AgentStack
SKILL verified MIT Self-run

Brandapp Sdk Review

skill-reopt-ai-reopt-skills-brandapp-sdk-review · by reopt-ai

Review consumer project code for @reopt-ai/brandapp-sdk usage anti-patterns and suggest improvements. Triggers on "brandapp-sdk review", "SDK review", "improve SDK usage", "EAV optimization", "brandapp-sdk audit".

No reviews yet
0 installs
3 views
0.0% view→install

Install

$ agentstack add skill-reopt-ai-reopt-skills-brandapp-sdk-review

✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.

Security review

✓ Passed

No issues found. Passed automated security review. · v0.1.0 How review works →

  • Prompt-injection patterns
  • Secret / credential exfiltration
  • Dangerous shell & filesystem operations
  • Untrusted network calls
  • Known-malicious package signatures

What it can access

  • Network access No
  • Filesystem access No
  • Shell / process execution No
  • Environment & secrets Used
  • Dynamic code execution No

From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.

Are you the author of Brandapp Sdk Review? Claim this listing to set pricing, connect Stripe payouts, and keep 70% of every sale.
Sign up to claim

About

Brandapp SDK Review

> This is NOT the SDK you know. Read node_modules/@reopt-ai/brandapp-sdk/docs/ before judging any usage (the package ships docs at top-level docs/, not dist/docs/). Anti-pattern remedies live there; this skill is grep keys + categories only.

When to apply

A consumer project already uses @reopt-ai/brandapp-sdk and wants an audit. Triggers: "review", "audit", "improve SDK usage", "EAV optimization".

Step 1 — Pin agent rules into AGENTS.md / CLAUDE.md

Source: the module's own agent-rules file once it ships one (@reopt-ai/brandapp-sdk does not, as of 3.1.0). Fallback: agent-rules.md bundled with this skill. Wrap content between:


…content from source…

Markers are shared with brandapp-sdk-install — same module, one block. If the block already exists from install, leave it alone (replace only when stale).

Step 2 — Version gate

grep '"@reopt-ai/brandapp-sdk"' package.json
  • `) | new Proxy({} as + createReoptEavClient` |

| P2 List-then-find on the client | .find(( / .filter(( chained on listAllRecords / records.list | | P3 Manual upsert (find + create/update) | if (existing) + records.create + records.update in same fn | | P4 Manual pagination loop | while + page + totalPages + records.list | | P5 Hand-rolled enum normalization | new Set tags — use toMetadata(post) | | CMS3 Hand-rolled sitemap / RSS | manual XML — use toSitemapItems / toRssFeed |

Step 4 — Report

For each finding emit:

[] 
  file:line
  why: 
  fix: .md#anchor>

Group by category; lead with version-gate failures (Step 2). Do not paste full before/after code in the report — keep it scannable.

Step 5 — Offer auto-fix

Patterns P5/P6/P7/P8/P9/Sch3/R1/R2/W1/W2/Cfg6/CMS2/CMS3 are mechanical rewrites — offer to apply directly. P1/P3/Auth*/Err3/Err5/Cfg1–Cfg5/Sch1/Sch4/Sch5 require human judgment — propose, don't apply.

Safety

  • Never apply fixes that change .env keys without explicit user approval (2.0 rename is wholesale).
  • Never edit package.json version pins without confirming the rest of the matrix passes Step 2.
  • Read docs/ for the canonical fix; do not invent code that the docs do not endorse.

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

Install and usage instructions live in the source repository linked above.

Reviews

No reviews yet — be the first.

Versions

  • v0.1.0 Imported from the upstream source.