CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

cloudbase-code-review

Code review and validation for CloudBase projects. After writing code for Web / miniprogram / CloudRun / cloud-function projects, call this skill to check for known pitfalls — auth guard misuse, missing database tables, RLS misconfiguration, storage domain setup, and SDK API misuse. Supports automated lint scripts (regex-based) + LLM semantic review.

Quality

81%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

The canonical home for this skill is cloudbase-code-review in TencentCloudBase/CloudBase-AI-Toolkit

SKILL.md
Quality
Evals
Security

Quality

Content

65%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

Well-structured progressive disclosure with a verified, cleanly linked reference bundle, but the body itself repeats the lint instructions three times and its workflow lacks an explicit module-identification step and validation loop for findings. Tightening the duplication and making the review sequence's checkpoints explicit would lift the weaker dimensions.

Suggestions

State the lint copy-and-run procedure once (e.g. only in 'How it works') and reference it from Quick start and Rule format instead of repeating it verbatim.

Add an explicit Step 0 to the workflow: 'Identify project modules (Web/miniprogram/CloudRun/cloud-function) via references/RULES_INDEX.md, then select applicable rules' so the entry point is unambiguous.

Add an explicit validation loop after review, e.g. 'If lint or LLM review finds issues, apply the rule's 修复指引 and re-run the check before declaring done.'

DimensionReasoningScore

Conciseness

Mostly efficient, but the optional-lint procedure (copy the code block from references/lint-rules/README.md to a temporary cloudbase-lint.mjs, then run node cloudbase-lint.mjs --project-dir) is repeated essentially verbatim in the 'How it works' table and again in Quick start, plus referenced a third time under Rule format — noticeable padding that could be consolidated.

3 / 5

Actionability

Provides concrete rule file paths, a runnable lint command, and an explicit user-consent step, but the Quick start bash block contains only comments with no copy-paste-ready lines in the body itself, so it is not fully executable as written.

4 / 5

Workflow Clarity

A rough sequence is present (read rules → optional lint → per-rule 'LLM 检查' inspection), but the entry step 'Read relevant rules for identified modules' never explains how to identify modules in the body, and there is no explicit checkpoint or fix-and-recheck loop for findings — validation is implicit ('before claiming done').

3 / 5

Progressive Disclosure

The body is a clean overview with all detail split into ten real bundle files (all listed paths verified to exist), one level deep, each enumerated with markdown links in the Reference index and a matrix entry point via RULES_INDEX.md — easy to navigate.

5 / 5

Total

15

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it names concrete capabilities, gives an explicit post-implementation trigger, and is clearly distinguishable from generic review skills. The only gap is missing natural synonyms for the CloudBase ecosystem that some users would use.

DimensionReasoningScore

Specificity

Lists multiple concrete actions — 'auth guard misuse, missing database tables, RLS misconfiguration, storage domain setup, and SDK API misuse' — plus a concrete two-layer method ('automated lint scripts (regex-based) + LLM semantic review'), giving comprehensive coverage of the CloudBase review domain.

5 / 5

Completeness

Explicitly answers both what ('check for known pitfalls — auth guard misuse, missing database tables, RLS misconfiguration...') and when ('After writing code for Web / miniprogram / CloudRun / cloud-function projects, call this skill'), which is a clear Use-when clause with concrete trigger contexts.

5 / 5

Trigger Term Quality

Good natural keyword coverage ('Code review', 'CloudBase', 'Web / miniprogram / CloudRun / cloud-function', 'RLS', 'storage'), but common synonyms and ecosystem terms a user might say (e.g. 'TCB', '腾讯云开发', '@cloudbase/js-sdk') are missing, so it falls short of the comprehensive anchor.

4 / 5

Distinctiveness Conflict Risk

The description is tightly scoped to CloudBase ('CloudBase projects', 'CloudRun', 'cloud-function', 'RLS'), establishing a clear niche with distinct triggers and minimal overlap risk with generic code-review skills.

5 / 5

Total

19

/

20

Passed

Validation

81%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 13 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

relative_links

Relative link issues: 10 deeper-than-1-level

Warning

referenced_paths_exist

Referenced path issues: 16 deeper-than-1-level

Warning

Total

13

/

16

Passed

Repository

TencentCloudBase/CloudBase-AI-Toolkit

Path

plugin/cloudbase/skills/cloudbase-code-review/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.