ai-code-review-autonomous

ai-code-review-autonomous — vibes-plug Skill

English | Bahasa Indonesia

---

English

Orchestration & Integration

• Anti-Slop & Quality Gates: anti-slop, coderabbit, zero-tech-debt-auditor
• TDD & Automated Debugging: autonomous-tdd-debugger, property-mutation-testing-expert, formal-spec-z3-verifier
• Security & Red Teaming: autonomous-red-teamer, prompt-injection-firewall
• Architecture & Clean Code: scalability-clean-code, living-codebase-ast-graph, typescript-expert
• Lifecycle & Governance: brainstorming, zero-to-prod-orchestrator, production-ready-hardener

Description

A structured multi-pass self-review protocol that the AI agent executes on its own generated code before presenting it to the user. Each pass focuses on a distinct quality dimension — syntax correctness, business logic validation, architectural conformance, security vulnerabilities, and performance characteristics. This eliminates the most common AI code generation failure: confidently presenting broken or insecure code because the model never re-read what it wrote.

Trigger Conditions

Activate this skill when:

• Generating any code that will be written to files (not just shown in conversation).
• Making changes to critical paths: authentication, payment, data mutation, or API endpoints.
• Producing code that spans multiple files or requires cross-file consistency.
• The generated code exceeds 50 lines and involves non-trivial logic.
• Before finalizing any PR-ready code or phase completion in zero-to-prod-orchestrator.

---

Core Concepts & Patterns

1. The 5-Pass Self-Review Protocol

GENERATED CODE
      │
      ▼
┌──────────────────┐
│ PASS 1: SYNTAX   │  Does this code compile/parse without errors?
│                  │  - Type correctness (TypeScript strict mode)
│                  │  - Import resolution (no phantom imports)
│                  │  - JSX/HTML well-formedness
│                  │  - Missing semicolons, brackets, parentheses
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ PASS 2: LOGIC    │  Does this code do what it's supposed to do?
│                  │  - Edge cases (null, empty, boundary values)
│                  │  - Off-by-one errors in loops/slicing
│                  │  - Async/await correctness (missing awaits)
│                  │  - State mutation side effects
│                  │  - Race conditions in concurrent code
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ PASS 3: ARCH     │  Does this code fit the project's architecture?
│                  │  - Follows established patterns (DDD, MVC, etc.)
│                  │  - Uses existing utility functions, not duplicates
│                  │  - Respects separation of concerns
│                  │  - Consistent with existing naming conventions
│                  │  - No circular dependencies introduced
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ PASS 4: SECURITY │  Is this code safe in production?
│                  │  - SQL injection (parameterized queries?)
│                  │  - XSS (user input sanitized before render?)
│                  │  - Auth bypass (route protection verified?)
│                  │  - Secret exposure (no hardcoded keys/tokens)
│                  │  - IDOR (authorization checked per resource?)
└──────┬───────────┘
       │
       ▼
┌──────────────────┐
│ PASS 5: PERF     │  Will this code perform at scale?
│                  │  - N+1 query patterns in ORM calls
│                  │  - Unbounded array/list operations
│                  │  - Missing pagination on list endpoints
│                  │  - Memory leaks (unclosed streams, listeners)
│                  │  - Unnecessary re-renders in React components
└──────┬───────────┘
       │
       ▼
  REVIEWED CODE → Present to User