skills.rest
Zoppy-crm
Zoppy-crmOFFICIAL
Explore all skills by this author →
WebsiteGitHub

code-review

Identify architecture, security, PII, and performance issues in NestJS code.

Updated Mar 1, 2026
Search Tags:#architecture#performance#security#code-review#nestjs#pii#sequelize
One-click install
npx skills add https://github.com/Zoppy-crm/.github --skill code-review-zoppy-crm
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: code-review
Source: https://github.com/Zoppy-crm/.github/tree/main/skills/backend/code-review
Command: npx skills add https://github.com/Zoppy-crm/.github --skill code-review-zoppy-crm

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This checklist helps reviewers detect architecture violations, PII exposure, security gaps, performance regressions, and code-quality issues in the zoppy-api NestJS codebase so they can be fixed before merge.

Core Features & Use Cases

  • Architecture checks: ensures controllers are thin, services and domains follow injection and repository patterns, and transactions and decorators are applied correctly.
  • PII & security audits: detects DTOs exposing sensitive fields, verifies guard order, webhook validation, and safe logging practices.
  • Performance and async checks: flags Sequelize include usage, N+1 patterns, inefficient loops, and improper promise handling.
  • Use Cases: run on PR reviews, controller/service audits, or when verifying endpoints and DTO responses for compliance.

Quick Start

Review the pull request or changed files and list BLOCKERS, WARNINGS, and SUGGESTIONS with exact file paths, line numbers, and concrete fixes for every BLOCKER.

Frequently Asked Questions about code-review

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find PII exposure and security gaps in NestJS controllers and DTOs?▼

To find PII exposure in NestJS, audit DTO projections for sensitive fields, verify guard order, and check webhook validation. Reviewing safe logging practices and exception interceptors prevents sensitive data leakage during pull requests.

How do I check NestJS Sequelize usage for performance issues and N+1 queries?▼

Checking NestJS Sequelize usage for performance involves flagging inefficient include usage, detecting N+1 query patterns, and reviewing improper promise handling. Evaluating async patterns and transaction decorators prevents performance regressions in service files.

Can I use this to verify NestJS architecture patterns like thin controllers and repository injections?▼

Yes, you can verify NestJS architecture patterns by ensuring controllers remain thin and services follow proper dependency injection and repository patterns. Auditing transaction decorators and domain layers confirms architectural compliance during code reviews.

What is the best way to report code review findings for NestJS pull requests?▼

The best way to report NestJS code review findings is to group issues by severity as BLOCKERS, WARNINGS, and SUGGESTIONS. Providing exact file paths, line numbers, and concrete fixes for every blocker ensures actionable pull request feedback.

When should I not use a checklist approach for NestJS code audits?▼

You should not use a static checklist for NestJS code audits when evaluating logic outside the framework's specific patterns, such as non-Sequelize database interactions or non-DTO data structures that require dynamic runtime analysis.

Related Skills

Explore More Software Engineering Skills→
Zoppy-crmZoppy-crm

tdd

Enforce failing tests before implementation in the zoppy-api NestJS project.

Official
Advanced
rvdbreemenrvdbreemen
199

caveman-review

Generate one-line code review comments with line numbers and fixes.

Community
Basic
ManzuetiManzueti

health

Wrap project tools to compute a weighted codebase health score.

Community
Advanced
DevelopersCoffeeDevelopersCoffee
3

cwe-359-privacy-violation

Mask PII in Java logs and API responses to remediate CWE-359 vulnerabilities.

Official
Intermediate