.claude/skills/code-quality-standards/SKILL.md
Code quality standards, code smells catalog, and refactoring patterns. Use when writing new code, reviewing code quality, refactoring existing code, or fixing bugs — to check naming clarity, function size, DRY/SOLID compliance, error handling, and complexity. Do NOT use for security audits or architecture reviews.
npx skillsauth add softmg/product-tracker code-quality-standardsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Purpose: Define code quality standards, best practices, and refactoring patterns.
Code is read 10x more than written. Optimize for reading.
// ✅ Good - Self-explanatory
function calculateMonthlyPayment(principal, rate, months)
return (principal * rate) / (1 - pow(1 + rate, -months))
// ❌ Bad - Unclear
function calc(p, r, m)
return (p * r) / (1 - pow(1 + r, -m))
// ✅ Good - Small, focused
function validateEmail(email)
return isValidEmailFormat(email)
function validatePassword(password)
return length(password) >= 8 AND hasUpperCase(password) AND hasDigit(password)
function validateUser(user)
return validateEmail(user.email) AND validatePassword(user.password)
// ❌ Bad - Too long, does multiple things
function validateUser(user)
// 50+ lines of validation logic
// ❌ Bad - Duplication
function getActiveUsers()
return filter(users, u => u.status == 'active' AND u.deletedAt == null)
function getActivePosts()
return filter(posts, p => p.status == 'active' AND p.deletedAt == null)
// ✅ Good - Extracted common logic
function isActive(item)
return item.status == 'active' AND item.deletedAt == null
function getActiveUsers()
return filter(users, isActive)
function getActivePosts()
return filter(posts, isActive)
// ✅ Good - Simple and clear
function isEven(n)
return n % 2 == 0
// ❌ Bad - Over-engineered
function isEven(n)
return (n & 1 == 0) ? true : false
Don't add functionality until it's needed.
// ❌ Bad - Unused complexity
User:
name
email
phone // Maybe we'll need it later?
fax // Just in case?
twitter // Why not?
// ✅ Good - Only what's needed now
User:
name
email
Smell: Function > 30 lines
Refactor: Extract smaller functions
Smell: Class with too many responsibilities
Refactor: Split into smaller classes (SRP)
Smell: Function with 4+ parameters
Refactor: Use object parameter or builder pattern
// ❌ Bad
function createUser(name, email, age, address, phone)
// ✅ Good
CreateUserParams:
name
email
age
address
phone
function createUser(params: CreateUserParams)
Smell: Same code in multiple places
Refactor: Extract to shared function/class
Smell: Using primitives instead of small objects
Refactor: Create value objects
// ❌ Bad
function sendEmail(email: String)
// No validation, easy to pass invalid email
// ✅ Good
Email:
value: String
constructor(emailString)
if NOT isValidEmail(emailString)
throw Error('Invalid email')
this.value = emailString
function isValidEmail(email)
return matchesEmailPattern(email)
function toString()
return this.value
function sendEmail(email: Email)
// Email is guaranteed to be valid
Smell: Method uses data from another class more than its own
Refactor: Move method to the other class
Smell: Unused functions, variables, imports
Refactor: Remove it
// ✅ Good - Specific error types
ValidationError extends Error:
constructor(message)
super(message)
this.name = 'ValidationError'
try:
validateUser(user)
catch error:
if error is ValidationError:
// Handle validation errors
else:
// Handle other errors
// ❌ Bad - Generic errors
try:
validateUser(user)
catch error:
log('Error:', error)
// ✅ Good - Explicit null handling
function getUser(id): User or null
return find(users, u => u.id == id) or null
user = getUser('123')
if user is not null:
print(user.name)
// ❌ Bad - Implicit nulls
function getUser(id): User
return find(users, u => u.id == id)
user = getUser('123')
print(user.name) // Potential crash if null
// ✅ Good - Immutable (create new object)
updatedUser = copyWithChanges(user, { name: 'New Name' })
// ❌ Bad - Mutation (modify existing object)
user.name = 'New Name'
// ✅ Good - Pure function
function add(a, b)
return a + b
// ❌ Bad - Side effects
total = 0
function add(a, b)
total = total + a + b // Modifies external state
return total
Before refactoring:
During refactoring:
After refactoring:
// High complexity (many branches)
function processOrder(order)
if order.status == 'pending':
if order.total > 1000:
if order.customer.vip:
// ...
else:
// ...
else:
// ...
else if order.status == 'shipped':
// ...
// ... more branches
// Better - Use polymorphism or strategy pattern
When reviewing code for quality:
Split long method into smaller ones
Use descriptive names
// Before: if (age > 18)
LEGAL_AGE = 18
if (age > LEGAL_AGE)
Replace long parameter lists with objects
Replace if/switch with class hierarchy
Note: These standards should be applied consistently across the codebase. Agents should reference this skill when writing, reviewing, or refactoring code.
documentation
Task tracking and plan management. Used by planner to create plans and persist tasks, by orchestrator to read tasks and update progress, by documenter to create completion reports, and by any agent to log non-critical issues.
development
Create, edit, evaluate, and package agent skills. Use when building a new skill from scratch, improving an existing skill, running evals to test a skill, benchmarking skill performance, optimizing a skill's description for better triggering, reviewing third-party skills for quality, or packaging skills for distribution. Not for using skills or general coding tasks.
development
Simple implementation workflow - code, test, document. Use when user invokes /implement, wants to create code with automatic testing and documentation, or for simple single-purpose tasks that don't need planning.
development
Security best practices covering authentication, input validation, API security, secrets management, data protection, and OWASP Top 10. Use when implementing auth flows, API endpoints, file uploads, or any feature touching passwords, tokens, PII, or sensitive data. Do NOT use for code style reviews or architecture decisions.