---
name: code-review
description: Review code changes for quality, security, and best practices. Use when reviewing pull requests, diffs, or when the user asks for a code review.
---
# Code Review
## Checklist
1. Read the full diff before commenting
2. Check for security issues (injection, XSS, secrets)
3. Verify error handling on all external calls
4. Confirm tests cover new logic
5. Flag breaking API changes
## Output Format
- **Critical**: must fix before merge
- **Suggestion**: optional improvement
- **Praise**: well-done patterns worth keeping
テンプレート 2:Commit Message
---
name: commit-message
description: Generate descriptive commit messages following Conventional Commits. Use when the user asks to write commit messages or review staged changes.
---
# Commit Message Generator
## Format
`<type>(<scope>): <subject>`
Types: feat, fix, docs, style, refactor, test, chore
## Rules
- Subject ≤ 72 characters, imperative mood
- Body explains WHY, not WHAT
- Reference issue numbers when applicable
テンプレート 3:ユニットテスト
---
name: unit-test-writer
description: Write unit tests for given code using the project's existing test framework. Use when the user asks to add tests, improve coverage, or test a function.
---
# Unit Test Writer
## Steps
1. Identify the project's test framework (Jest, pytest, Go test, etc.)
2. Read existing test files for patterns and conventions
3. Cover: happy path, edge cases, error paths
4. Use descriptive test names: `should_<expected>_when_<condition>`
5. Mock external dependencies, not the unit under test
テンプレート 4:Dockerfile 最適化
---
name: dockerfile-optimize
description: Optimize Dockerfiles for smaller image size, faster builds, and security. Use when working with Docker, containerization, or image optimization.
---
# Dockerfile Optimizer
## Checklist
- Use multi-stage builds
- Pin base image versions (no `latest`)
- Run as non-root user
- Combine RUN layers, clean package caches
- Use .dockerignore
- Scan for known CVEs in base image
テンプレート 5:セキュリティレビュー
---
name: security-review
description: Review code for security vulnerabilities following OWASP guidelines. Use when the user asks for security review, vulnerability scan, or before deploying to production.
---
# Security Review
## OWASP Top 10 Check
1. Injection (SQL, command, LDAP)
2. Broken authentication
3. Sensitive data exposure
4. XXE / deserialization
5. Broken access control
6. Security misconfiguration
7. XSS
8. Insecure deserialization
9. Known vulnerable components
10. Insufficient logging
## Output
Severity: Critical / High / Medium / Low / Info
Include: location, impact, remediation
テンプレート 6:API ドキュメント
---
name: api-docs-openapi
description: Generate or update OpenAPI/Swagger documentation from code. Use when documenting REST APIs, generating API specs, or working with OpenAPI files.
---
# API Documentation
## Steps
1. Scan route handlers for endpoints, methods, params
2. Generate OpenAPI 3.1 YAML with request/response schemas
3. Add examples for each endpoint
4. Document error responses (4xx, 5xx)
5. Include authentication requirements
テンプレート 7:データベースマイグレーション
---
name: migration-sql
description: Write database migration scripts with rollback support. Use when altering database schema, adding tables, or writing Flyway/Liquibase migrations.
---
# Database Migration
## Rules
- Every UP migration must have a DOWN (rollback)
- Never drop columns in production without deprecation period
- Add indexes CONCURRENTLY on PostgreSQL
- Test migration on a copy of production data
- Name: `V{version}__{description}.sql`
テンプレート 8:MCP Server 開発
---
name: mcp-server
description: Build MCP (Model Context Protocol) servers for tool integration. Use when creating MCP servers, connecting external tools to AI agents, or working with the MCP SDK.
---
# MCP Server Builder
## Structure
- Define tools with JSON Schema input/output
- Implement handlers with proper error responses
- Add authentication if connecting to external APIs
- Test with `npx @modelcontextprotocol/inspector`
- Document each tool's purpose and parameters