generic-fullstack-code-reviewerReview full-stack code for bugs, security vulnerabilities, performance issues, accessibility gaps, and CLAUDE.md compliance. Enforces TypeScript strict mode, input validation, GPU-accelerated animations, and design system consistency. Use when completing features, before commits, or reviewing pull requests.
Independent GitHub snapshot · Automated classification · Original documentation governs
Review Next.js/NestJS code against production quality standards.
Extends: Generic Code Reviewer - Read base skill for full code review methodology, P0/P1/P2 priority system, and judgment calls.
Validate by reading the diff, not by running a test/lint/build ladder; the checks below are what to look for.
Authentication & Authorization:
// Protected routes MUST have auth guard
@UseGuards(JwtAuthGuard)
@Get('profile')
getProfile(@CurrentUser() user: User) {
return this.userService.findById(user.id);
}
Input Validation (DTOs):
// All inputs validated via class-validator
export class CreateUserDto {
@IsEmail()
email: string;
@IsString()
@MinLength(8)
password: string;
}
Database Safety:
// Use Prisma, never raw SQL
// ✓ Good
await this.prisma.user.findUnique({ where: { id } });
// ✗ Bad
await this.prisma.$queryRaw`SELECT * FROM users WHERE id = ${id}`;
Server vs Client Components:
// Default: Server Component (can fetch data, no hooks)
export default async function Page() {
const data = await getData();
return <div>{data}</div>;
}
// Client: Interactive (hooks, event handlers)
'use client';
export default function Interactive() {
const [state, setState] = useState();
return <button onClick={() => setState(...)}>Click</button>;
}
API Route Patterns:
// app/api/[route]/route.ts
export async function POST(request: Request) {
const body = await request.json();
// Validate body before processing
return NextResponse.json({ success: true });
}
Shared Types:
// types/api.ts - Shared between frontend/backend
interface UserResponse {
id: string;
email: string;
createdAt: string;
}
API Contract:
# .env (never committed)
DATABASE_URL=postgres://...
JWT_SECRET=...
# Check .env.example exists with placeholder values
# Verify .gitignore includes .env
# After schema changes
npx prisma migrate dev --name description
npx prisma generate
Backend:
Frontend: