# Cloudbase Code Review

Code review and validation for CloudBase projects.

- Repository: https://github.com/TencentCloudBase/CloudBase-AI-Toolkit (1153 stars)
- Category: Data and ML
- License: MIT
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add TencentCloudBase/CloudBase-AI-Toolkit --skill cloudbase-code-review -g -a claude-code -y`
Codex: `npx skills add TencentCloudBase/CloudBase-AI-Toolkit --skill cloudbase-code-review -g -a codex -y`
Cursor: `npx skills add TencentCloudBase/CloudBase-AI-Toolkit --skill cloudbase-code-review -g -a cursor -y`
Gemini CLI: `npx skills add TencentCloudBase/CloudBase-AI-Toolkit --skill cloudbase-code-review -g -a gemini-cli -y`
Claude Code plugin marketplace: `/plugin marketplace add TencentCloudBase/CloudBase-AI-Toolkit`

## Description

Code review and validation for CloudBase projects. After writing code for Web / miniprogram / CloudRun / cloud-function projects, call this skill to check for known pitfalls, auth guard misuse, missing database tables, RLS misconfiguration, storage domain setup, and SDK API misuse. Supports automated lint scripts (regex-based) + LLM semantic review.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

## Sibling skills (local only)

Sibling CloudBase skills ship beside this skill. Use local relative paths such as `../auth-tool-cloudbase/SKILL.md`.

If a referenced sibling skill file is missing from this environment, ask the user to install the full CloudBase plugin (or the missing skill). Do **not** HTTP-fetch remote skill or protocol markdown into the agent context.

# CloudBase Code Review

> **One-liner**: After implementing CloudBase features, call this skill to catch common mistakes before users do.

## When to use

Call this skill **after** completing a CloudBase implementation task, before declaring done:

- You implemented auth (login / register / route guard)
- You created database tables or wrote CRUD (NoSQL / PostgreSQL / MySQL)
- You set up CloudBase Storage (file upload, hosting)
- You configured security rules or RLS policies
- You wrote MCP-dependent code
- You wrote Cloud Function or CloudRun HTTP handlers (check for credential / header echo leaks)

## How it works

The skill runs in two layers:

| Layer | Method | Speed | What it catches |
|-------|--------|-------|-----------------|
| **Lint (optional)** | No executable script is shipped. If the user approves running lint, review the code block in `references/lint-rules/README.md`, copy it to a temporary local `cloudbase-lint.mjs`, then run `node cloudbase-lint.mjs --project-dir <path>` | Seconds | Deterministic regex checks, wrong API calls, missing configs, pattern mismatches |
| **LLM review** | Read each rule's "LLM 检查" section, inspect code semantically | Variable | Semantic issues, route guard logic, RLS completeness, architecture-level problems |

## Rule index

See `references/RULES_INDEX.md` for the full matrix (module × frontend type → applicable rules).

## Rule boundary

The rest: https://github.com/TencentCloudBase/CloudBase-AI-Toolkit/blob/HEAD/config/.claude/skills/cloudbase-code-review/SKILL.md