review-and-iterate

Name: review-and-iterate
Author: sendaifun

162stars45forks

How to install review-and-iterate?

sendaifun/solana-new/review-and-iterate

$npx -y skills add sendaifun/solana-new --skill review-and-iterate

Installs into the current project.

Summary

Review Solana project code for quality, security, and production readiness. Use when a user says "review my code", "is this production ready", "audit my program", "what should I fix", "code review", or "check for security issues".

Files · 1

View on GitHub

SKILL.md

1	## Preamble (run first)
2
3	```bash
4	_TEL_TIER=$(cat ~/.superstack/config.json 2>/dev/null \| grep -o '"telemetryTier": "[^"]"' \| head -1 \| sed 's/."telemetryTier": "//;s/"$//' \|\| echo "anonymous")
5	_TEL_TIER="${_TEL_TIER:-anonymous}"
6	_TEL_PROMPTED=$([ -f ~/.superstack/.telemetry-prompted ] && echo "yes" \|\| echo "no")
7	_TEL_START=$(date +%s)
8	_SESSION_ID="$$-$(date +%s)"
9	mkdir -p ~/.superstack
10	echo "TELEMETRY: $_TEL_TIER"
11	echo "TEL_PROMPTED: $_TEL_PROMPTED"
12	if [ "$_TEL_TIER" != "off" ]; then
13	_TEL_EVENT='{"skill":"review-and-iterate","phase":"build","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}'
14	echo "$_TEL_EVENT" >> ~/.superstack/telemetry.jsonl 2>/dev/null \|\| true
15	_CONVEX_URL=$(cat ~/.superstack/config.json 2>/dev/null \| grep -o '"convexUrl":"[^"]*"' \| head -1 \| cut -d'"' -f4 \|\| echo "")
16	[ -n "$_CONVEX_URL" ] && curl -s -X POST "$_CONVEX_URL/api/mutation" -H "Content-Type: application/json" -d '{"path":"telemetry:track","args":{"skill":"review-and-iterate","phase":"build","status":"success","version":"0.2.0","platform":"'$(uname -s)-$(uname -m)'","timestamp":'$(date +%s)000'}}' >/dev/null 2>&1 &
17	true
18	fi
19	```
20
21	If `TEL_PROMPTED` is `no`: Before starting the skill workflow, ask the user about telemetry.
22	Use AskUserQuestion:
23
24	> Help superstack get better! We track which skills get used and how long they take —
25	> no code, no file paths, no PII. Change anytime in `~/.superstack/config.json`.
26
27	Options:
28	- A) Sure, help superstack improve (anonymous)
29	- B) No thanks
30
31	If A: run this bash:
32	```bash
33	echo '{"telemetryTier":"anonymous"}' > ~/.superstack/config.json
34	_TEL_TIER="anonymous"
35	touch ~/.superstack/.telemetry-prompted
36	```
37
38	If B: run this bash:
39	```bash
40	echo '{"telemetryTier":"off"}' > ~/.superstack/config.json
41	_TEL_TIER="off"
42	touch ~/.superstack/.telemetry-prompted
43	```
44
45	This only happens once. If `TEL_PROMPTED` is `yes`, skip this entirely and proceed to the skill workflow.
46
47	> Wrong skill? See [SKILL_ROUTER.md](../../SKILL_ROUTER.md) for all available skills.
48
49	# Review and Iterate
50
51	## Overview
52
53	Perform a structured code review of a Solana project. Check for security vulnerabilities, code quality, compute optimization, and production readiness. Produce an actionable report with specific fixes.
54
55	## Workflow
56
57	1. Check for `.superstack/build-context.md` to understand the stack and architecture.
58	2. Scan the project structure and identify all Solana-related code.
59	3. Apply [references/code-review-rubric.md](references/code-review-rubric.md) for quality scoring.
60	4. Check against [references/security-basics.md](references/security-basics.md) for vulnerability patterns.
61	5. Evaluate optimization opportunities with [references/compute-optimization.md](references/compute-optimization.md).
62	6. Produce a review HTML artifact with findings, scores, and fix suggestions.
63
64	## Prior Context (Optional — never block on this)
65
66	If `.superstack/build-context.md` exists, use it for context. If not, proceed immediately — just review whatever code is in the current directory.
67
68	## Non-Negotiables
69
70	- Never block on missing context files. Review whatever code exists.
71	- Every finding must include a specific fix suggestion with code, not just a warning.
72	- Security issues are always flagged as critical — do not bury them in style nits.
73	- Do not generate false positives to look thorough. If the code is clean, say so.
74	- Score honestly. A "B" is fine — not everything needs to be "A".
75	- Check for the OWASP top 10 equivalent for Solana: missing signer checks, unchecked math, PDA confusion, rent drain, reinitialization attacks.
76
77	## Phase Handoff
78
79	This skill is Phase 2 (Build) in the Idea → Build → Launch journey.
80
81	Writes/Updates: `.superstack/build-context.md` (creates if missing) with:
82	- `review.security_score`: letter grade A-F
83	- `review.quality_score`: letter grade A-F
84	- `review.findings`: array of { severity, category, description, fix }
85	- `review.ready_for_mainnet`: boolean
86
87	When the review is clean, tell the user they can proceed to Phase 3 (Launch):
88	- `deploy-to-mainnet` — production deployment checklist
89	- `create-pitch-deck` — structured pitch deck
90	- `submit-to-hackathon` — hackathon submission builder
91
92	When updating `build-context.md`, deep-merge with existing content — don't overwrite fields from prior phases.
93
94	See `../../data/specs/phase-handoff.md` for the full JSON contract.
95
96	## Quick Start
97
98	```bash
99	# Run the full security checklist:
100	# See ../../data/guides/security-checklist.md for exact commands
101
102	# Quick checks:
103	grep -rn '\.unwrap()' programs/ --include="*.rs" \| grep -v test # Potential panics
104	grep -rn 'AccountInfo' programs/ --include="*.rs" \| grep -v 'Signer\\|Account<' # Missing type safety
105	grep -rn 'checked_' programs/ --incl

People who liked this also viewed

6 picks

Type

review-and-iterate

162stars45forks

View on GitHub

How to install review-and-iterate?

sendaifun/solana-new/review-and-iterate

$npx -y skills add sendaifun/solana-new --skill review-and-iterate

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Preamble (run first)
2
3	```bash
4	_TEL_TIER=$(cat ~/.superstack/config.json 2>/dev/null \| grep -o '"telemetryTier": "[^"]"' \| head -1 \| sed 's/."telemetryTier": "//;s/"$//' \|\| echo "anonymous")
5	_TEL_TIER="${_TEL_TIER:-anonymous}"
6	_TEL_PROMPTED=$([ -f ~/.superstack/.telemetry-prompted ] && echo "yes" \|\| echo "no")
7	_TEL_START=$(date +%s)
8	_SESSION_ID="$$-$(date +%s)"
9	mkdir -p ~/.superstack
10	echo "TELEMETRY: $_TEL_TIER"
11	echo "TEL_PROMPTED: $_TEL_PROMPTED"
12	if [ "$_TEL_TIER" != "off" ]; then
13	_TEL_EVENT='{"skill":"review-and-iterate","phase":"build","event":"started","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'"}'
14	echo "$_TEL_EVENT" >> ~/.superstack/telemetry.jsonl 2>/dev/null \|\| true
15	_CONVEX_URL=$(cat ~/.superstack/config.json 2>/dev/null \| grep -o '"convexUrl":"[^"]*"' \| head -1 \| cut -d'"' -f4 \|\| echo "")
16	[ -n "$_CONVEX_URL" ] && curl -s -X POST "$_CONVEX_URL/api/mutation" -H "Content-Type: application/json" -d '{"path":"telemetry:track","args":{"skill":"review-and-iterate","phase":"build","status":"success","version":"0.2.0","platform":"'$(uname -s)-$(uname -m)'","timestamp":'$(date +%s)000'}}' >/dev/null 2>&1 &
17	true
18	fi
19	```
20
21	If `TEL_PROMPTED` is `no`: Before starting the skill workflow, ask the user about telemetry.
22	Use AskUserQuestion:
23
24	> Help superstack get better! We track which skills get used and how long they take —
25	> no code, no file paths, no PII. Change anytime in `~/.superstack/config.json`.
26
27	Options:
28	- A) Sure, help superstack improve (anonymous)
29	- B) No thanks
30
31	If A: run this bash:
32	```bash
33	echo '{"telemetryTier":"anonymous"}' > ~/.superstack/config.json
34	_TEL_TIER="anonymous"
35	touch ~/.superstack/.telemetry-prompted
36	```
37
38	If B: run this bash:
39	```bash
40	echo '{"telemetryTier":"off"}' > ~/.superstack/config.json
41	_TEL_TIER="off"
42	touch ~/.superstack/.telemetry-prompted
43	```
44
45	This only happens once. If `TEL_PROMPTED` is `yes`, skip this entirely and proceed to the skill workflow.
46
47	> Wrong skill? See [SKILL_ROUTER.md](../../SKILL_ROUTER.md) for all available skills.
48
49	# Review and Iterate
50
51	## Overview
52
53	Perform a structured code review of a Solana project. Check for security vulnerabilities, code quality, compute optimization, and production readiness. Produce an actionable report with specific fixes.
54
55	## Workflow
56
57	1. Check for `.superstack/build-context.md` to understand the stack and architecture.
58	2. Scan the project structure and identify all Solana-related code.
59	3. Apply [references/code-review-rubric.md](references/code-review-rubric.md) for quality scoring.
60	4. Check against [references/security-basics.md](references/security-basics.md) for vulnerability patterns.
61	5. Evaluate optimization opportunities with [references/compute-optimization.md](references/compute-optimization.md).
62	6. Produce a review HTML artifact with findings, scores, and fix suggestions.
63
64	## Prior Context (Optional — never block on this)
65
66	If `.superstack/build-context.md` exists, use it for context. If not, proceed immediately — just review whatever code is in the current directory.
67
68	## Non-Negotiables
69
70	- Never block on missing context files. Review whatever code exists.
71	- Every finding must include a specific fix suggestion with code, not just a warning.
72	- Security issues are always flagged as critical — do not bury them in style nits.
73	- Do not generate false positives to look thorough. If the code is clean, say so.
74	- Score honestly. A "B" is fine — not everything needs to be "A".
75	- Check for the OWASP top 10 equivalent for Solana: missing signer checks, unchecked math, PDA confusion, rent drain, reinitialization attacks.
76
77	## Phase Handoff
78
79	This skill is Phase 2 (Build) in the Idea → Build → Launch journey.
80
81	Writes/Updates: `.superstack/build-context.md` (creates if missing) with:
82	- `review.security_score`: letter grade A-F
83	- `review.quality_score`: letter grade A-F
84	- `review.findings`: array of { severity, category, description, fix }
85	- `review.ready_for_mainnet`: boolean
86
87	When the review is clean, tell the user they can proceed to Phase 3 (Launch):
88	- `deploy-to-mainnet` — production deployment checklist
89	- `create-pitch-deck` — structured pitch deck
90	- `submit-to-hackathon` — hackathon submission builder
91
92	When updating `build-context.md`, deep-merge with existing content — don't overwrite fields from prior phases.
93
94	See `../../data/specs/phase-handoff.md` for the full JSON contract.
95
96	## Quick Start
97
98	```bash
99	# Run the full security checklist:
100	# See ../../data/guides/security-checklist.md for exact commands
101
102	# Quick checks:
103	grep -rn '\.unwrap()' programs/ --include="*.rs" \| grep -v test # Potential panics
104	grep -rn 'AccountInfo' programs/ --include="*.rs" \| grep -v 'Signer\\|Account<' # Missing type safety
105	grep -rn 'checked_' programs/ --incl

People who liked this also viewed

6 picks

Type