🔍代码审查 / GitHub MCP 推荐

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

Use when developing or modifying the @handsontable/react-wrapper package - React components, hooks, settings mapping, selection preservation during updateSettings, and the wrapper's TypeScript prop types and generated .d.ts. Use this whenever a task touches HotTableProps/HotColumnProps typing or IDE autocomplete for <HotTable>/<HotColumn> props, the declaration build, or a report that React/TypeScript users get no prop suggestions - even if the wrapper is not named explicitly.

Refactor 主入口。触发：优化/重构/拆分/性能/代码太长，且不改变行为、不新增需求。不要用于新增功能(cs-feat)、修复 bug(cs-issue)、对外文档(cs-docs)、大需求拆解(cs-epic)。

Used to review whether an Apache ShardingSphere PR truly fixes the root cause, assess side effects and regression risks, and judge code correctness or mergeability from public evidence. If not mergeable, produce committer-tone change requests or needs-discussion feedback when the PR direction, root-cause model, or problem framing should be reopened. Also use for GitHub-visible PR discussion, review comments, challenged findings, and copy-ready committer replies where review correctness, mergeability, change-request validity, or root-cause evidence is being judged. Supports full-coverage ledger review for high-risk or explicitly anti-drip requests, and self-iterates before final output.

Analyze Agent Host debug log exports. Use when given an ah-logs or ahp-logs zip/folder, an Export Agent Host Debug Logs bundle, events.jsonl, AHP JSONL transport logs, Agent Host.log, remote-agenthost.log, or copilot-logs.

Find and read timestamped process logs from Code OSS dev builds, including main.log, renderer.log, extension host logs, and agenthost.log. For bundles produced by Export Agent Host Debug Logs, use agent-host-logs.

Run a comprehensive code review

Authors engineering blog posts end-to-end: launch deep-dives, incident postmortems, architecture migrations, performance case studies, tutorials, AI/agent system writeups, security disclosures, and research-to-product translations. Picks the correct archetype, plans the abstraction ladder, enforces an evidence cadence (diagrams, benchmarks, profiles, traces, code, ablations), tunes voice against publisher house styles (Datadog, Vercel, GitHub, AWS, Meta, Cloudflare, Jane Street), and runs a pre-publish gate for narrative momentum and disclosure ethics. Use when drafting a new engineering post, restructuring a draft that feels flat, deciding which evidence form belongs where, validating that depth and product context are balanced, or preparing a postmortem, migration, or performance narrative for external publication. Do not use for API reference documentation, README authoring, marketing copy, release notes, generic SEO content, ghost-written executive thought leadership, or non-engineering long-form essays.

Author, refactor, and debug agent skills. Use when creating a new skill from scratch, pruning or restructuring a bloated SKILL.md, tightening a skill description's triggers, or diagnosing bundled references the agent ignores. Don't use for agent instruction files like CLAUDE.md or AGENTS.md (use agent-md-refactor), general documentation, or READMEs.

Audits a codebase for refactoring opportunities using Martin Fowler's code smell and technique catalog — long functions, duplication, high coupling, complex conditionals, primitive obsession — and writes a prioritized report to docs/_refacs/. Use when auditing code quality, planning a refactoring sprint, or reviewing architectural health; not for style/formatting, performance, or security audits.

Testing doctrine for tests that reveal bugs instead of passing for the wrong reason — spanning software and LLM/AI systems. Use when authoring or reviewing tests, adding a mock, deciding where a test belongs, letting a coding agent generate tests, triaging flaky CI, designing an eval suite for an LLM/agent feature, or rebuilding a brittle suite. Not for general code review, library debugging unrelated to tests, CI pipeline design beyond tests, or production observability.

Master TypeScript's advanced type system including generics, conditional types, mapped types, template literals, and utility types for building type-safe applications. Use when implementing complex type logic, creating reusable type utilities, or ensuring compile-time type safety in TypeScript projects. Don't use for plain JavaScript, runtime validation libraries (Zod, Yup), or basic TypeScript syntax questions.

Use when the user asks for a security review of a pull request, commit, branch diff, working-tree patch, or other Git-backed change set.

Use for a standard, single-pass security audit of an entire repository or a scoped path, package folder, or submodule with no diff to review. This is the default repository scan. Do not use for PR/commit/branch/working-tree diffs, or for deep, multi-pass, or variance-reducing scans.

Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, input-schema validation, official-SDK usage, RCE vectors, and the OWASP MCP Top 10 — producing a report with file/line evidence. Use this skill when: - Reviewing an MCP server implementation for security before release - Checking a server against the baseline controls (MCP-01 to MCP-05) and the OWASP MCP Top 10 - Auditing tools for RCE vectors (command/code injection, unsafe deserialization, path traversal, SSTI, dependency hijacking, SSRF) - Verifying auth, session, rate-limiting, and input-validation controls on a network-exposed server - Reviewing MCP client code that handles untrusted server responses and session IDs - Requests like "review this MCP server for security" or "is my MCP server implementation secure?"

Use when Review self-improvement automation runs and activation policy.

Use when writing or running end-to-end tests for a Shiny for Python (py-shiny) app - launching an app under pytest, locating and asserting on UI components (inputs, outputs, cards, navsets), simulating user interaction with Playwright, or when tempted to hand-roll CSS selectors, raw Playwright locators, or sleep() waits against Shiny-rendered HTML.

Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from websites, take screenshots, fill forms, click buttons, or interact with web applications. Supports remote Browserbase sessions with Browserbase Identity, Verified browsers, automatic CAPTCHA solving, and residential proxies — ideal for protected websites and JavaScript-heavy pages.

Transform monolithic Terraform configurations into reusable, maintainable modules following HashiCorp's module design principles and community best practices.

Write secure, optimized database queries using parameterized statements, eager loading, proper indexing, and transaction management. Use this skill when writing database queries, implementing data fetching logic, optimizing query performance, preventing SQL injection, handling N+1 query problems, using ORMs or query builders, implementing caching strategies, or managing database transactions. Apply when working with SQL queries, ORM query methods, database repository patterns, or any code that retrieves or manipulates data from databases.

Define database models and ORM entities with proper naming, relationships, validation, and data integrity constraints. Use this skill when creating or modifying model classes, database table definitions, model relationships (one-to-many, many-to-many), data validation rules, database constraints, or model methods. Apply when working with ORM model files, ActiveRecord, SQLAlchemy, Sequelize, Prisma schemas, or any database model definitions that map objects to database tables and enforce data structure and relationships.

Expert TypeScript/Node.js developer for building high-quality, performant, and maintainable CLI tools and libraries. Enforces best practices, strict typing, and modern patterns.

Write secure, performant, and optimized database queries using parameterized queries, eager loading, proper indexing, and transaction management. Use this skill when writing database queries in controllers, repositories, services, or model methods, when using query builders or ORM methods, when implementing filtering/sorting/pagination logic, when optimizing N+1 query problems with eager loading, when working with joins and complex queries, when implementing query caching, or when wrapping related operations in database transactions.

Define and configure database models with proper naming, relationships, timestamps, data types, constraints, and validation. Use this skill when creating or editing model files in app/Models/, Eloquent model classes, model relationships (hasMany, belongsTo, etc.), database table structures, model attributes and casts, model factories, or seeders. Use when working on model validation logic, database constraints, foreign key relationships, indexes, scopes, accessors, mutators, or any ORM-related model configuration.

Create reversible, focused database migrations with proper naming, version control practices, and zero-downtime deployment considerations. Use this skill when creating or editing migration files in database/migrations/, when writing schema changes (creating/modifying tables, columns, indexes, foreign keys), when implementing migration rollback methods, when managing database version control, when adding or modifying indexes on large tables, or when separating schema changes from data migrations for safer deployments.

Cursorでclaude-memのMCPサーバーにアクセスし、過去のセッション記録を検索・新しい観測を記録。トリガー: 'メモリ検索', 'claude-mem', '過去の判断', '記録して', 'memory search', 'past decisions'. Do NOT load for: 通常のコーディング、一時的なメモ、実装作業。

Local Next.js docs index for this repo (.next-docs/). Use for ANY Next.js-related work in apps/web - routing, layouts, pages, app router, server/client components, server actions, caching, revalidation, metadata, route handlers, proxy/middleware, next.config, images, fonts, error handling, loading states, parallel/intercepting routes, dynamic routes, useRouter/usePathname/useSearchParams, cookies/headers, redirects, deployment, upgrades. Read the relevant .mdx files before implementing or debugging Next.js behavior; do not rely on training data.

Repository-specific guidance for the AI code review agent reviewing this repo

Guide for writing PostHog agent skills — job-to-be-done templates that teach agents how to use MCP tools to achieve a goal. Use when adding new product functionality that agents should know how to work with, creating a new skill, or updating existing skills in products/*/skills/.

Use when researching React APIs or concepts for documentation. Use when you need authoritative usage examples, caveats, warnings, or errors for a React feature.

Debug React Native apps including metro bundler issues, native errors, performance problems, and crash analysis. Use when troubleshooting errors or investigating issues.

Pedantic backend pre-commit and atomic commit Skill for Django/Optimo-style repos. Enforces local AGENTS.md / CLAUDE.md, pre-commit hooks, .security/* helpers, and Monty’s backend engineering taste – with no AI signatures in commit messages.

TypeScript project conventions: derived types, type placement, acronym casing, imports, generics, factories, and runtime schema patterns. Use when editing `.ts` files, defining exported types, reviewing type names, or organizing type tests.

Diagnose SQL database in Fabric performance via sqlcmd against Query Store, DMVs, sys.dm_db_resource_stats, and Extended Events on the OLTP endpoint. Identifies the top resource-consuming, slowest, or most expensive queries and handles query-performance ranking, blocking-chain, missing-index, and plan-regression diagnostics. For routine data queries use the sqldb-consumption-cli skill; for schema changes use the sqldb-authoring-cli skill. Triggers: "query store slow query analysis sqldb top queries", "top resource-consuming queries from query store sqldb", "slowest queries sql database in Fabric query store", "most expensive queries sqldb query store", "sql database in Fabric blocked sessions head blocker chain sqlcmd", "sqldb missing index recommendation", "sqldb regressed plan instability sqlcmd", "sqldb extended events trace".

Query SQL database in Fabric via sqlcmd: interactive exploration, vector similarity, JSON, temporal queries, and security policy inspection on the OLTP and SQL analytics endpoints. For schema changes see the sqldb-authoring-cli skill. Triggers: "sql database in Fabric query sys.tables sqlcmd", "sql database in Fabric system view list user tables sqlcmd", "list user tables sqldb", "sys.tables sqldb", "explore sqldb schema", "vector similarity sqldb", "RAG embedding sqldb", "row level security sqldb inspect", "audit log sqldb inspect", "chat with sqldb", "export sqldb rows", "temporal as of sqldb", "json openrowset sqldb".

Create and manage SQL database in Fabric items, author T-SQL DDL/DML with constraints, foreign keys, triggers, indexes, and vector columns. Deploy schema via SqlPackage (.dacpac/.bacpac), configure source control, CI/CD, and GraphQL APIs. Triggers: "sql database in Fabric create table sqlcmd ddl", "sql database in Fabric primary key default getdate sqlcmd", "create sqldb item", "create table sqldb ddl", "sqldb foreign key constraint", "sqldb stored procedure", "sqldb trigger create", "sqldb vector column", "SqlPackage dacpac deploy sqldb", "bacpac sqldb", "sqldb source control", "graphql api sqldb", "sqldb collation set", "sp_invoke_external_rest_endpoint".

Pedantic Diversio backend dev workflow Skill that enforces ClickUp-linked branch/PR naming, PR hygiene, safe Django migrations, and downtime-safe schema changes for Django4Lyfe-style backends.

Reference for writing and editing skills well — the vocabulary and principles that make a skill predictable.

Optimize Next.js 15 applications for performance, Core Web Vitals, and production best practices using App Router patterns

Scaffolds evaluation suites for the Axiom AI SDK. Generates eval files, scorers, flag schemas, and config from natural-language descriptions. Use when creating evals, writing scorers, setting up flag schemas, or configuring axiom.config.ts.

Automation and verification guide for running Native SDK apps. Use when the user asks to test a running app, inspect runtime state, list windows, wait for readiness, drive widgets, take deterministic screenshots, send bridge commands, debug why automation is not connected, create smoke tests, or verify a Native SDK example in a GUI-capable session.

Coding standards, conventions, and patterns for developing Python code in the Agent Framework repository. Use this when writing or modifying Python source files in the python/ directory.

Review code for common issues. Use when reviewing PRs, suggesting code changes, or when user asks to review code.

Apply the Lightdash frontend style guide when working on React components, migrating Mantine v6 to v8, or styling frontend code. Use when editing TSX files, fixing styling issues, or when user mentions Mantine, styling, or CSS modules.

GitHub CLI for issues, PRs, CI/check logs, comments, reviews, releases, repos, and gh api queries.

Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates.