Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Agents should invoke this skill when choosing patterns, designing traits/interfaces/components, deciding abstraction boundaries, evaluating dependency injection/callbacks, or comparing implementation approaches in Rust, TypeScript/React, or Django/Python.
インストール方法を見るインストールする前に、エージェントに与えられる指示の中身を確認できます。
Pattern recommendations tailored to common tech stacks. Every pattern recommendation includes when to use it, when to avoid it, and the trade-offs.
The golden rule: Patterns are tools, not goals. Use the simplest pattern that solves the problem. If no pattern fits, a plain function or struct is fine.
Wrap a primitive to add type safety and domain meaning.
struct UserId(u64);
struct OrderId(u64);
// Now the compiler prevents mixing up UserId and OrderId
fn get_order(user: UserId, order: OrderId) -> Order { ... }
When to use: When two values have the same underlying type but different meanings. When to skip: One-off uses where a type alias suffices.
Construct complex objects step by step.
let config = ServerConfig::builder()
.host("localhost")
.port(8080)
.max_connections(100)
.build()?;
When to use: Structs with many optional fields, complex construction logic.
When to skip: Structs with 1-3 required fields — just use new().
Encode state transitions in the type system so invalid states are unrepresentable.
struct Connection<S: State> { /* ... */ state: PhantomData<S> }
struct Disconnected;
struct Connected;
struct Authenticated;
impl Connection<Disconnected> {
fn connect(self) -> Result<Connection<Connected>> { ... }
}
impl Connection<Connected> {
fn authenticate(self, creds: &Credentials) -> Result<Connection<Authenticated>> { ... }
}
impl Connection<Authenticated> {
fn query(&self, sql: &str) -> Result<Rows> { ... }
}
// Can't call query() on a Disconnected connection — compile error
When to use: Protocols with clear state transitions (connections, workflows, parsing stages). When to skip: Simple on/off states — a boolean or enum is clearer.
| Approach | Dispatch | Binary Size | Flexibility |
|---|---|---|---|
impl Trait (generics) | Static (monomorphized) | Larger (one copy per type) | Known at compile time |
dyn Trait (trait objects) | Dynamic (vtable) | Smaller (one copy) | Extensible at runtime |
Use generics when: Performance matters, types are known at compile time, you want zero-cost abstraction. Use trait objects when: You need heterogeneous collections, plugin systems, or the set of types is open-ended.
| Pattern | When | Crate |
|---|---|---|
thiserror | Library errors — structured, specific variants | thiserror |
anyhow | Application errors — context-rich, propagate quickly | anyhow |
| Custom enum | When you need exhaustive matching by callers | std only |
Rule of thumb: Libraries use thiserror (callers need to match). Applications use anyhow (callers need context).
Components that work together implicitly via shared context.
<Select>
<Select.Trigger>Choose a fruit</Select.Trigger>
<Select.Options>
<Select.Option value="apple">Apple</Select.Option>
<Select.Option value="banana">Banana</Select.Option>
</Select.Options>
</Select>
When to use: Complex UI components with multiple related parts (menus, accordions, tabs). When to skip: Simple components with 1-2 elements.
Extract and compose behavior into reusable hooks.
function useDebounce<T>(value: T, delay: number): T { ... }
function usePagination(items: Item[], pageSize: number) { ... }
function useLocalStorage<T>(key: string, initial: T) { ... }
When to use: Shared stateful logic across components, complex state management within a component. When to skip: One-off logic that doesn't repeat.
Type-safe state modeling using TypeScript's union types.
type AsyncState<T> =
| { status: "idle" }
| { status: "loading" }
| { status: "success"; data: T }
| { status: "error"; error: Error };
// Exhaustive switch — TypeScript ensures all cases handled
function render(state: AsyncState<User>) {
switch (state.status) {
case "idle": return <Placeholder />;
case "loading": return <Spinner />;
case "success": return <UserCard user={state.data} />;
case "error": return <ErrorBanner error={state.error} />;
}
}
When to use: State machines, API response states, form states, anything with distinct modes. When to skip: Boolean flags are fine for simple on/off states.
useState / useReduceruseReducer + ContextSeparate business logic from views and models.
# services/order_service.py
class OrderService:
@staticmethod
def create_order(user: User, items: list[CartItem]) -> Order:
"""Business logic lives here, not in the view."""
order = Order.objects.create(user=user, total=calculate_total(items))
OrderItem.objects.bulk_create([...])
send_confirmation_email(user, order)
return order
When to use: Business logic that involves multiple models, external calls, or complex validation. When to skip: Simple CRUD with no business rules beyond Django's built-in validation.
Custom managers and querysets to encapsulate query logic.
class PublishedManager(models.Manager):
def get_queryset(self):
return super().get_queryset().filter(status="published")
class Article(models.Model):
objects = models.Manager() # Default
published = PublishedManager() # Article.published.all()
When to use: Complex or reusable query logic, domain-specific filtering. When to skip: One-off queries or simple filters.
| Approach | Pros | Cons |
|---|---|---|
| Django signals | Decoupled, works across apps | Hidden control flow, hard to debug, ordering issues |
| Explicit calls | Visible, debuggable, testable | Coupling between modules |
Rule of thumb: Use signals for truly cross-cutting concerns (audit logging, cache invalidation). Use explicit calls for business-critical logic where you need to understand and test the flow.
| Anti-Pattern | Problem | Fix |
|---|---|---|
| Premature abstraction | Abstracting before seeing the pattern repeat | Wait for 3 instances before extracting |
| Inheritance over composition | Deep inheritance hierarchies, fragile base class | Prefer composition (traits, hooks, mixins) |
| God object | One class/module that does everything | Split by responsibility (SRP) |
| Shotgun surgery | One change requires editing many files | Group related code together |
| Feature envy | A function uses another class's data more than its own | Move the function to the class it envies |
| Speculative generality | Building for use cases that may never come | YAGNI — build for now, refactor when needed |
| Golden hammer | Using the same pattern/tool for everything | Choose the right tool for the job |
When asked "which pattern should I use?":
Cross-reference this pack's code-architect skill for structural/architecture assessment and code-quality for the complexity thresholds that motivate refactoring toward a pattern.
まだレビューはありません。使ってみた感想をお寄せください。
概要と使いどころ
Audit GitHub Actions that run AI agents for prompt injection, unsafe interpolation, sandbox gaps, and permissive actor rules. Use for agentic CI workflows, not general application code review.
日本語の概要は準備中です。原文の説明を表示しています。
Audit and improve project-rules files (AGENTS.md, CLAUDE.md, .agents/instructions, local overrides) so the agent keeps accurate project context. Use when the user asks to check, audit, review, update, improve, or fix their AGENTS.md or CLAUDE.md, mentions "project rules maintenance" or "agent context optimization", or when the codebase has changed enough that the rules file may be stale. Scans the repository for every rules file, grades each against a quality rubric, outputs a quality report, and applies targeted edits only after user approval.
日本語の概要は準備中です。原文の説明を表示しています。
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future sessions benefit. Use when the user says "revise the rules", "update AGENTS.md / CLAUDE.md with what we just learned", "save this to project memory", "remember this for next time", or at the end of a productive session when valuable context has emerged that is not yet documented. This complements agents-md-improver — improver audits, while this one captures.
日本語の概要は準備中です。原文の説明を表示しています。
Operational rubric that turns "don't make AI slop" into observable properties, severity levels, evidence requirements, and repair actions for interface design. Use as the reference rubric when building or reviewing marketing sites, product interfaces, dashboards, portfolios, or e-commerce pages, especially alongside frontend-design.
日本語の概要は準備中です。原文の説明を表示しています。
Design a feature architecture by analyzing existing codebase patterns and conventions, then provide a comprehensive implementation blueprint with specific files to create or modify, component designs, data flows, and a build sequence. Use this skill when the user asks for an architecture design, an implementation plan for a non-trivial feature, or when dispatched as a sub-task during feature-dev architecture phase.
日本語の概要は準備中です。原文の説明を表示しています。
Deeply analyze an existing codebase feature by tracing execution paths, mapping architecture layers, understanding patterns and abstractions, and documenting dependencies. Use this skill when you need to understand how a feature works before modifying or extending it, when dispatched as a sub-task during feature-dev exploration, or when the user asks "how does X work in this codebase".
日本語の概要は準備中です。原文の説明を表示しています。