tiagoyoko/bmad-code-review
.agents/skills/bmad-code-review/SKILL.md
Perform adversarial code review finding specific issues. Use when the user says "run code review" or "review this code"
development
Updated Apr 15, 2026
$ install --global
skillsauthnpx skillsauth add tiagoyoko/BPO_MANAGER bmad-code-reviewInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 12:00 AM22.8s1 file scanned
SKILL.md
- name:
- bmad-code-review
- description:
- Perform adversarial code review finding specific issues. Use when the user says "run code review" or "review this code
IT IS CRITICAL THAT YOU FOLLOW THIS COMMAND: LOAD the FULL {project-root}/_bmad/bmm/workflows/4-implementation/code-review/workflow.md, READ its entire contents and follow its directions exactly!
ADDITIONAL PROJECT RULE: when the workflow concludes with story status done, you MUST execute the workflow's git completion steps end-to-end: commit the completed work and merge it into the default branch. Do not stop after updating story status/sprint tracking.
TypeScript (bpo360-app / Next.js)
When reviewing TypeScript, Next.js API routes, or React code in this repo:
- Consult the Mastering Modern TypeScript skill (
/mastering-typescriptor the skill atmastering-typescript/SKILL.md): use it to assess type safety, use ofany/unknown, validation at boundaries (Zod),satisfiesvs type assertions, strict mode and index access, and toolchain (ESLint, Prettier). - Check alignment with bpo360-app conventions: API responses via
jsonSuccess/jsonError, request body validation withparseBodyand schemas fromsrc/lib/api/schemas/, no rawas unknown ason Supabase data without a mapper, and consistency withdocs/typescript-recommendations.mdwhere applicable.
Related Skills
tiagoyoko/bmad-technical-research
business
VerifiedTrustedCommunity
Conduct technical research on technologies and architecture. Use when the user says "create a technical research report on [topic]".
SKILL.mdUpdated Apr 15, 2026
tiagoyoko/bmad-tech-writer
documentation
VerifiedTrustedCommunity
tech-writer agent
SKILL.mdUpdated Apr 15, 2026
tiagoyoko/bmad-teach-me-testing
testing
VerifiedTrustedCommunity
Teach testing progressively through structured sessions. Use when user says "lets learn testing" or "I want to study test practices"
SKILL.mdUpdated Apr 15, 2026
tiagoyoko/bmad-sprint-status
testing
VerifiedTrustedCommunity
Summarize sprint status and surface risks. Use when the user says "check sprint status" or "show sprint status"
SKILL.mdUpdated Apr 15, 2026