从五个质量维度审查代码
代码变更可能隐藏正确性、安全性、架构、可读性和性能问题。此技能采用结构化审查流程，并提供按优先级排列、可执行的反馈。
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
Review the Skillstore skill "code-review-and-quality" from https://skillstore.io/skills/addyosmani-code-review-and-quality.md and its manifest at https://skillstore.io/api/skills/addyosmani-code-review-and-quality/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.你的智能体仍应展示其计划，并按安全策略请求必要确认。
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
正在使用“code-review-and-quality”。 审查一个修改日期解析并仅添加了一项正常路径测试的缺陷修复。
预期结果:
必须：添加针对无效值、空值和时区边界的测试。实现看起来具有良好的可读性，但当前覆盖范围无法防止已报告的问题再次出现。
正在使用“code-review-and-quality”。 审查一项将功能逻辑移至共享工具的重构。
预期结果:
要求修改：此次重构只是转移了复杂性，并削弱了模块归属。请将逻辑保留在功能包中，并复用现有的规范辅助函数。
正在使用“code-review-and-quality”。 审查一项测试套件全部通过的单软件包依赖项升级。
预期结果:
确认变更日志和锁文件差异后批准。测试已通过，升级范围独立，并且回滚方案仍然清晰。
All 37 static findings are false positives in documentation-only Markdown. The matches are inline backticks, fenced examples, relative links, or ordinary checklist language; no executable behavior, secret access, network activity, or prompt injection was found in SKILL.md.
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
https://skillstore.io/skills/addyosmani-code-review-and-quality/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report[](https://skillstore.io/skills/addyosmani-code-review-and-quality?utm_source=security_passport_badge)<a href="https://skillstore.io/skills/addyosmani-code-review-and-quality?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-code-review-and-quality/security.svg" alt="Skillstore security assessment" loading="lazy"></a><iframe src="https://skillstore.io/embed/skills/addyosmani-code-review-and-quality.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>addyosmani. (2026). code-review-and-quality security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-code-review-and-quality/audits/4@techreport{addyosmani-addyosmani-code-review-and-quality-2026,
author = {addyosmani},
title = {code-review-and-quality security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/addyosmani-code-review-and-quality/audits/4},
note = {Author version unspecified}
}cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "code-review-and-quality security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "addyosmani"
date-released: "2026-09-19"
url: "https://skillstore.io/skills/addyosmani-code-review-and-quality/audits/4"
identifiers:
- type: other
value: "skillstore:addyosmani-code-review-and-quality:audit:4"
description: "Skillstore immutable audit report identifier"
在批准功能之前评估其行为、测试、架构、安全性和性能。
检查智能体生成的变更中是否存在潜在错误、隐藏假设、薄弱测试和不必要的复杂性。
审查变更日志影响、锁文件变更、传递依赖包、安全风险和验证质量。
从正确性、可读性、架构、安全性和性能方面审查此变更。先列出必须解决的问题，再列出可选的改进建议。
将此实现与需求和测试进行比较。识别遗漏的边界情况、薄弱的错误处理和缺失的回归测试覆盖。
从降低复杂性、模块归属、类型边界、重复逻辑和无用代码方面审查此次重构。提出具体的结构性改进方案。
审计此次依赖项升级。评估变更日志风险、锁文件变更、传递依赖项、安全风险、测试覆盖率和回滚方案的清晰度。
作者
addyosmani许可证
MIT
Skillstore 修订
r2
版本提示
作者未声明版本。
引用
5d5054f8a23586f9b500fece1cb613a9dffc787b
维护新鲜度
2026/9/19
使用量
12 次下载 · 0 次浏览
文件结构
📄 SKILL.md
Clarify User Intent Before You Build
Underspecified requests cause teams to build the wrong outcome and discover misalignment late. This skill runs a focused, one-question interview that turns ambiguity into confirmed intent.
Plan Work Into Verifiable Tasks
Large or vague software work can hide dependencies, missing acceptance criteria, and verification gaps. This skill converts a specification into ordered task slices with checkpoints, scope guidance, and clear completion conditions.
Document Decisions and Architecture Clearly
Teams lose context when important technical decisions remain in chat, code comments, or individual memory. This skill turns architectural reasoning, API guidance, project instructions, and release changes into structured documentation.
Build Accessible, Production-Ready Frontends
Frontend work can become inconsistent, inaccessible, or difficult to maintain. This skill guides component architecture, responsive layouts, state handling, and polished user experiences.
Harden Applications Against Security Risks
Security reviews can miss trust boundaries and unsafe data flows. This skill supplies threat-modeling prompts, OWASP patterns, and practical review checklists.
Instrument Production Systems with Clear Telemetry
Production teams need reliable evidence when services fail, slow down, or behave unexpectedly. This skill helps design useful logs, metrics, traces, alerts, and verification steps.
通过构建应用来教授编程
由 Emz1998
当示例与真实项目脱节时，学习编程可能会显得抽象。这个技能会在逐步构建可运行应用的过程中讲解概念。
路由 CC-DevFlow 工作流
由 Dimon94
团队在复杂交付工作中会因选择下一个 CC-DevFlow 命令而耗费时间。此技能会将项目状态、阶段门和用户意图映射到合适的 Claude、Codex 或 Claude Code 工作流。
Trace Requirements to Verified Delivery
由 solohic
Teams can lose requirements when agent-skill work moves from planning to implementation and review. This skill keeps requirements, acceptance evidence, review state, and completion claims connected through a clear traceability process.
Trace Requirements Across Superpowers Workflows
由 solohic
Development teams can lose requirement evidence across planning, implementation, review, and release. This skill adds RVTF traceability while preserving Superpowers task boundaries and control.
审查代码中的整洁代码问题
由 hylarucoder
代码质量问题会拖慢审查并让变更更具风险。此技能可发现整洁代码问题，并提供按优先级排序的重构指导。
改进基于证据的推理
由 89jobrien
当主张超出证据范围时，复杂审查和决策往往会失败。此技能提供验证工作流、假设检验和自我纠正提示。