# Javimontano Jm Adk Alfa Code Review Checklist > Code Review Checklist - Skill: `tomevault-io/javimontano-jm-adk-alfa-code-review-checklist` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add tomevault-io/javimontano-jm-adk-alfa-code-review-checklist` - Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/javimontano-jm-adk-alfa-code-review-checklist/raw - Safety review: pending (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: tomevault-io (https://skillmd.com/u/tomevault-io) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/tomevault-io/javimontano-jm-adk-alfa-code-review-checklist --- # Code Review Checklist ## Purpose Use this skill to run a repeatable checklist over supplied code-review evidence. The skill is read-only: it may inspect code, diffs, rules, package manifests, test output, CI output, and audit reports, but it does not edit target code. [CONFIG] ## Deterministic Resources - `assets/manifest.json` declares every deterministic asset. [CÓDIGO] - `assets/activation-policy.json` defines activation and missing-input routing. [CÓDIGO] - `assets/checklist-taxonomy.json` defines fixed checklist IDs, domains, blocking behavior, statuses, and decision rules. [CÓDIGO] - `assets/evidence-policy.json` defines evidence tags and required source fields. [CÓDIGO] - `assets/report-contract.json` defines the JSON report shape. [CÓDIGO] - `assets/source-boundary-policy.json` defines read-only scope, hotfix handling, and forbidden behaviors. [CÓDIGO] - `scripts/check.sh` runs deterministic validator fixtures. [CÓDIGO] ## When To Activate Activate when the user asks for a code review checklist, PR checklist, OWASP review, Firebase review, TypeScript review checklist, performance review checklist, or merge-readiness checklist for code artifacts. [CONFIG] Do not activate for generic product reviews, book reviews, service reviews, or non-code checklists unless the user supplies code artifacts. If no code, diff, PR, branch, rules file, package manifest, test output, or audit report is available, return `needs_context` with minimum inputs instead of inventing checklist results. [CONFIG] ## Checklist Domains ### Security - `SEC-01`: No secrets in code; use environment variables or Secret Manager. - `SEC-02`: User-controlled HTML is sanitized before `dangerouslySetInnerHTML`. - `SEC-03`: Firestore rules enforce authentication and least privilege. - `SEC-04`: CORS does not allow wildcard origins for production endpoints. - `SEC-05`: Dependency audit has no high or critical vulnerabilities. ### Performance And Firebase - `FB-01`: Firestore reads use `limit()`, pagination, or a bounded query plan. - `FB-02`: Firestore reads are not executed inside unbounded loops. - `PERF-03`: Images use optimized formats, lazy loading, or responsive sizing when image changes are in scope. - `PERF-04`: New dependencies above 50KB are justified or split. - `FB-05`: Cloud Functions minimize cold-start cost through scoped imports or lazy initialization. ### Quality And Types - `QUAL-01`: No new `any` types without a documented boundary and type guard. - `QUAL-02`: No `@ts-ignore`, `eslint-disable`, or suppression without ticket or policy evidence. - `QUAL-03`: Changed functions/files remain within stated size policy unless generated code or documented exception applies. - `QUAL-04`: Naming is intention-revealing for changed public code. - `QUAL-05`: Error handling is explicit; catches are not silently swallowed. ## Output Contract Preferred output is JSON matching `assets/report-contract.json`. Markdown reports must preserve these sections: 1. `# Code Review Checklist Report` 2. `## Scope` 3. `## Scores` 4. `## Checklist Results` 5. `## Findings` 6. `## Missing Evidence` 7. `## Validation` 8. `## Decision` 9. `## Risks and Limits` Every checklist result must include `id`, `domain`, `status`, `evidence_tag`, `source.file`, `source.line`, and `why`. Status values are `pass`, `fail`, `not_applicable`, and `not_verified`. [CONFIG] ## Validation Gate - Any failing security item (`SEC-*`) blocks merge. [CONFIG] - Failing `FB-01`, `FB-02`, `QUAL-01`, or `QUAL-02` blocks merge. [CONFIG] - Missing minimum input produces `needs_context`, not a guessed checklist. [CONFIG] - Clean PRs must include positive evidence and must not fabricate findings. [CONFIG] - Hotfix reviews may run only security plus critical Firebase/performance gates, but must record a full-review follow-up within 48 hours. [CONFIG] - Reports must pass `bash skills/code-review-checklist/scripts/check.sh` before this skill can be marked complete. [CÓDIGO] ## Decision Rules - `request_changes`: one or more blocking checklist failures. - `approve_with_comments`: non-blocking failures only. - `approve`: no failures, no missing required evidence, and positive evidence exists. - `needs_context`: minimum inputs are missing. ## Anti-Patterns - Treating style preferences as blockers without policy evidence. - Approving despite a failed security, unbounded Firestore, `any`, or unapproved suppression gate. - Treating safe React JSX escaping as an XSS finding. - Flagging batched Firestore reads as loop reads. - Loading remote assets or using implicit current dates in report templates. - Using `Write` or `Edit` tools while performing checklist review. ## Assumptions & Limits - The checklist validates supplied artifacts only. [CONFIG] - It cannot prove runtime safety outside inspected code, tests, CI, rules, audit output, or user-supplied evidence. [CONFIG] - It complements `code-review`; it does not replace deeper implementation review or `audit-security` for specialized security audits. [CONFIG] --- > Source: [JaviMontano/jm-adk-alfa](https://github.com/JaviMontano/jm-adk-alfa) — distributed by [TomeVault](https://tomevault.io).