[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71944MP9GWJEF74CZTVB2CS":3,"skill-same:01M71944MP9GWJEF74CZTVB2CS":86},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":62,"ownerHtmlUrl":63,"ownerBlogUrl":62,"ownerDescription":64,"updatedAt":65,"install":66,"resources":79},"01M71944MP9GWJEF74CZTVB2CS","code-review",null,"Security-focused code review with 2-pass model. Pass 1 blocks merge (SQL safety, race conditions, LLM trust boundary, security). Pass 2 is informational (dead code, magic numbers, test gaps). Use when reviewing code changes, PRs, or before shipping features. Triggers on 'review code', 'code review', 'check this code', 'is this safe to merge'.","orionfold\u002Frelay","orionfold","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F276500412?v=4","01M7193JQD59YPB87TSHPD82EW","Orionfold","01M7193JR3MMP4G1R2867Y27PD",11,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcode-review\u002FSKILL.md",[18,23,28],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000007","代码审查","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",{"categoryNo":29,"categoryName":30,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000033","数据分析师",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"review","code review","code","when","prs","trust boundary","magic","features","reviewing code","triggers","trust","use","dead code","model","Safety","shipping","sql","merge","security","safe","2026-11-10 10:12:30",false,"---\nname: code-review\ndescription: \"Security-focused code review with 2-pass model. Pass 1 blocks merge (SQL safety, race conditions, LLM trust boundary, security). Pass 2 is informational (dead code, magic numbers, test gaps). Use when reviewing code changes, PRs, or before shipping features. Triggers on 'review code', 'code review', 'check this code', 'is this safe to merge'.\"\n---\n\n# Code Review — 2-Pass Model\n\nReview code changes using a structured 2-pass model. Pass 1 catches merge-blocking issues. Pass 2 surfaces informational findings. Each critical finding uses the one-issue-one-question pattern for clear resolution.\n\n## Setup\n\n1. Load the checklist: read `skills\u002Fcode-review\u002Fchecklist.md` (relative to this skill)\n2. Identify the changes to review (diff, PR, or staged files)\n3. Read all changed files in full (not just the diff — context matters)\n\n## Pass 1: CRITICAL — Blocks Merge\u002FShip\n\nThese findings **must be resolved** before code can merge or ship. Review in this order:\n\n### 1.1 SQL & Data Safety\n- String interpolation in SQL queries (must use parameterized queries)\n- Missing parameterization in Drizzle raw SQL\n- TOCTOU races (time-of-check-time-of-use) in database operations\n- Unvalidated data written to database\n\n### 1.2 Race Conditions\n- Check-then-set patterns without atomicity guarantees\n- Concurrent database access patterns (verify WAL mode awareness for SQLite)\n- Shared mutable state across async boundaries\n- File system operations without proper locking\n\n### 1.3 LLM Output Trust Boundary\n- Agent\u002FLLM output used directly in database writes without validation\n- LLM-generated content passed to API calls without sanitization\n- Tool call results trusted without schema validation\n- Prompt injection vectors in user-controlled content passed to agents\n\n### 1.4 Security (OWASP-aligned)\n- XSS: unsanitized user input rendered in HTML\u002FJSX\n- Injection: command injection, path traversal, SSRF\n- Auth bypass: missing authorization checks on API routes\n- Sensitive data exposure: secrets in logs, error messages, or client bundles\n\n### Resolution Pattern\n\nFor each Pass 1 finding, use the **one-issue-one-question** pattern:\n\n> **CRITICAL: [Issue Title]**\n>\n> [Description of the issue with code reference]\n>\n> **File:** `path\u002Fto\u002Ffile.ts:42`\n> **Category:** [SQL Safety | Race Condition | LLM Trust | Security]\n>\n> Options:\n> - **A) Fix now** — [suggested fix]\n> - **B) Acknowledge risk** — document why this is acceptable\n> - **C) Skip** — false positive, here's why: [explanation needed]\n\nAsk one question at a time. Wait for the user's response before presenting the next finding.\n\n---\n\n## Pass 2: INFORMATIONAL — Non-blocking\n\nReport these findings as a summary list. They do not block merge but should be tracked.\n\n### 2.1 Dead Code & Consistency\n- Unreachable code paths, unused imports, orphaned functions\n- Inconsistent naming conventions within the change\n- Style drift from established codebase patterns\n\n### 2.2 Magic Numbers & String Coupling\n- Hardcoded values that should be constants or configuration\n- Tightly coupled string literals across files\n- Implicit dependencies between modules\n\n### 2.3 Test Gaps\n- New code paths without corresponding tests\n- Modified behavior without updated tests\n- Edge cases visible in the code but not covered by tests\n\n### 2.4 Type Coercion at Boundaries\n- API response data used without type narrowing\n- Form data or URL params used without validation\n- Database query results assumed to have specific shapes\n\n### 2.5 Prompt Quality (for agent-related code)\n- Vague or ambiguous system prompts\n- Missing output format specifications\n- No error handling guidance in prompts\n\n### Informational Output Format\n\n```markdown\n## Pass 2 — Informational Findings\n\n| # | Category | File | Finding | Severity |\n|---|----------|------|---------|----------|\n| 1 | Test Gap | `src\u002Ffoo.ts:23` | New branch not tested | Low |\n| 2 | Magic Number | `src\u002Fbar.ts:45` | Hardcoded timeout 5000 | Low |\n```\n\n---\n\n## Review Flow\n\n```\n1. Load checklist.md\n2. Read all changed files (full context)\n3. Run Pass 1 checks (critical)\n   └─ For each finding: one-issue-one-question → wait for response\n4. Run Pass 2 checks (informational)\n   └─ Present summary table\n5. Final verdict: APPROVE \u002F REQUEST CHANGES\n```\n\n## Final Verdict\n\nAfter all Pass 1 findings are resolved:\n\n- **APPROVE** — no unresolved critical findings, informational items noted\n- **REQUEST CHANGES** — unresolved critical findings remain (user chose to skip without explanation)\n\n## Guidelines\n\n- **Read the full file, not just the diff.** Context around the change often reveals issues the diff alone hides.\n- **Check the checklist.** The external `checklist.md` may have project-specific items. Load it every time.\n- **Err toward false negatives.** A missed real bug is worse than a flagged non-issue, but flooding with false positives erodes trust. When uncertain, flag it as informational (Pass 2), not critical (Pass 1).\n- **Respect the Engineering Principles.** Reference AGENTS.md principles by name when a finding relates to one (e.g., \"Violates: Zero silent failures\").\n","# Code Review — 2-Pass Model\n\nReview code changes using a structured 2-pass model. Pass 1 catches merge-blocking issues. Pass 2 surfaces informational findings. Each critical finding uses the one-issue-one-question pattern for clear resolution.\n\n## Setup\n\n1. Load the checklist: read `skills\u002Fcode-review\u002Fchecklist.md` (relative to this skill)\n2. Identify the changes to review (diff, PR, or staged files)\n3. Read all changed files in full (not just the diff — context matters)\n\n## Pass 1: CRITICAL — Blocks Merge\u002FShip\n\nThese findings **must be resolved** before code can merge or ship. Review in this order:\n\n### 1.1 SQL & Data Safety\n- String interpolation in SQL queries (must use parameterized queries)\n- Missing parameterization in Drizzle raw SQL\n- TOCTOU races (time-of-check-time-of-use) in database operations\n- Unvalidated data written to database\n\n### 1.2 Race Conditions\n- Check-then-set patterns without atomicity guarantees\n- Concurrent database access patterns (verify WAL mode awareness for SQLite)\n- Shared mutable state across async boundaries\n- File system operations without proper locking\n\n### 1.3 LLM Output Trust Boundary\n- Agent\u002FLLM output used directly in database writes without validation\n- LLM-generated content passed to API calls without sanitization\n- Tool call results trusted without schema validation\n- Prompt injection vectors in user-controlled content passed to agents\n\n### 1.4 Security (OWASP-aligned)\n- XSS: unsanitized user input rendered in HTML\u002FJSX\n- Injection: command injection, path traversal, SSRF\n- Auth bypass: missing authorization checks on API routes\n- Sensitive data exposure: secrets in logs, error messages, or client bundles\n\n### Resolution Pattern\n\nFor each Pass 1 finding, use the **one-issue-one-question** pattern:\n\n> **CRITICAL: [Issue Title]**\n>\n> [Description of the issue with code reference]\n>\n> **File:** `path\u002Fto\u002Ffile.ts:42`\n> **Category:** [SQL Safety | Race Condition | LLM Trust | Security]\n>\n> Options:\n> - **A) Fix now** — [suggested fix]\n> - **B) Acknowledge risk** — document why this is acceptable\n> - **C) Skip** — false positive, here's why: [explanation needed]\n\nAsk one question at a time. Wait for the user's response before presenting the next finding.\n\n---\n\n## Pass 2: INFORMATIONAL — Non-blocking\n\nReport these findings as a summary list. They do not block merge but should be tracked.\n\n### 2.1 Dead Code & Consistency\n- Unreachable code paths, unused imports, orphaned functions\n- Inconsistent naming conventions within the change\n- Style drift from established codebase patterns\n\n### 2.2 Magic Numbers & String Coupling\n- Hardcoded values that should be constants or configuration\n- Tightly coupled string literals across files\n- Implicit dependencies between modules\n\n### 2.3 Test Gaps\n- New code paths without corresponding tests\n- Modified behavior without updated tests\n- Edge cases visible in the code but not covered by tests\n\n### 2.4 Type Coercion at Boundaries\n- API response data used without type narrowing\n- Form data or URL params used without validation\n- Database query results assumed to have specific shapes\n\n### 2.5 Prompt Quality (for agent-related code)\n- Vague or ambiguous system prompts\n- Missing output format specifications\n- No error handling guidance in prompts\n\n### Informational Output Format\n\n```markdown\n## Pass 2 — Informational Findings\n\n| # | Category | File | Finding | Severity |\n|---|----------|------|---------|----------|\n| 1 | Test Gap | `src\u002Ffoo.ts:23` | New branch not tested | Low |\n| 2 | Magic Number | `src\u002Fbar.ts:45` | Hardcoded timeout 5000 | Low |\n```\n\n---\n\n## Review Flow\n\n```\n1. Load checklist.md\n2. Read all changed files (full context)\n3. Run Pass 1 checks (critical)\n   └─ For each finding: one-issue-one-question → wait for response\n4. Run Pass 2 checks (informational)\n   └─ Present summary table\n5. Final verdict: APPROVE \u002F REQUEST CHANGES\n```\n\n## Final Verdict\n\nAfter all Pass 1 findings are resolved:\n\n- **APPROVE** — no unresolved critical findings, informational items noted\n- **REQUEST CHANGES** — unresolved critical findings remain (user chose to skip without explanation)\n\n## Guidelines\n\n- **Read the full file, not just the diff.** Context around the change often reveals issues the diff alone hides.\n- **Check the checklist.** The external `checklist.md` may have project-specific items. Load it every time.\n- **Err toward false negatives.** A missed real bug is worse than a flagged non-issue, but flooding with false positives erodes trust. When uncertain, flag it as informational (Pass 2), not critical (Pass 1).\n- **Respect the Engineering Principles.** Reference AGENTS.md principles by name when a finding relates to one (e.g., \"Violates: Zero silent failures\").\n",{"name":5,"description":7},"main","b80e0240f42f84cd950fe8361a11a10699aa7984",".agents\u002Fskills\u002Fcode-review",3,"https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay","https:\u002F\u002Forionfold.com","https:\u002F\u002Fgithub.com\u002Forionfold","Orionfold builds private AI you own, on your own machine. Get an AI team without hiring one.","2026-09-04 21:49:30",{"source":8,"skillName":5,"commands":67,"prompt":77,"zipAvailable":78},[68,71,74],{"tool":69,"command":70},"npx","npx skills add orionfold\u002Frelay --skill code-review",{"tool":72,"command":73},"bunx","bunx skills add orionfold\u002Frelay --skill code-review",{"tool":75,"command":76},"pnpm","pnpm dlx skills add orionfold\u002Frelay --skill code-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcode-review\u002FSKILL.md",true,[80],{"path":81,"resourceType":82,"resourceTypeDesc":83,"sizeBytes":84,"sourceHtmlUrl":85},"checklist.md","REFERENCE","参考文档",2679,"https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcode-review\u002Fchecklist.md",[87,106,121,140,156,180],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":52},"01M719952CZE2BR6GGER42MG51","reader-coach","Helps notice what was read this week. Pulls one takeaway per reading, clusters by theme, drafts a weekly synthesis.","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002Fsrc\u002Flib\u002Fplugins\u002Fexamples\u002Freading-radar\u002Fprofiles\u002Freader-coach\u002FSKILL.md",[],[94,95,96,97,98,99,100,101,102,103,104,105],"reader","reader coach","coach","Synthesis","Clusters","weekly synthesis","reading","drafts","read","theme","notice","weekly",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":52},"01M71993PCY50PQMQW3C3SMMN6","personal-cfo","A patient personal CFO who categorizes transactions, flags unusual spend, and prepares monthly summaries.","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002Fsrc\u002Flib\u002Fplugins\u002Fexamples\u002Ffinance-pack\u002Fprofiles\u002Fpersonal-cfo\u002FSKILL.md",[],[113,114,115,116,117,118,119,120],"personal cfo","personal","cfo","flags","transactions","monthly","summaries","patient",{"skillNo":122,"name":123,"nameZh":6,"description":124,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":125,"categories":126,"keywords":127,"publishedAt":52},"01M71991XD74YK2BY4A3A6J361","relay-web-publisher--site-editor","Drafts structured website section rows for the static-site publisher","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002Fsrc\u002Flib\u002Fpacks\u002Ftemplates\u002Frelay-web-publisher\u002Fbase\u002Fprofiles\u002Frelay-web-publisher--site-editor\u002FSKILL.md",[],[128,129,130,131,132,133,134,135,136,101,137,138,139],"web","editor","relay","relay web publisher site editor","site","publisher","for","static","section","static-site","structured","website",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":146,"publishedAt":52},"01M719906C2NYTTVJQBJJ1F011","relay-web-assets--asset-curator","Curates web-design assets into a clean gallery inventory","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002Fsrc\u002Flib\u002Fpacks\u002Ftemplates\u002Frelay-web-assets\u002Fbase\u002Fprofiles\u002Frelay-web-assets--asset-curator\u002FSKILL.md",[],[147,128,130,148,149,150,151,152,153,154,155],"relay web assets asset curator","assets","asset","design assets","web-design","inventory","gallery","clean","design",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":165,"publishedAt":52},"01M7198Y634C0NJ2CKTSSTVY9R","relay-social--content-studio","The content inventory and repurpose planner — tracks source assets, decides what to repurpose next, and writes the channel brief for each creative","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002Fsrc\u002Flib\u002Fpacks\u002Ftemplates\u002Frelay-social\u002Fbase\u002Fprofiles\u002Frelay-social--content-studio\u002FSKILL.md",[162],{"categoryNo":163,"categoryName":164,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000036","内容创作者",[166,167,130,168,169,170,171,134,172,173,174,175,176,152,177,148,178,179],"studio","content","social","social content","relay social content studio","content studio","planner","brief","tracks","next","repurpose","creative","source","channel",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":192,"publishedAt":52},"01M7198VQ1YYN3PFQH9Y7ZZ6SK","relay-social--campaign-runner","The organic-first campaign engine — composes, schedules, and measures a campaign from plan to published to results, setting the UTM that leads attribute back to","https:\u002F\u002Fgithub.com\u002Forionfold\u002Frelay\u002Fblob\u002Fmain\u002Fsrc\u002Flib\u002Fpacks\u002Ftemplates\u002Frelay-social\u002Fbase\u002Fprofiles\u002Frelay-social--campaign-runner\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000019","营销推广",{"categoryNo":190,"categoryName":191,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000035","市场营销",[193,194,195,168,196,130,197,198,199,200,201,202,203,204,205],"relay social campaign runner","runner","campaign","social campaign","back","engine","leads","plan","organic","first","results","schedules","utm"]