# Brandapp Sdk Review

> Review consumer project code for @reopt-ai/brandapp-sdk usage anti-patterns and suggest improvements. Triggers on "brandapp-sdk review", "SDK review", "improve SDK usage", "EAV optimization", "brandapp-sdk audit".

- **Type:** Skill
- **Install:** `agentstack add skill-reopt-ai-reopt-skills-brandapp-sdk-review`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [reopt-ai](https://agentstack.voostack.com/s/reopt-ai)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [reopt-ai](https://github.com/reopt-ai)
- **Source:** https://github.com/reopt-ai/reopt-skills/tree/main/skills/brandapp-sdk-review
- **Website:** https://skills.sh/reopt-ai/reopt-skills

## Install

```sh
agentstack add skill-reopt-ai-reopt-skills-brandapp-sdk-review
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Brandapp SDK Review

> This is NOT the SDK you know. Read `node_modules/@reopt-ai/brandapp-sdk/docs/` before judging any usage (the package ships docs at top-level `docs/`, not `dist/docs/`). Anti-pattern remedies live there; this skill is grep keys + categories only.

## When to apply

A consumer project already uses `@reopt-ai/brandapp-sdk` and wants an audit. Triggers: "review", "audit", "improve SDK usage", "EAV optimization".

## Step 1 — Pin agent rules into AGENTS.md / CLAUDE.md

Source: the module's own agent-rules file once it ships one (`@reopt-ai/brandapp-sdk` does not, as of 3.1.0). Fallback: `agent-rules.md` bundled with this skill. Wrap content between:

```

…content from source…

```

Markers are shared with `brandapp-sdk-install` — same module, one block. If the block already exists from install, leave it alone (replace only when stale).

## Step 2 — Version gate

```bash
grep '"@reopt-ai/brandapp-sdk"' package.json
```

- ``) | `new Proxy({} as` + `createReoptEavClient` |
| P2 List-then-find on the client | `.find((` / `.filter((` chained on `listAllRecords` / `records.list` |
| P3 Manual upsert (find + create/update) | `if (existing)` + `records.create` + `records.update` in same fn |
| P4 Manual pagination loop | `while` + `page` + `totalPages` + `records.list` |
| P5 Hand-rolled enum normalization | `new Set` tags — use `toMetadata(post)` |
| CMS3 Hand-rolled sitemap / RSS | manual XML — use `toSitemapItems` / `toRssFeed` |

## Step 4 — Report

For each finding emit:

```
[] 
  file:line
  why: 
  fix: .md#anchor>
```

Group by category; lead with version-gate failures (Step 2). Do not paste full before/after code in the report — keep it scannable.

## Step 5 — Offer auto-fix

Patterns P5/P6/P7/P8/P9/Sch3/R1/R2/W1/W2/Cfg6/CMS2/CMS3 are mechanical rewrites — offer to apply directly. P1/P3/Auth*/Err3/Err5/Cfg1–Cfg5/Sch1/Sch4/Sch5 require human judgment — propose, don't apply.

## Safety

- Never apply fixes that change `.env` keys without explicit user approval (2.0 rename is wholesale).
- Never edit `package.json` version pins without confirming the rest of the matrix passes Step 2.
- Read `docs/` for the canonical fix; do not invent code that the docs do not endorse.

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [reopt-ai](https://github.com/reopt-ai)
- **Source:** [reopt-ai/reopt-skills](https://github.com/reopt-ai/reopt-skills)
- **License:** MIT
- **Homepage:** https://skills.sh/reopt-ai/reopt-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-reopt-ai-reopt-skills-brandapp-sdk-review
- Seller: https://agentstack.voostack.com/s/reopt-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.