Automated summary
Provides a structured security, correctness, and maintainability review for pull requests and diffs in the contentstack-cli-content-type plugin.
Strengths
- Explicit Critical / Important / Suggestion feedback scale that keeps reviews consistent across contributors
- Targeted scrutiny for compare.ts and diagram.ts, including temp-file handling, browser opening, path validation, and the Graphviz dependency
- Concrete secret-handling rules: no logging of tokens, authtoken values, Bearer strings, or full API responses
- Gives a checklist for dependency upgrades (axios, diff2html, git-diff, node-graphviz, tmp, cli-ux) covering changelogs and supply chain
Limitations
- Tightly scoped to this repository: the cited paths, commands, and dependencies do not transfer to other projects
- Assumes familiarity with the project's oclif setup, eslint-config-oclif-typescript, and Jest conventions
- Does not address performance broadly or accessibility beyond SVG generation and the missing-Graphviz user message
Use it before merging a PR, when auditing a dependency bump, or whenever a change touches compare/diagram behavior in this plugin.
Avoid it for reviewing code in other repositories or for product design discussions that have no diff to inspect.
Security analysis
SafeThe skill contains only review guidance and checklists for a specific repository. It declares no allowed tools and does not instruct execution of commands, data exfiltration, destructive actions, or unsafe practices.
No concerns found
How this analysis is madeExamples
Review this diff against the contentstack-cli-content-type repo before I merge. Flag Critical, Important, and Suggestion items, and pay extra attention to anything touching src/core/content-type/compare.ts.I'm upgrading axios and diff2html in the content-type plugin. Review the package.json and lockfile changes: check security advisories, changelog behavior changes affecting the compare UX, and whether tests or ESLint still pass.Review my changes to src/core/contentstack/client.ts and the compare HTML output. Make sure no access tokens, management tokens, or Bearer strings get logged or written into temp files.name: code-review description: >- Reviews pull requests and risky changes for the contentstack-cli-content-type plugin. Use when reviewing diffs, security-sensitive edits, dependency upgrades, or changes to compare/diagram/temp-file behavior, ESLint, and tests.
code-review – contentstack-cli-content-type
When to use
- Reviewing a PR or diff before merge.
- Auditing dependency upgrades (axios, diff2html, git-diff, node-graphviz, tmp, cli-ux).
- Changes touching compare HTML, temp files, diagram output, or
src/core/contentstack/.
Instructions
Provide consistent security, correctness, and maintainability review for this repository. The plugin handles stack API keys in error messages, opens HTML diffs in a browser, and writes diagram files via Graphviz.
Use Critical / Important / Suggestion when leaving feedback.
Highlights
- Secrets: Never approve logging of tokens,
authtoken/authorizationvalues, or raw management tokens. - Compare / diagram: Changes to src/core/content-type/compare.ts or diagram.ts deserve extra scrutiny (temp files, browser open, paths, binary dependency).
- Dependencies: axios, diff2html, git-diff, node-graphviz, tmp, cli-ux—review changelog and supply-chain for version bumps.
- Quality: TypeScript and eslint-config-oclif-typescript (.eslintrc); behavioral changes should include or update Jest tests where appropriate.
Security and privacy
| Severity | Item |
|----------|------|
| Critical | No logging or serializing of access tokens, management tokens, or Bearer strings. |
| Critical | No new console.log of full API responses that may contain secrets. |
| Important | Stack API keys appear in user-facing errors only in line with src/core/contentstack/client.ts (buildError + optional key suffix). |
Correctness
| Severity | Item |
|----------|------|
| Critical | Command flags and setup(flags) behavior remain consistent; compare-remote still resolves origin vs remote stacks correctly. |
| Important | Compare: left/right version logic and warning when versions are equal; HTML output path and browser open behavior unchanged unless intentionally redesigned. |
| Important | Diagram: output path validation; Graphviz / DOT paths; orientation and file type flags. |
| Suggestion | Edge cases for empty audit logs, missing references, or single-version content types. |
Compare and diagram (touching core)
| Severity | Item |
|----------|------|
| Critical | compare.ts: temp HTML creation does not write sensitive data beyond the diff; file handling is safe on failure paths. |
| Important | diagram.ts: sanitizePath / path usage; large stack models do not cause unbounded memory without consideration. |
| Suggestion | User messaging when Graphviz is missing or SVG generation fails. |
Dependencies
| Severity | Item | |----------|------| | Important | axios: security advisories; upgrade notes. | | Important | diff2html, git-diff, tmp, cli-ux: behavior changes affecting compare UX. | | Important | node-graphviz: compatibility with supported Node and system Graphviz. | | Suggestion | moment (if touched): prefer minimal churn; note maintenance status of dependencies. |
Tests and tooling
| Severity | Item |
|----------|------|
| Important | New behavior in src/core/ or src/utils/ has Jest coverage or a clear reason why not. |
| Important | pnpm test and ESLint (pnpm run lint / .eslintrc) pass. |
| Suggestion | Tests mock HTTP/SDK boundaries; no accidental live API calls. |
Documentation
| Severity | Item |
|----------|------|
| Important | If commands or flags change, README (generated via oclif readme) is updated via pnpm run build / version workflow. |
| Suggestion | User-facing strings and examples match src/commands/content-type/*.ts examples. |
References
- testing/SKILL.md — test and lint expectations.
- contentstack-cli-content-type/SKILL.md — architecture and risky areas.
From the file to a first result
The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.
View the source and supporting filesThis download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.
1. Download the file
Download SKILL.mdFrom the root of a test project, save the file as .skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.
Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.
mkdir -p '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/code-review-for-contentstack-cli-content-type-mrwakcun/download' --output '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md.part' && mv '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md.part' '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md'2. Check prerequisites
Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.
Original excerpt: Dependencies
| Severity | Item |
|---|---|
| Important | axios: security advisories; upgrade notes. |
| Important | diff2html, git-diff, tmp, cli-ux: behavior changes affecting compare UX. |
| Important | node-graphviz: compatibility with supported Node and system Graphviz. |
| Suggestion | moment (if touched): prefer minimal churn; note maintenance status of dependencies. |
The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.
3. Load the skill
After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.
Claude Code
test -f '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md' && test -s '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/code-review' && cp -R '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun' '.claude/skills/code-review'Cursor
test -f '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md' && test -s '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/code-review' && cp -R '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun' '.cursor/skills/code-review'Codex
test -f '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md' && test -s '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/code-review' && cp -R '.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun' '.agents/skills/code-review'OpenSkills
OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.
Official OpenSkills installationopenskills install './.skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun'openskills read 'code-review-for-contentstack-cli-content-type-mrwakcun'Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.
For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.
openskills syncManual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.
4. Try a first task
Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:
Read .skill-downloads/code-review-for-contentstack-cli-content-type-mrwakcun/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.
React Hook Form Best Practices
Development
Master React Hook Form: avoid anti-patterns, manage subscriptions, and handle reset, dirty state, and controlled inputs correctly.
Emotion to Mantine Migration
Development
Migrate Emotion styled-components to Mantine components with style props and CSS modules. Use when converting .styled.tsx files or removing @emotion imports.
Scope Creep Detector
Development
Analyzes git diffs against a stated intent to detect scope creep, unrelated files, broad PRs, and oversized changes, then suggests keep, split, or justify actions.