skills/code-quality-reviewer/SKILL.md
Use when the user asks to review code quality, find redundant code, audit duplication, or "clean up" a codebase. Also use when the user says "find issues" or "anything worth fixing" after a feature is built. This skill provides a systematic framework for identifying code quality issues, evaluating whether each fix is worth making, and safely applying changes without over-engineering.
npx skillsauth add luochang212/skills code-quality-reviewerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Systematically review a codebase for quality issues, then evaluate each finding against a concrete benefit/side-effect framework before fixing. The goal is not "perfect" code — it's to find changes that reduce code without reducing readability, and fix correctness issues without introducing risk.
Announce at start: "I'm using the code quality reviewer to audit the codebase."
For every potential fix, ask three questions:
When scanning files, look for these specific patterns:
Lazy that isn't actually lazy-loadeduseCallback that only forwards to another function, a function whose body is just calling another function with the same argumentsuseStar/useUnstar with identical structure differing only in a boolean<div> with a className is not meaningful duplicationconst next = new Set(x); next.has(y) ? next.delete(y) : next.add(y) is clear enough inlineSpawn parallel Explore agents to list files and identify which ones to review. Skip UI primitives (components/ui/), test files, and generated code unless the user asks for them.
Spawn multiple agents in parallel, each reviewing a group of related files. Agents MUST be read-only — they report findings, they do NOT edit. Group files by directory/concern so each agent has context.
Each agent should:
Collect findings from all agents. Group by impact (high/medium/low) and type (code reduction vs. correctness). Present a summary table to the user and ask which they want to fix.
CRITICAL: Fix issues sequentially, NOT in parallel. Two agents editing related files (or the same file) will silently overwrite each other. Parallel fixes to a file edited by multiple agents will lose all but the last write — edits vanish without error.
For each issue the user wants to fix, follow this order strictly:
Never evaluate without a concrete proposal — "this looks duplicated" is not enough. "Extract a 4-line helper function, saving 3 lines" makes the tradeoff visible.
After all fixes are applied, run the full verification suite: type checking and tests. Report what was changed and what was skipped (with reasons).
An useStar and useUnstar hook (each ~18 lines) had identical optimistic update and rollback logic, differing only in the API call and a single boolean value. Extracted a parameterized factory function. Saved ~15 lines, no callers changed, tests passed as-is. Correct: benefit > side effect.
A useCallback whose body only called another function with the same arguments. Replaced the two call sites with the inner function directly. Saved 3 lines and removed an unnecessary memo dependency. Correct: benefit > side effect.
A component was named *Lazy but used a static top-level import with no lazy loading. Renamed to *Panel to reflect reality. Zero line change, fixed misleading name. Correct: fixes correctness issue.
Two dialogs shared a 6-line JSX shell (a flex row with a label and toggle). But their substantive contents (status badges, disabled conditions, data sources) differed significantly. A shared component would need many props to accommodate the differences, saving ~4 lines of JSX while adding a new file and coupling two unrelated components. Correctly skipped: side effect > benefit.
Two adjacent settings cards shared outer layout structure but differed in icon behavior (one changes icon while pending, one doesn't) and disabled conditions. Extracting a shared component would replace inline JSX with a component definition plus props interface, net lines flat or negative. Correctly skipped: premature abstraction.
When multiple agents edit simultaneously:
Safe pattern: parallel reads → sequential writes. Use multiple agents to review code simultaneously (read-only), then apply fixes one at a time from the main conversation.
If you must use agents for fixes, dispatch them one at a time and wait for each to complete before dispatching the next. Or better: do the fixes yourself in the main conversation, since you have the full context.
development
--- name: md-to-pdf description: Use when converting Markdown files (.md) to PDF on macOS, Windows, or Linux, especially files containing CJK (Chinese/Japanese/Korean) text. Triggers include "convert md to pdf", "markdown to pdf", "generate pdf from markdown", "export md as pdf", "md转pdf". Two cross-platform backends: Playwright/Chromium for best quality (default), reportlab for pure-Python lightweight fallback. --- # Markdown to PDF Converter Two cross-platform backends. Choose based on your
development
Create beautiful, self-contained single-file HTML reports, landing pages, and documents that are visual, interactive, and spatial. Use when the user wants to present information that would benefit from layout, color, diagrams, or interaction — such as project reports, product pages, architecture overviews, design documents, dashboards, slide decks, code review summaries, incident post-mortems, status reports, or any document where plain text would be too flat. Triggers include "create an HTML page", "make a report", "write a landing page", "build a dashboard", "present this information visually", or any request to communicate technical or business information in a polished, readable format.
development
Use when the user asks to review code quality, find redundant code, audit duplication, or "clean up" a codebase. Also use when the user says "find issues" or "anything worth fixing" after a feature is built. This skill provides a systematic framework for identifying code quality issues, evaluating whether each fix is worth making, and safely applying changes without over-engineering.
development
Security audit and code scanning. Use when the user asks to scan code for bugs/vulnerabilities, audit security, run SAST, find code patterns, or review code for security issues. Supports two modes — fast pattern scanning (Semgrep) for quick results and CI gating, and deep AI-powered investigation (deepsec) for thorough reasoning-based analysis. Also use when the user mentions "semgrep", "deepsec", "static analysis", "security scan", "code scanning", "find vulnerabilities", "scan my code", or "security audit".