skills install --agent claude
38
+ npx agent-skills install ./custom-skills-dir
39
+ `);
40
+ }
41
+
42
+ function parseFlags(argsList) {
43
+ const flags = { agent: null, skills: null, positional: [] };
44
+ for (let i = 0; i < argsList.length; i++) {
45
+ const arg = argsList[i];
46
+ if (arg === '--agent' && i + 1 < argsList.length) {
47
+ flags.agent = argsList[++i];
48
+ } else if (arg === '--skills' && i + 1 < argsList.length) {
49
+ flags.skills = argsList[++i].split(',').map(s => s.trim());
50
+ } else if (!arg.startsWith('--')) {
51
+ flags.positional.push(arg);
52
+ }
53
+ }
54
+ return flags;
55
+ }
56
+
57
+ function resolveAgentTargetDir(agentType, userProvidedDir) {
58
+ if (userProvidedDir) return userProvidedDir;
59
+ switch (agentType?.toLowerCase()) {
60
+ case 'claude': return '.claude/skills';
61
+ case 'codex': return '.codex/skills';
62
+ case 'cursor': return '.cursor/skills';
63
+ case 'antigravity': return '.gemini/skills';
64
+ default: return '.agents/skills';
65
+ }
66
+ }
67
+
68
+ switch (command) {
69
+ case 'list': {
70
+ console.log('\n📦 Available Developer AI Agent Skills:\n');
71
+ const skills = getSkills();
72
+ skills.forEach((skill, index) => {
73
+ console.log(` ${index + 1}. \x1b[36m${skill.name}\x1b[0m`);
74
+ console.log(` ${skill.description}`);
75
+ console.log(` \x1b[90mPath: ${skill.dir}\x1b[0m\n`);
76
+ });
77
+ break;
78
+ }
79
+
80
+ case 'install':
81
+ case 'export': {
82
+ const flags = parseFlags(args.slice(1));
83
+ const rawTarget = flags.positional[0];
84
+ const targetDir = resolveAgentTargetDir(flags.agent, rawTarget);
85
+
86
+ console.log(`\n🚀 Installing skills into \x1b[34m${targetDir}\x1b[0m...`);
87
+ const result = installSkills({
88
+ targetDir,
89
+ skills: flags.skills
90
+ });
91
+
92
+ console.log(`\x1b[32m✔ Successfully installed ${result.installed.length} skills:\x1b[0m`);
93
+ result.installed.forEach(name => console.log(` - ${name}`));
94
+ console.log(`\n📍 Location: ${result.targetDir}\n`);
95
+ break;
96
+ }
97
+
98
+ case 'help':
99
+ case '--help':
100
+ case '-h':
101
+ default:
102
+ printHelp();
103
+ break;
104
+ }
package/index.js ADDED
@@ -0,0 +1,119 @@
1
+ const fs = require('fs');
2
+ const path = require('path');
3
+
4
+ const SKILLS_DIR = path.join(__dirname, 'skills');
5
+
6
+ /**
7
+ * Parse simple YAML frontmatter from SKILL.md
8
+ */
9
+ function parseFrontmatter(content) {
10
+ const match = content.match(/^---\r?\n([\s\S]*?)\r?\n---/);
11
+ if (!match) return {};
12
+ const frontmatter = {};
13
+ const lines = match[1].split('\n');
14
+ for (const line of lines) {
15
+ const colonIdx = line.indexOf(':');
16
+ if (colonIdx > 0) {
17
+ const key = line.slice(0, colonIdx).trim();
18
+ let value = line.slice(colonIdx + 1).trim();
19
+ if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) {
20
+ value = value.slice(1, -1);
21
+ }
22
+ frontmatter[key] = value;
23
+ }
24
+ }
25
+ return frontmatter;
26
+ }
27
+
28
+ /**
29
+ * Get list of available skills dynamically from the skills/ directory.
30
+ */
31
+ function getSkills() {
32
+ if (!fs.existsSync(SKILLS_DIR)) return [];
33
+ const entries = fs.readdirSync(SKILLS_DIR, { withFileTypes: true });
34
+ const skills = [];
35
+
36
+ for (const entry of entries) {
37
+ if (entry.isDirectory()) {
38
+ const dirName = entry.name;
39
+ const skillPath = path.join(SKILLS_DIR, dirName);
40
+ const skillFilePath = path.join(skillPath, 'SKILL.md');
41
+
42
+ let name = dirName;
43
+ let description = '';
44
+
45
+ if (fs.existsSync(skillFilePath)) {
46
+ const content = fs.readFileSync(skillFilePath, 'utf8');
47
+ const fm = parseFrontmatter(content);
48
+ if (fm.name) name = fm.name;
49
+ if (fm.description) description = fm.description;
50
+ }
51
+
52
+ skills.push({
53
+ name,
54
+ description,
55
+ dir: `skills/${dirName}`,
56
+ path: skillPath,
57
+ skillFilePath
58
+ });
59
+ }
60
+ }
61
+
62
+ return skills;
63
+ }
64
+
65
+ /**
66
+ * Get path of a specific skill by name.
67
+ */
68
+ function getSkillPath(skillName) {
69
+ const available = getSkills();
70
+ const found = available.find(s => s.name === skillName);
71
+ return found ? found.path : null;
72
+ }
73
+
74
+ /**
75
+ * Copy directory recursively.
76
+ */
77
+ function copyDirSync(src, dest) {
78
+ if (!fs.existsSync(dest)) {
79
+ fs.mkdirSync(dest, { recursive: true });
80
+ }
81
+ const entries = fs.readdirSync(src, { withFileTypes: true });
82
+ for (const entry of entries) {
83
+ const srcPath = path.join(src, entry.name);
84
+ const destPath = path.join(dest, entry.name);
85
+ if (entry.isDirectory()) {
86
+ copyDirSync(srcPath, destPath);
87
+ } else {
88
+ fs.copyFileSync(srcPath, destPath);
89
+ }
90
+ }
91
+ }
92
+
93
+ /**
94
+ * Install bundled skills into target directory.
95
+ */
96
+ function installSkills({ targetDir, skills, overwrite = true }) {
97
+ const resolvedTarget = path.resolve(targetDir);
98
+ const available = getSkills();
99
+ const toInstall = skills
100
+ ? available.filter(s => skills.includes(s.name))
101
+ : available;
102
+
103
+ const installed = [];
104
+ for (const skill of toInstall) {
105
+ const destSkillDir = path.join(resolvedTarget, skill.name);
106
+ if (fs.existsSync(destSkillDir) && !overwrite) {
107
+ continue;
108
+ }
109
+ copyDirSync(skill.path, destSkillDir);
110
+ installed.push(skill.name);
111
+ }
112
+ return { installed, targetDir: resolvedTarget };
113
+ }
114
+
115
+ module.exports = {
116
+ getSkills,
117
+ getSkillPath,
118
+ installSkills
119
+ };
package/package.json ADDED
@@ -0,0 +1,48 @@
1
+ {
2
+ "name": "developer-agent-skills",
3
+ "version": "1.0.0",
4
+ "description": "Essential AI Agent Skills for software developers and web engineering workflows: code review, UI visual feedback loops, Figma DevTools inspection, git branch reporting, and project docs sync.",
5
+ "main": "index.js",
6
+ "bin": {
7
+ "developer-agent-skills": "bin/cli.js",
8
+ "developer-skills": "bin/cli.js",
9
+ "agent-skills": "bin/cli.js",
10
+ "skills-pack": "bin/cli.js"
11
+ },
12
+ "repository": {
13
+ "type": "git",
14
+ "url": "git+https://github.com/AdnanIqbalKhan/developer-agent-skills.git"
15
+ },
16
+ "bugs": {
17
+ "url": "https://github.com/AdnanIqbalKhan/developer-agent-skills/issues"
18
+ },
19
+ "homepage": "https://github.com/AdnanIqbalKhan/developer-agent-skills#readme",
20
+ "keywords": [
21
+ "developer-agent-skills",
22
+ "developer-skills",
23
+ "agent-skills",
24
+ "skills",
25
+ "ai-agent",
26
+ "claude-code",
27
+ "antigravity",
28
+ "cursor",
29
+ "codex",
30
+ "copilot",
31
+ "code-review",
32
+ "figma",
33
+ "ui-feedback"
34
+ ],
35
+ "license": "MIT",
36
+ "files": [
37
+ "bin",
38
+ "index.js",
39
+ "skills",
40
+ "README.md",
41
+ "LICENSE"
42
+ ],
43
+ "scripts": {
44
+ "test": "node bin/cli.js list",
45
+ "list": "node bin/cli.js list",
46
+ "install-skills": "node bin/cli.js install"
47
+ }
48
+ }
@@ -0,0 +1,107 @@
1
+ ---
2
+ name: code-review
3
+ description: Review code changes from explicit commit SHAs/ranges or from the current Git branch by selecting commits whose subjects start with the branch-derived ticket name, ignoring branch version suffixes such as v2/v3. Use when Codex is asked to perform a code review, review branch commits, review a ticket branch, audit changed code, or create a priority-sorted issue report from commits.
4
+ ---
5
+
6
+ # Code Review
7
+
8
+ ## Overview
9
+
10
+ Produce an actionable code-review report for a Git branch or explicit commit target. Default to reviewing only commits in the current branch whose commit subject starts with the branch-derived ticket name; if the user provides commit SHAs or a Git range, review exactly that target instead.
11
+
12
+ ## Target Selection
13
+
14
+ 1. If the user supplies one or more commit SHAs, refs, or ranges, use those exactly and skip branch-name filtering.
15
+ 2. Otherwise, derive the ticket prefix from the current branch:
16
+ - Split branch names on `/` and inspect segments from right to left.
17
+ - Ignore version-only segments like `v2`, `v3`, `v10`.
18
+ - Strip trailing version suffixes like `-v2`, `_v3`, `.v4`.
19
+ - Prefer a ticket-like token such as `ABC-123` when present; otherwise use the cleaned branch segment.
20
+ 3. Select commits reachable from `HEAD` but not the target base branch whose subject starts with the ticket prefix. If the branch tracks its own remote counterpart, do not use that upstream as the base; fall back to `origin/main`, `origin/master`, `origin/develop`, `main`, `master`, or `develop`, or use the user-provided `--base`. Match case-insensitively.
21
+ 4. If no matching commits are found, do not silently broaden scope. Report the derived ticket prefix and ask for an explicit commit/range or base branch.
22
+
23
+ Use the bundled script to make this deterministic. It attempts `git pull --ff-only` before collecting context, skips the pull if the working tree is dirty, and records a warning if pull fails:
24
+
25
+ ```bash
26
+ python scripts/collect_review_context.py --repo . --output /tmp/code-review-context.md
27
+ ```
28
+
29
+ Examples:
30
+
31
+ ```bash
32
+ # Review explicit commits/range supplied by the user
33
+ python scripts/collect_review_context.py --repo . --commit abc123 --commit def456 --output /tmp/code-review-context.md
34
+ python scripts/collect_review_context.py --repo . --range origin/main..HEAD --output /tmp/code-review-context.md
35
+
36
+ # Review branch commits using a specific base when needed
37
+ python scripts/collect_review_context.py --repo . --base origin/main --output /tmp/code-review-context.md
38
+
39
+ # After user approves the filtered list, review a selected subset by 1-based index
40
+ python scripts/collect_review_context.py --repo . --select 1 --output /tmp/code-review-context.md
41
+ python scripts/collect_review_context.py --repo . --select 2-6 --output /tmp/code-review-context.md
42
+ ```
43
+
44
+ ## Review Workflow
45
+
46
+ 1. Run `collect_review_context.py` from the repository root with `--no-diff` to produce the filtered commit list first. Let it try `git pull --ff-only` before collecting context. If pull fails or is skipped, continue and note the warning when asking for approval. Pass explicit commits/ranges when the user provided them.
47
+ 2. Show the filtered commits to the user and ask which commits to review before reading diffs or writing the report. Do not proceed until the user approves a selection. Accept `all`, one number such as `1`, a comma list such as `1,3,5`, or an inclusive range such as `2-6`.
48
+ 3. Run `collect_review_context.py` again with the approved selection, e.g. `--select all`, `--select 1`, or `--select 2-6`, and without `--no-diff` unless the user only wants the commit list.
49
+ 4. Read the generated context file, then inspect changed files directly as needed with `git show`, `git diff`, `git blame`, and targeted source-file reads.
50
+ 5. Focus on changed behavior and changed interfaces. Verify claims against the diff and current codebase.
51
+ 6. Read `references/review-rubric.md` before writing the final report.
52
+ 7. Produce a report that first lists the selected commits, then lists issues sorted by priority from highest to lowest. Include only findings that are actionable and supported by changed code.
53
+
54
+ ## Report Format
55
+
56
+ Use this structure:
57
+
58
+ ```markdown
59
+ # Code Review Report
60
+
61
+ ## Scope
62
+ - Branch: `<branch>`
63
+ - Base: `<base or explicit target>`
64
+ - Ticket prefix: `<derived prefix or n/a>`
65
+ - Commits reviewed: `<count>`
66
+
67
+ ## Selected Commits
68
+ | # | SHA | Subject |
69
+ |---:|---|---|
70
+ | 1 | `<short-sha>` | `<commit subject>` |
71
+
72
+ ## Summary
73
+ <one short paragraph>
74
+
75
+ ## Issues
76
+ ### P0 Critical
77
+ - None, or issue entries
78
+
79
+ ### P1 High
80
+ - None, or issue entries
81
+
82
+ ### P2 Medium
83
+ - None, or issue entries
84
+
85
+ ### P3 Low
86
+ - None, or issue entries
87
+ ```
88
+
89
+ Issue entries must include:
90
+
91
+ ```markdown
92
+ - **[P1 High] Short title** — `path/to/file.ext:line` (`commit-sha`)
93
+ - **Problem:** What is wrong.
94
+ - **Impact:** Why it matters.
95
+ - **Recommendation:** Concrete fix direction.
96
+ ```
97
+
98
+ Always include the `Selected Commits` table using the commits from the generated context. If there are no selected commits, write `No commits selected.` in that section.
99
+
100
+ If there are no issues, say `No actionable issues found in the reviewed commits.`
101
+
102
+ ## Constraints
103
+
104
+ - Do not modify repository files during the review unless the user explicitly asks for fixes. The only default exception is the preflight `git pull --ff-only` attempt; never create merge commits during this pull.
105
+ - Do not review unrelated commits when branch filtering finds no ticket-prefixed commits; ask for an explicit target instead.
106
+ - Do not include style-only nits unless they indicate a real defect or maintainability risk.
107
+ - Keep report ordering strictly P0, P1, P2, P3.
@@ -0,0 +1,4 @@
1
+ interface:
2
+ display_name: "Code Review"
3
+ short_description: "Review branch commits by priority"
4
+ default_prompt: "Use $code-review to review this branch and write a priority-sorted issue report."
@@ -0,0 +1,38 @@
1
+ # Review Rubric
2
+
3
+ Load this before writing the final report.
4
+
5
+ ## Priority order
6
+
7
+ - **P0 Critical**: Introduces a likely outage, data loss, security/privacy breach, payment/order corruption, authentication bypass, or broken build/runtime startup for a core path.
8
+ - **P1 High**: Definite functional regression in a normal user/admin flow, incorrect persisted state, SSR/client crash, API contract break, broken navigation, or high-confidence performance issue with user-visible impact.
9
+ - **P2 Medium**: Edge-case defect, incomplete error handling, race condition, accessibility regression with meaningful impact, maintainability issue likely to create bugs soon, or moderate performance degradation.
10
+ - **P3 Low**: Minor correctness risk, confusing code path, small maintainability concern, or low-impact UX issue. Avoid noisy nit-only findings.
11
+
12
+ ## Finding quality bar
13
+
14
+ Only include a finding when all are true:
15
+
16
+ 1. The issue is introduced or exposed by the reviewed commits.
17
+ 2. The report can point to a changed file and approximate line or hunk.
18
+ 3. The impact is concrete, not speculative.
19
+ 4. The recommendation is specific enough for an engineer to act on.
20
+
21
+ ## Review checklist
22
+
23
+ Prioritize these areas while reading the diff:
24
+
25
+ - Runtime crashes: null/undefined access, missing imports, wrong exports, bad async assumptions, SSR/browser API misuse.
26
+ - Data correctness: wrong IDs, wrong filters, incorrect state transitions, stale caches, lost user input, incorrect totals/prices/availability.
27
+ - API boundaries: request/response shape mismatches, unhandled non-2xx responses, missing loading/error states, backward-incompatible changes.
28
+ - Security and privacy: exposed secrets, unsafe redirects, injection, auth/permission bypass, sensitive data leaks.
29
+ - Routing and UX flows: broken links, forms that cannot submit, redirects to invalid routes, inaccessible controls that block completion.
30
+ - Performance: repeated expensive work in render paths, unbounded fetches, large unnecessary payloads, avoidable re-renders in hot components.
31
+ - Maintainability: duplicated branching that can diverge, fragile assumptions, dead paths in changed logic, unclear ownership of side effects.
32
+
33
+ ## Output discipline
34
+
35
+ - Sort by P0, P1, P2, then P3.
36
+ - Within each priority, list higher confidence and higher impact first.
37
+ - Prefer fewer high-quality findings over broad commentary.
38
+ - If no issues meet the bar, state that no actionable issues were found.