skills/code-quality/SKILL.md
Use when the user asks to review code quality, find redundant code, audit duplication, or "clean up" a codebase. Also use when the user says "find issues" or "anything worth fixing" after a feature is built. This skill provides a systematic framework for identifying code quality issues, evaluating whether each fix is worth making, and safely applying changes without over-engineering.
npx skillsauth add luochang212/skills code-qualityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Systematically review a codebase for quality issues, then evaluate each finding against a concrete benefit/side-effect framework before fixing. The goal is not "perfect" code — it's to find changes that reduce code without reducing readability, and fix correctness issues without introducing risk.
Announce at start: "I'm using the code quality reviewer to audit the codebase."
For every potential fix, ask three questions:
Beyond the three questions, these heuristics help decide edge cases:
Two pieces of code that look the same aren't necessarily duplicates:
await in a loop — lint will flag it, but for...await with break on first error is intentional control flow, not a mistake. Suppress the rule, don't restructure to Promise.all().Don't over-engineer a fix, but don't let rot compound either:
When scanning files, look for these specific patterns:
Lazy that isn't actually lazy-loadeduseCallback that only forwards to another function, a function whose body is just calling another function with the same argumentsuseStar/useUnstar with identical structure differing only in a boolean<div> with a className is not meaningful duplicationconst next = new Set(x); next.has(y) ? next.delete(y) : next.add(y) is clear enough inlineSpawn parallel Explore agents to list files and identify which ones to review. Skip UI primitives (components/ui/), test files, and generated code unless the user asks for them.
Spawn multiple agents in parallel, each reviewing a group of related files. Agents MUST be read-only — they report findings, they do NOT edit. Group files by directory/concern so each agent has context.
Each agent should:
Collect findings from all agents. Group by impact (high/medium/low) and type (code reduction vs. correctness). Present a summary table to the user and ask which they want to fix.
CRITICAL: Fix issues sequentially, NOT in parallel. Two agents editing related files (or the same file) will silently overwrite each other. Parallel fixes to a file edited by multiple agents will lose all but the last write — edits vanish without error.
For each issue the user wants to fix, follow this order strictly:
Never evaluate without a concrete proposal — "this looks duplicated" is not enough. "Extract a 4-line helper function, saving 3 lines" makes the tradeoff visible.
After all fixes are applied, run the full verification suite: type checking and tests. Report what was changed and what was skipped (with reasons).
An useStar and useUnstar hook (each ~18 lines) had identical optimistic update and rollback logic, differing only in the API call and a single boolean value. Extracted a parameterized factory function. Saved ~15 lines, no callers changed, tests passed as-is. Correct: benefit > side effect.
A component was named *Lazy but used a static top-level import with no lazy loading. Renamed to *Panel to reflect reality. Zero line change, fixed misleading name. Correct: fixes correctness issue.
API response type and public command return type had identical fields. Suggested merging into one struct to eliminate a manual .map(). Skipped: keeping API shape and public interface separate prevents upstream API changes from cascading into the command layer. Semantic isolation > mechanical deduplication.
A set of useMutation hooks shared the same query client + cache invalidation pattern. Suggested extracting a factory. Skipped: each hook is 5-6 lines with clearly visible mutation function and invalidation target at the call site. A factory would add type parameters and indirection without reducing meaningful complexity. Explicit > short.
Two dialogs shared a 6-line JSX shell (a flex row with a label and toggle). But their substantive contents (status badges, disabled conditions, data sources) differed significantly. A shared component would need many props to accommodate the differences, saving ~4 lines of JSX while adding a new file and coupling two unrelated components. Side effect > benefit.
Two adjacent settings cards shared outer layout structure but differed in icon behavior (one changes icon while pending, one doesn't) and disabled conditions. Extracting a shared component would replace inline JSX with a component definition plus props interface, net lines flat or negative. Premature abstraction: net zero gain with added indirection.
When multiple agents edit simultaneously:
Safe pattern: parallel reads → sequential writes. Use multiple agents to review code simultaneously (read-only), then apply fixes one at a time from the main conversation.
If you must use agents for fixes, dispatch them one at a time and wait for each to complete before dispatching the next. Or better: do the fixes yourself in the main conversation, since you have the full context.
development
--- name: md-to-pdf description: Use when converting Markdown files (.md) to PDF on macOS, Windows, or Linux, especially files containing CJK (Chinese/Japanese/Korean) text. Triggers include "convert md to pdf", "markdown to pdf", "generate pdf from markdown", "export md as pdf", "md转pdf". Two cross-platform backends: Playwright/Chromium for best quality (default), reportlab for pure-Python lightweight fallback. --- # Markdown to PDF Converter Two cross-platform backends. Choose based on your
development
Create beautiful, self-contained single-file HTML reports, landing pages, and documents that are visual, interactive, and spatial. Use when the user wants to present information that would benefit from layout, color, diagrams, or interaction — such as project reports, product pages, architecture overviews, design documents, dashboards, slide decks, code review summaries, incident post-mortems, status reports, or any document where plain text would be too flat. Triggers include "create an HTML page", "make a report", "write a landing page", "build a dashboard", "present this information visually", or any request to communicate technical or business information in a polished, readable format.
development
Security audit and code scanning. Use when the user asks to scan code for bugs/vulnerabilities, audit security, run SAST, find code patterns, or review code for security issues. Supports two modes — fast pattern scanning (Semgrep) for quick results and CI gating, and deep AI-powered investigation (deepsec) for thorough reasoning-based analysis. Also use when the user mentions "semgrep", "deepsec", "static analysis", "security scan", "code scanning", "find vulnerabilities", "scan my code", or "security audit".
development
AI-powered vulnerability scanning with deepsec. Use when the user asks to audit security, scan for vulnerabilities, run a deep security audit, or review code for security issues. Also use when the user mentions "deepsec", "AI security scan", "agent-powered audit", "deep code audit", or wants to find hard-to-find vulnerabilities that grep/Semgrep would miss. Use for PR security review when the user mentions "review this PR for security" or "check these changes for vulnerabilities". Prefer this over semgrep when the user wants thorough, reasoning-based investigation rather than pattern matching.