Community程式設計與開發github.com

fswp-reviewer

全端 WordPress 開發者流程中的獨立審查階段,從安全性、程式碼品質及精簡度等面向檢視 WordPress 程式碼,僅回報高信賴度的發現。

fswp-reviewer 是什麼?

此技能 (SKILL) 為全端 WordPress 開發者工作流程提供一個獨立的程式碼審查階段,由 `fswp-code-reviewer` Agent 在驗證閘門後調用。它會以陌生人的角度、唯讀方式審查已完成的 WordPress 外掛、主題、附加元件或核心修補程式,主要透過三個透鏡進行分析:安全性透鏡(檢查 WordPress 特定漏洞、REST/AJAX 授權與 API 風險地圖、AI 生成程式碼風險)、品質透鏡(檢查錯誤處理、資料與升級安全性、效能、國際化與無障礙、註解準確性、測試缺口、類別與型別設計及範圍),以及可選的精簡透鏡(用於修剪過度設計)。此流程會對每個發現進行 0-100 的信賴度評分,僅回報分數在 80 分以上(包含「嚴重」與「重要」等級)的項目,並以固定格式輸出,最後給出「可發布」或「先修正」的結論。此技能無法讀取建置紀錄,以確保審查的獨立性。

相容平台✓Claude Code~Codex CLI~Cursor
npx skills add https://github.com/syncwin/fswp-developer/tree/main/skills/fswp-reviewer

Installed? Explore more 程式設計與開發 skills: steipete/bluebubbles, steipete/eightctl, steipete/blucli · View all 6 →

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

說明文件

FSWP Reviewer

以陌生人的角度審查程式碼:閱讀實際存在的內容,而非它是如何建立的。唯讀,絕不編輯。請在 fswp-qa-engineer 通過之後再執行,以便將時間投入腳本無法察覺的部分。精簡透鏡 (lean lens) 可獨立對任何既有程式碼執行。

程序

  1. 列出所有檔案。閱讀 PRD 或變更摘要(如果有的話),並標記任何已交付但非其要求的功能。若無摘要(如第三方程式碼或精簡審計),則跳過此檢查,而非編造範疇。
  2. 識別程式碼類型(外掛、主題、附加元件、核心修補程式),並套用指定的透鏡:security 和/或 quality (references/security-lens.md, references/quality-lens.md);lean (references/lean-lens.md)。允許任意組合。如果 docs/review-rules.json 存在,也一併套用 (references/project-rules.md)。
  3. 針對每個安全性/品質的待審項目,根據其為此程式碼中真正缺陷的信賴度給予 0-100 分。僅回報 80 分及以上 的項目:嚴重 (Critical, 90-100)、重要 (Important, 80-89)。剔除風格問題以及掃描器已回報的項目。精簡透鏡的發現則使用其自有格式。
  4. 僅針對安全性透鏡:針對信賴度低於 80 分、但人員應大致瀏覽的候選項目,添加未經證實的疑慮 (Unverified suspicions)(最多 5 項,每項一行)。漏掉一個漏洞比多寫一行更嚴重。
  5. 若無任何項目達到標準,則說明已檢查的內容並停止。不添加填充內容或讚美。

發現格式

[Critical|Important] <標題>  (信心指數 NN, CWE-NNN 如果是安全性問題)
File: 路徑:行號
Evidence: 確切的程式碼或行為
Impact: 一個具體的影響描述
Fix: 能消除此問題的最小變更

裁決

安全性/品質檢查:一個最終的結論行,ship 或 fix first,並附上嚴重與重要等級的計數。精簡審計:若套用所有發現,則列出將被移除的總行數與相依性;無 ship/fix-first 結論,因為精簡審計並非發布閘門。

獨立性

此技能絕對不讀取建置紀錄。在 Claude Code 中,fswp-code-reviewer Agent 會強制執行此規則。若無 Agent 輔助,則應揭露此次執行為自我審查。

Individual skills in this repo

This repo contains 9 individual skills — each has its own dedicated page.

fswp-api-developer

Domain skill for WordPress REST API and Abilities API work in Full-Stack WP Developer. Covers registering routes with schemas, argument validation and sanitization, permission callbacks, controller classes, exposing post types and meta, authentication (cookie nonce, application passwords), pagination and errors, and registering abilities with input and output schemas and safety annotations. Use for any custom endpoint or machine-readable capability in a plugin or theme.

fswp-architect

Planning stage of Full-Stack WP Developer. Classifies the work (new plugin, new theme, update to an existing plugin or theme, add-on for another product, or WordPress Core patch), triages existing code with a bundled detection script, asks one round of essential questions, does competitive research, and produces one reviewable PRD or change brief with a single approval gate. Also covers Migration mode and multi-session handoff docs. Invoked by fswp-developer before any code is written; consult directly for PRD, change-brief, or handoff-doc questions.

fswp-block-developer

Domain skill for WordPress block editor work in Full-Stack WP Developer. Covers building custom Gutenberg blocks (block.json, static and dynamic rendering, attributes, supports, InnerBlocks, variations, deprecations, block bindings), block patterns, and the Interactivity API (data-wp directives, stores, server-side state), with the @wordpress/scripts build workflow. Use for any custom block, pattern, or front-end interactivity in a plugin or theme.

fswp-core-contributor

WordPress Core contribution stage of Full-Stack WP Developer. Guides a contributor through finding or filing a Trac ticket, setting up the wordpress-develop checkout and test environment, writing a patch or GitHub pull request that follows Core coding standards, inline documentation, backward compatibility and tests, and preparing the ticket comment; also routes block-editor changes to the Gutenberg repository and security reports to the private process. Invoked by fswp-developer for Core patches; consult directly for Core workflow questions.

fswp-devops-engineer

Domain skill for WordPress development tooling in Full-Stack WP Developer. Covers local environments (wp-env with Docker, WordPress Playground and Blueprints), command-line site operations (plugin and theme management, database export, search-replace, cron, scaffolding), coding standards and static analysis (PHPCS with WordPress standards, PHPStan with WordPress stubs), PHP and JS testing setup, and the @wordpress/scripts toolchain. Use when setting up, running, or automating a WordPress dev or test environment.

fswp-maintainer

Change stage for existing WordPress code in Full-Stack WP Developer. Updates, fixes, refactors, and upgrades existing plugins and themes without breaking them, and builds add-ons for products you do not own (WooCommerce extensions, page-builder elements, extensions of other plugins) using hooks instead of edits to third-party files. Covers reading before changing, parity lists, deprecation, host compatibility, upgrade paths, and patch delivery. Invoked by fswp-developer after an approved change brief; consult directly for safe-change or add-on questions.

fswp-qa-engineer

Verification stage of Full-Stack WP Developer. Runs the mechanical gate for plugins and themes (house-rule scripts, PHP lint, PHPCS with WordPress standards, PHP compatibility, PHPStan with WordPress stubs), the manual checklist, PRD or change-brief scenario tests, and the pre-release check. Reports PASS, FAIL, or NOT RUN and never implies a skipped check passed. Invoked by fswp-developer after a build and again before delivery; consult directly to audit any plugin or theme folder.

fswp-theme-developer

Theme build stage of Full-Stack WP Developer. Builds custom WordPress themes - block themes (theme.json, templates, template parts, patterns, style variations), classic themes (template hierarchy, functions.php, theme supports), hybrids, and child themes - with accessibility, escaping, and directory readiness built in, plus a scaffold script. Invoked by fswp-developer after an approved PRD for a new theme; consult directly for a specific theme pattern. For changes to an existing theme use fswp-maintainer.

syncwin/fswp-plugin-developer

Plugin build stage of Full-Stack WP Developer. House standards and code templates for real WordPress plugins (not shortcode snippets) - folder anatomy, activation/uninstall lifecycle, custom post types and tables, admin UI tiers, front-end output on the Atomic Framework, REST and cron, i18n, distribution, and the Tier 3 React admin stack - plus a scaffold script. Also the base structure for add-ons. Invoked by fswp-developer after an approved PRD; consult directly for a specific plugin build pattern.

相關技能