🔍代码审查 / GitHub MCP 推荐

Structured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports.

Build an evidence-backed ECC install plan for a specific repo by sorting skills, commands, rules, hooks, and extras into DAILY vs LIBRARY buckets using parallel repo-aware review passes. Use when ECC should be trimmed to what a project actually needs instead of loading the full bundle.

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

REST API design patterns including resource naming, status codes, pagination, filtering, error responses, versioning, and rate limiting for production APIs.

Next.js 16+ and Turbopack — incremental bundling, FS caching, dev speed, and when to use Turbopack vs webpack.

Thorough code review of branch changes. Supports automatic/interactive fixing, instruction-based, agnostic, or combined review lenses. Use when: review my code, review this branch, do a code review, review branch changes, check my changes. Input: [--base <branch>] [--mode automatic|interactive] [--lens instructions|agnostic|both]

Use when deploying or managing Kubernetes workloads. Invoke to create deployment manifests, configure pod security policies, set up service accounts, define network isolation rules, debug pod crashes, analyze resource limits, inspect container logs, or right-size workloads. Use for Helm charts, RBAC policies, NetworkPolicies, storage configuration, performance optimization, GitOps pipelines, and multi-cluster management.

Docker containerization expert with deep knowledge of multi-stage builds, image optimization, container security, Docker Compose orchestration, and production deployment patterns. Use PROACTIVELY f...

Guide users building apps, scripts, CI pipelines, or automations on top of the Cursor TypeScript SDK (`@cursor/sdk`). Use this skill whenever the user mentions integrating, installing, or writing code against the Cursor SDK; whenever they say `Agent.create`, `Agent.prompt`, `Agent.resume`, `agent.send`, `run.stream`, `CursorAgentError`, or `@cursor/sdk`; whenever they ask to run Cursor agents programmatically from a script, CI/CD pipeline, GitHub Action, backend service, or any other code that isn't the Cursor IDE itself; and whenever they want to pick between local and cloud runtime, configure MCP servers for an SDK agent, or handle streaming, cancellation, or errors from an SDK agent. Also trigger when a user is wiring Cursor into an automation, writing a bot that runs Cursor, or porting REST `/v1/agents` calls to the SDK, even if they don't explicitly name the package. Use this eagerly rather than answering from memory; the SDK surface evolves and this skill plus its references are the source of truth for

When reviewing or fixing Python code that uses setattr() with user-controlled kwargs to configure C++ extension objects (SessionOptions, RunOptions, etc.) in ONNX Runtime. Use this to apply the allowlist pattern that prevents arbitrary file writes and other attacks via reflected property access.

Mobile-first design thinking and decision-making for iOS and Android apps. Touch interaction, performance patterns, platform conventions. Teaches principles, not fixed values. Use when building React Native, Flutter, or native mobile apps.

Refactor Kotlin code toward clearer, more idiomatic design without breaking Spring behavior, serialization, persistence, or public contracts. Use when Java-flavored Kotlin needs cleanup, domain modeling should become more expressive, or boilerplate should be reduced, but the refactoring must remain safe for proxies, Jackson, JPA, configuration binding, and existing tests.

Design reusable 2D character pose libraries, action cycles, and expression states for data-driven animation.

Create, update, and sync Ona automations. Ensures YAML files in .ona/automations/ stay in sync with the live Ona automation registry. Use when creating a new automation, modifying triggers or prompts, deleting an automation, or auditing drift between YAML and live state. Triggers on "create automation", "update automation", "delete automation", "sync automations", "register automation", "automation drift", "add a new automation", "change automation triggers".

Guidance for using external MCP tools safely.

Mobile Text Alerts integration. Manage Accounts. Use when the user wants to interact with Mobile Text Alerts data.

Backendless integration. Manage data, records, and automate workflows. Use when the user wants to interact with Backendless data.

Docker Hub integration. Manage data, records, and automate workflows. Use when the user wants to interact with Docker Hub data.

Cursor integration. Manage data, records, and automate workflows. Use when the user wants to interact with Cursor data.

Yerel geliştirme, konteyner güvenliği, ağ, volume stratejileri ve multi-servis orkestrasyon için Docker ve Docker Compose kalıpları.

用于本地开发的Docker和Docker Compose模式，包括容器安全、网络、卷策略和多服务编排。

Next.js 16+ 和 Turbopack — 增量打包、文件系统缓存、开发速度，以及何时使用 Turbopack 与 webpack。

Next.js 16+ and Turbopack — incremental bundling, FS caching, dev speed, and when to use Turbopack vs webpack.

Use to review code changes with a two-stage process - first checking spec/requirements compliance, then code quality. Works on staged changes, branches, or PRs.

Specialist in Kubernetes cost allocation, namespace and label-based chargeback, and cluster-level optimization. Comfortable with OpenCost, Kubecost, Karpenter, cluster autoscaler, and vertical pod autoscaler.

Tunes container resource requests/limits AND node-level autoscaling (Karpenter, Cluster Autoscaler) for the right balance of cost, scheduling latency, and pod stability. Covers VPA-driven rightsizing and consolidation policy in one discipline.

Configure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates.

MallBase ThinkPHP 后端测试基线；新增、修改或回归后端接口、服务、模型逻辑时使用。

MallBase Vben Admin 后端驱动路由规则；新增或调整后台菜单、权限路由、页面路由和 System 路由映射时使用。

Delegate a task to Cursor's CLI agent (code review, Q&A, planning) for a second opinion from a non-Claude model

Review and improve documentation with parallel evaluation and iterative improvement loop.

Generate a structured refactoring plan for a Cacti package or module. Analyzes current code structure, identifies improvement opportunities, and produces a phased plan with risk assessment.

How to write and manage Cursor rules - invoke with @cursor-usage

TypeScript conventions, React patterns, testing, styling, and import rules for the Opentrons monorepo JS/TS packages. Use when working with TypeScript or React files in app/, components/, shared-data/, step-generation/, protocol-designer/, protocol-visualization/, opentrons-ai-client/, or other JS/TS packages.

Reviews UniGetUI .json language files for localization quality, detects parity issues, English-equal entries, wrong-script content, and cross-language outliers, then generates a dataset for LLM-assisted linguistic review. Use when the user asks to review translations, audit localization, inspect i18n or l10n quality, or validate language files.

Automatically processes TizenFX ai-task issues (dispatching between refactoring/feature modes) and creates a PR.

Automatically scans the TizenFX codebase on a rotating schedule to discover .NET 8 / C# 12+ refactoring targets and register them as GitHub Issues.

Perform a refactor pass focused on simplicity after recent changes. Use when the user asks for a refactor/cleanup pass, simplification, dead-code removal, or says "refactor pass".

Database Connection Troubleshooting

Python Application Memory Troubleshooting

Structural refactoring pass on changed code. Use after implementing a feature to improve code structure, reduce duplication, and clean up APIs without changing behavior.

Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.

Use when defining or reviewing massCode renderer types that come from generated API clients or DTOs, especially when deciding whether to reuse existing API shapes, derive narrower local types, or introduce a UI-only model.

HiMarket 前端（React + TypeScript + Vite）代码规范：Prettier/ESLint、严格 TypeScript、注释与 Fast Refresh、Design Token、Tailwind、验证命令。

refactor 流程的超轻量通道——直接识别 1-3 条低风险优化、一次确认、原地改、跑测试自证。触发：用户说"快速重构"、"小重构"、"简单优化下 XX 函数"、"别那么多步骤"，且改动在单函数 / 单组件局部、有测试可自证。

Add new C# APIs to SkiaSharp by wrapping Skia C++ functionality, or review existing API PRs for correctness and style. Two workflows: (1) Add: C++ analysis → C API → bindings → C# wrapper → tests → review (2) Review: check naming, Span overloads, properties, tests, interop safety. Triggers: - "add DrawFoo method", "expose SkSurface::draw", "wrap sk_foo_bar" - "add API", "expose function", "wrap method", "create binding for" - "review this API", "check the API surface", "review PR #NNN for API design" - Issue classified as "New API" (after fetching and classification)

Use this skill whenever a user wants to transfer, migrate, convert, troubleshoot, or generate commands for moving SQLite 3 schema and data into MySQL or MariaDB using sqlite3mysql. This skill helps gather the required source and connection details, choose a local or Docker workflow, produce safe copy-pasteable commands, and explain sqlite3mysql caveats.

Use this skill when the user wants to css generator for transforming user interfaces from design tokens.