# Review Checklist

> Code review standards and checklist for the code-reviewer agent

- **Type:** Skill
- **Install:** `agentstack add skill-zachjxyz-jvn-review-checklist`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [zachjxyz](https://agentstack.voostack.com/s/zachjxyz)
- **Installs:** 0
- **Category:** [Developer Tools](https://agentstack.voostack.com/c/developer-tools)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [zachjxyz](https://github.com/zachjxyz)
- **Source:** https://github.com/zachjxyz/jvn/tree/main/template/.claude/skills/review-checklist

## Install

```sh
agentstack add skill-zachjxyz-jvn-review-checklist
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Code Review Checklist

Use this checklist when reviewing implementation changes.

## Correctness
- [ ] Logic matches specification requirements
- [ ] Edge cases handled (null, empty, boundary values)
- [ ] Error paths return appropriate responses
- [ ] No off-by-one errors in loops/pagination

## Type Safety
- [ ] No `any` types
- [ ] No `@ts-ignore` or `@ts-expect-error`
- [ ] Drizzle query types properly inferred (not manually typed)
- [ ] API response types match contract

## Security
- [ ] No secrets or credentials in source code
- [ ] Auth checks on all protected routes and server actions
- [ ] User input validated at system boundaries
- [ ] SQL injection prevented (Drizzle parameterized queries)
- [ ] XSS prevented (no `dangerouslySetInnerHTML` without sanitization)

## Performance
- [ ] No N+1 query patterns
- [ ] Indexes on columns used in WHERE, JOIN, ORDER BY
- [ ] Independent data fetches use `Promise.all()`
- [ ] Heavy components use `next/dynamic` for code splitting
- [ ] Suspense boundaries wrap async server components

## Testing
- [ ] Tests written BEFORE implementation (TDD)
- [ ] Happy path covered
- [ ] Error cases covered
- [ ] Edge cases covered
- [ ] Integration tests for API routes

## Maintainability
- [ ] Files under ~200 lines (split if larger)
- [ ] Descriptive variable and function names
- [ ] Early returns for guard clauses
- [ ] No dead code (unused imports, variables, functions)
- [ ] No commented-out code

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [zachjxyz](https://github.com/zachjxyz)
- **Source:** [zachjxyz/jvn](https://github.com/zachjxyz/jvn)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-zachjxyz-jvn-review-checklist
- Seller: https://agentstack.voostack.com/s/zachjxyz
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.