---
name: code-review
description: Review code changes for quality, security, and best practices. Use when reviewing pull requests, diffs, or when the user asks for a code review.
---
# Code Review
## Checklist
1. Read the full diff before commenting
2. Check for security issues (injection, XSS, secrets)
3. Verify error handling on all external calls
4. Confirm tests cover new logic
5. Flag breaking API changes
## Output Format
- **Critical**: must fix before merge
- **Suggestion**: optional improvement
- **Praise**: well-done patterns worth keeping
模板 2:Commit Message
---
name: commit-message
description: Generate descriptive commit messages following Conventional Commits. Use when the user asks to write commit messages or review staged changes.
---
# Commit Message Generator
## Format
`<type>(<scope>): <subject>`
Types: feat, fix, docs, style, refactor, test, chore
## Rules
- Subject ≤ 72 characters, imperative mood
- Body explains WHY, not WHAT
- Reference issue numbers when applicable
模板 3:單元測試
---
name: unit-test-writer
description: Write unit tests for given code using the project's existing test framework. Use when the user asks to add tests, improve coverage, or test a function.
---
# Unit Test Writer
## Steps
1. Identify the project's test framework (Jest, pytest, Go test, etc.)
2. Read existing test files for patterns and conventions
3. Cover: happy path, edge cases, error paths
4. Use descriptive test names: `should_<expected>_when_<condition>`
5. Mock external dependencies, not the unit under test
模板 4:Dockerfile 最佳化
---
name: dockerfile-optimize
description: Optimize Dockerfiles for smaller image size, faster builds, and security. Use when working with Docker, containerization, or image optimization.
---
# Dockerfile Optimizer
## Checklist
- Use multi-stage builds
- Pin base image versions (no `latest`)
- Run as non-root user
- Combine RUN layers, clean package caches
- Use .dockerignore
- Scan for known CVEs in base image
模板 5:安全審查
---
name: security-review
description: Review code for security vulnerabilities following OWASP guidelines. Use when the user asks for security review, vulnerability scan, or before deploying to production.
---
# Security Review
## OWASP Top 10 Check
1. Injection (SQL, command, LDAP)
2. Broken authentication
3. Sensitive data exposure
4. XXE / deserialization
5. Broken access control
6. Security misconfiguration
7. XSS
8. Insecure deserialization
9. Known vulnerable components
10. Insufficient logging
## Output
Severity: Critical / High / Medium / Low / Info
Include: location, impact, remediation
模板 6:API 文件
---
name: api-docs-openapi
description: Generate or update OpenAPI/Swagger documentation from code. Use when documenting REST APIs, generating API specs, or working with OpenAPI files.
---
# API Documentation
## Steps
1. Scan route handlers for endpoints, methods, params
2. Generate OpenAPI 3.1 YAML with request/response schemas
3. Add examples for each endpoint
4. Document error responses (4xx, 5xx)
5. Include authentication requirements
模板 7:資料庫遷移
---
name: migration-sql
description: Write database migration scripts with rollback support. Use when altering database schema, adding tables, or writing Flyway/Liquibase migrations.
---
# Database Migration
## Rules
- Every UP migration must have a DOWN (rollback)
- Never drop columns in production without deprecation period
- Add indexes CONCURRENTLY on PostgreSQL
- Test migration on a copy of production data
- Name: `V{version}__{description}.sql`
模板 8:MCP Server 開發
---
name: mcp-server
description: Build MCP (Model Context Protocol) servers for tool integration. Use when creating MCP servers, connecting external tools to AI agents, or working with the MCP SDK.
---
# MCP Server Builder
## Structure
- Define tools with JSON Schema input/output
- Implement handlers with proper error responses
- Add authentication if connecting to external APIs
- Test with `npx @modelcontextprotocol/inspector`
- Document each tool's purpose and parameters