Code Review & Quality for Claude Code

Cost-optimized code generator using tiered model routing — cheap models for boilerplate, mid-tier for logic, high-tier only for security-critical paths. Use when generating bulk code on a budget. Trigger with \"generate code cheaply\", \"draft the implementation\".

Validates URLs, detects broken links, updates redirects to final destinations, and enriches resource collections with accurate descriptions. Use when checking link health in HTML/Markdown or curating a link directory. Trigger with \"check the links\", \"fix broken URLs\".

Coordinates the session-end hygiene suite — scout, repo cleanup, status logging, and snippet harvesting — to leave a codebase clean and documented between sessions. Use when wrapping up a session or reaching a milestone. Trigger with \"checkpoint\", \"I'm done for today\".

Runs the full product pipeline from raw idea to validated code — business plan, PRD, full-stack or cost-optimized code generation, and final code review. Use when taking an idea through to a working implementation. Trigger with \"build this product idea\", \"take this from idea to code\".

Coordinates specialized sub-agents to audit, build, or refactor Python projects (Flask apps, CLI tools, libraries, scripts). Use when starting or reviewing a Python codebase and needing end-to-end coverage. Trigger with \"audit this Python project\", \"build a Python tool\".

Coordinates accessibility, performance, API design, and dependency audit agents in parallel to produce a scored quality report. Use when running a pre-release gate or investigating multi-domain quality issues. Trigger with \"run a quality audit\", \"check this app for quality issues\".

Coordinates backend (Flask/API/DB), frontend (React/design/a11y), and quality agents to build or audit full-stack web applications. Use when building a new web app end-to-end or running a comprehensive web audit. Trigger with \"build this web application\", \"audit my web app\".

Cleans up repositories by auditing git state, fixing .gitignore, archiving temp files, and organizing uncommitted changes into atomic, well-described commits. Use when wrapping up a session, preparing a PR, or finding the repo state messy. Trigger with \"clean up this repo\", \"organize my uncommitted changes\".

Makes minimal, surgical edits to complex or large files with zero collateral damage — mapping dependencies, preserving invariants, and verifying syntax after each atomic change. Use when fixing bugs or adding features in high-risk code (auth, DB transactions, concurrent logic). Trigger with \"make a precise change to this file\", \"surgical fix for this bug\".

Systematically scans a project for issues, applies safe non-breaking quick fixes (typos, whitespace, unused imports), and generates a prioritized improvement report with HTML output. Use when starting on a codebase after time away or running a mid-session health check. Trigger with \"scout this project\", \"scan for quick wins\".

Harvests reusable code patterns from projects into a categorized snippet library, deduplicates existing entries, and updates the searchable JSON index and HTML GUI. Use when completing an integration or noticing duplicate patterns across projects. Trigger with \"harvest snippets from this project\", \"organize the snippet library\".

Modernizes deprecated API usage, old syntax patterns (var, prototype, XMLHttpRequest), unnecessary polyfills, and compatibility shims — always checking platform targets first to avoid over-modernizing. Use when upgrading a codebase to current Node/browser targets or removing old Babel polyfills. Trigger with \"remove legacy code\", \"modernize deprecated APIs\".

Validates test suite quality by running mutation testing tools (Stryker, mutmut, PITest) and analyzing survived mutants to identify under-tested logic paths — outputting kill rates and targeted recommendations for filling gaps. Use when code coverage looks healthy but test confidence is still low. Trigger with \"run mutation tests\", \"find test gaps with mutation testing\".

Generate ORM entity classes, migration files, and relationship definitions for TypeORM, Prisma, SQLAlchemy, Django ORM, Hibernate, and more from database schemas or requirements. Use when bootstrapping data models, migrating between ORMs, or generating code for a new API. Trigger with \"generate ORM models\", \"create entity classes\".

Scans codebases for N+1 queries, blocking I/O in async handlers, bundle bloat, unnecessary React re-renders, and O(n²) algorithm patterns — classifying findings by impact before flagging for human review. Use when profiling reveals hot paths or before a performance-focused sprint. Trigger with \"find performance issues\", \"audit N+1 queries\".

Use when reviewing hot paths, algorithmic complexity, caching, bundle size, or anything with a latency/throughput budget — verifies performance against the performance persona standards.

Phase 1 of the BigQuery schema optimization pipeline — parses schema export files to count tables and fields, detect naming patterns and type inconsistencies, flag duplicate or nullable issues, and write a markdown analysis report plus strict JSON for phase 2. Use when starting a BigQuery schema audit from raw exports. Trigger with \"run schema phase 1\", \"analyze BigQuery schema\".

Architects multi-language SDKs with idiomatic patterns per language, typed error handling, auto-pagination, and consistent cross-language interfaces — generated and hand-polished. Use when designing a new SDK surface, reviewing an existing SDK for ergonomics, or auditing coverage gaps across languages. Trigger with \"design the SDK architecture\", \"review this SDK\".

Risk-maps codebases and writes the actual test code — integration tests on critical paths, Playwright E2E for user journeys, flaky test triage, and CI gating — using the testing trophy over the pyramid. Use when a codebase has no test strategy, CI is slow/flaky, or a critical path has zero coverage. Trigger with \"write the tests\", \"triage our flaky tests\".

Maintains and runs an automated API and unit test suite (pytest, Jest, Vitest) against the sprint API contract, reports coverage gaps and failures in a structured QA REPORT. Use when validating backend implementation or expanding regression coverage. Trigger with "run QA tests", "validate API contract".

Code quality, testing, and validation enforcement specialist

Scan mapped GitHub repos for issue matches, recent commits, affected paths, and deploy changes. Use when gathering evidence for bug clusters after clustering step.

Scores codebase health by combining cyclomatic complexity, git churn, and test coverage metrics, then ranks refactoring candidates by business impact. Use when prioritizing technical debt or planning a refactor sprint. Trigger with "analyze code health", "what should I refactor".

Writes runnable code samples and tutorials that get developers to first success fast — real values, error handling, expected output, language parity. Use when creating or reviewing API examples and quickstarts. Trigger with \"write a code sample\", \"create a quickstart guide\".

Integrates SAST/DAST tooling into the SDLC — Semgrep rules, CodeQL, OWASP ZAP, and secure code review covering the full OWASP Top 10. Use when adding security scanning to a pipeline or fixing a security finding. Trigger with \"set up SAST scanning\", \"fix this security finding\".

Designs and reviews API schemas (OpenAPI 3.1, GraphQL, gRPC) for consistency, naming conventions, and developer ergonomics — the schema is the source of truth for docs, SDKs, and contract tests. Use when designing a new API or auditing an existing spec. Trigger with \"design this API schema\", \"review my OpenAPI spec\".

Use when the chain needs the codebase mapped — locating implementations, call sites, conventions, or affected surfaces — before analysis or implementation. The surface-mapping investigator.

OWASP Top 10 vulnerability scanner and security code reviewer that identifies injection flaws, auth failures, misconfigurations, and crypto weaknesses with CWE-mapped findings and remediation code. Use when you need a security audit, vulnerability scan, or code review for security issues. Trigger with \"security audit\", \"scan for vulnerabilities\".

Scans code for security vulnerabilities (OWASP Top 10, injection, auth flaws, insecure dependencies) and delivers severity-ranked findings with remediation guidance. Use when reviewing authentication logic, APIs, or any security-sensitive code. Trigger with "security review", "audit this code".

Audit and fix Claude Code SKILL.md files against enterprise compliance standards: frontmatter completeness, required body sections, and style. Use when validating or repairing skills in a plugin directory. Trigger with "audit skill", "fix skill compliance".

Identifies and removes AI-generated comment noise — restating comments, obvious JSDoc, filler section markers, and preamble boilerplate — while preserving every comment that explains why, documents a workaround, or captures business logic. Use when a codebase has been heavily AI-assisted and comment quality has degraded. Trigger with \"remove slop comments\", \"clean up AI-generated comments\".

Finds duplicate and near-duplicate TypeScript type/interface definitions across a codebase, consolidates them into a shared module using Pick/Omit/Partial utility types, updates all import sites, and verifies with tsc --noEmit. Use when type definitions have proliferated across modules with heavy overlap. Trigger with \"consolidate types\", \"find duplicate interfaces\".

Implement comprehensive data validation at database and application layers — type, range, format, referential integrity, and custom business-rule checks. Use when adding validation to a schema, enforcing data quality constraints, or auditing existing validation coverage. Trigger with \"add data validation\", \"implement validation rules\".

Adversarially verifies specialist analytics agent outputs — checks every number against raw data, flags hallucinated insights, logical contradictions, and sampling bias before the report reaches the user. Use when quality-gating an analytics pipeline before final delivery. Trigger with \"verify analytics outputs\", \"quality check the report\".

Visual brand reviewer. Checks any generated asset against the brand profile — palette exactness, contrast/accessibility, logo clear-space, and typography — returns a pass/fix scorecard, and flags anything it cannot verify. Use as the final pass before an asset is delivered.

Replaces explicit any, implicit any, overly broad object/{} types, and unconstrained unknowns with precise compiler-verified types — inferring the correct type from usage patterns and verifying every change via tsc --noEmit. Use when enabling noImplicitAny or tightening an existing TypeScript codebase. Trigger with \"eliminate any types\", \"strengthen TypeScript types\".

你是团队中的编码开发专家。你的职责是把需求转化为高质量、可运行的代码。

Blind Comparator Agent