Install
$ agentstack add skill-reopt-ai-reopt-skills-brandapp-sdk-review ✓ scanned · ✓ verified — works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ● Environment & secrets Used
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
About
Brandapp SDK Review
> This is NOT the SDK you know. Read node_modules/@reopt-ai/brandapp-sdk/docs/ before judging any usage (the package ships docs at top-level docs/, not dist/docs/). Anti-pattern remedies live there; this skill is grep keys + categories only.
When to apply
A consumer project already uses @reopt-ai/brandapp-sdk and wants an audit. Triggers: "review", "audit", "improve SDK usage", "EAV optimization".
Step 1 — Pin agent rules into AGENTS.md / CLAUDE.md
Source: the module's own agent-rules file once it ships one (@reopt-ai/brandapp-sdk does not, as of 3.1.0). Fallback: agent-rules.md bundled with this skill. Wrap content between:
…content from source…
Markers are shared with brandapp-sdk-install — same module, one block. If the block already exists from install, leave it alone (replace only when stale).
Step 2 — Version gate
grep '"@reopt-ai/brandapp-sdk"' package.json
- `
) |new Proxy({} as+createReoptEavClient` |
| P2 List-then-find on the client | .find(( / .filter(( chained on listAllRecords / records.list | | P3 Manual upsert (find + create/update) | if (existing) + records.create + records.update in same fn | | P4 Manual pagination loop | while + page + totalPages + records.list | | P5 Hand-rolled enum normalization | new Set tags — use toMetadata(post) | | CMS3 Hand-rolled sitemap / RSS | manual XML — use toSitemapItems / toRssFeed |
Step 4 — Report
For each finding emit:
[]
file:line
why:
fix: .md#anchor>
Group by category; lead with version-gate failures (Step 2). Do not paste full before/after code in the report — keep it scannable.
Step 5 — Offer auto-fix
Patterns P5/P6/P7/P8/P9/Sch3/R1/R2/W1/W2/Cfg6/CMS2/CMS3 are mechanical rewrites — offer to apply directly. P1/P3/Auth*/Err3/Err5/Cfg1–Cfg5/Sch1/Sch4/Sch5 require human judgment — propose, don't apply.
Safety
- Never apply fixes that change
.envkeys without explicit user approval (2.0 rename is wholesale). - Never edit
package.jsonversion pins without confirming the rest of the matrix passes Step 2. - Read
docs/for the canonical fix; do not invent code that the docs do not endorse.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: reopt-ai
- Source: reopt-ai/reopt-skills
- License: MIT
- Homepage: https://skills.sh/reopt-ai/reopt-skills
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet — be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.