跳到主要内容

开发工具：代码审查

写完代码后对 CloudBase 项目做落地检查，覆盖鉴权守卫、数据表缺失、RLS 配置、存储域名与 SDK 误用等常见坑

如何使用​

查看如何使用Skill了解详细的使用方法。

测试 Skill​

你可以使用以下提示词来测试：

  • "帮我检查这个 CloudBase Web 项目有没有鉴权配置问题"
  • "帮我审查小程序项目里的 SDK 用法是否符合规范"
  • "检查云开发数据库的表结构和安全规则配置是否正确"

使用 AI 检查项目落地是否符合规范

安装与查看​

如果需要安装全部 CloudBase Skills，可执行：

npx skills add tencentcloudbase/cloudbase-skills

如果只安装当前 Skill，可执行：

npx skills add https://github.com/tencentcloudbase/skills --skill cloudbase-code-review

当前 Skill 在线查看： cloudbase-code-review

Skill 规则原文​

查看 SKILL.md 原文
## Sibling skills (local only)

Sibling CloudBase skills ship beside this skill. Use local relative paths such as `../auth-tool-cloudbase/SKILL.md`.

If a referenced sibling skill file is missing from this environment, ask the user to install the full CloudBase plugin (or the missing skill). Do **not** HTTP-fetch remote skill or protocol markdown into the agent context.

# CloudBase Code Review

> **One-liner**: After implementing CloudBase features, call this skill to catch common mistakes before users do.

## When to use

Call this skill **after** completing a CloudBase implementation task, before declaring done:

- You implemented auth (login / register / route guard)
- You created database tables or wrote CRUD (NoSQL / PostgreSQL / MySQL)
- You set up CloudBase Storage (file upload, hosting)
- You configured security rules or RLS policies
- You wrote MCP-dependent code
- You wrote Cloud Function or CloudRun HTTP handlers (check for credential / header echo leaks)

## How it works

The skill runs in two layers:

| Layer | Method | Speed | What it catches |
|-------|--------|-------|-----------------|
| **Lint (optional)** | No executable script is shipped. If the user approves running lint, review the code block in `references/lint-rules/README.md`, copy it to a temporary local `cloudbase-lint.mjs`, then run `node cloudbase-lint.mjs --project-dir <path>` | Seconds | Deterministic regex checks — wrong API calls, missing configs, pattern mismatches |
| **LLM review** | Read each rule's "LLM 检查" section, inspect code semantically | Variable | Semantic issues — route guard logic, RLS completeness, architecture-level problems |

## Rule index

See `references/RULES_INDEX.md` for the full matrix (module × frontend type → applicable rules).

## Rule boundary

Do not promote a single failed run or case-specific workaround into a hard rule. A rule should be backed by stable SDK/API documentation, repeated failures, or deterministic runtime behavior. Case-specific observations belong in attribution reports; only broadly applicable constraints should enter `RULES_INDEX.md` or the optional lint checklist.

## Quick start

```bash
# Step 1: Read relevant rules for identified modules
#   references/rules/cross-cutting/AUTH001.md
#   references/rules/cross-cutting/SEC001.md
#   references/rules/postgresql/PG-CR001.md
#   ...

# Optional: if the user approves running lint, review the script code block in
# references/lint-rules/README.md, copy it to a temporary cloudbase-lint.mjs,
# then run: node cloudbase-lint.mjs --project-dir .

# Step 2: For each applicable rule, read the "LLM 检查" section
#         and manually inspect your code before claiming done.
```

## Rule format

Each rule `.md` file follows this structure:

```markdown
# RULE-ID Rule Name

- **Module**: which module (auth / postgresql / storage / ...)
- **Severity**: error | warning
- **Stage**: code-generation | deployment | config

## 正则检查 (Lint)

The condition checked by the optional script code block in `references/lint-rules/README.md`.

## LLM 检查

Semantic review prompt for human or LLM to evaluate.

## 修复指引

How to fix the issue.
```

## Reference index

All packaged reference files (required for skill lint reachability):

- [RULES_INDEX.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/RULES_INDEX.md)
- [lint-rules/README.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/lint-rules/README.md)
- [rules/cross-cutting/AUTH001.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/cross-cutting/AUTH001.md)
- [rules/cross-cutting/SEC001.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/cross-cutting/SEC001.md)
- [rules/cross-cutting/SKILL001.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/cross-cutting/SKILL001.md)
- [rules/postgresql/PG-CR001.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/postgresql/PG-CR001.md)
- [rules/postgresql/PG-CR002.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/postgresql/PG-CR002.md)
- [rules/postgresql/PG-CR003.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/postgresql/PG-CR003.md)
- [rules/postgresql/PG-CR004.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/postgresql/PG-CR004.md)
- [rules/postgresql/PG-CR005.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/postgresql/PG-CR005.md)
- [rules/storage/STORAGE001.md](https://cnb.cool/tencent/cloud/cloudbase/CloudBase-AI-Toolkit/-/git/raw/main/config/source/skills/cloudbase-code-review/references/rules/storage/STORAGE001.md)

参考文件​

当前 Skill 的详细规则文件（源仓库 CNB 镜像，国内可直连）：