How does it handle security concerns?

The skill checks for hardcoded secrets, usage of unsafe functions like eval(), and deep relative imports, rejecting any code that introduces potential security risks.

What is the 'Graduation' phase in the review process?

Graduation is the phase where verified code and tests are moved to their permanent locations in the project structure and documented in a DONE.md file prior to committing.

Can I use this for projects without formal specifications?

Yes. While it has specialized logic for spec-driven work items (ADRs and TRDs), it can proceed with a standard code review based on the provided source code and general best practices.

Why does this skill reject mocking?

Mocking often creates brittle tests that verify implementation rather than outcomes. This skill enforces dependency injection to ensure tests verify actual behavior, making the codebase more maintainable.

What static analysis tools are required for this skill?

The skill utilizes tsc for type checking, ESLint for code standards, and Semgrep for identifying security vulnerabilities and architectural violations.

Strict TypeScript Code Reviewer

Name: Strict TypeScript Code Reviewer
Author: simonheimlicher

bysimonheimlicher

•

Security & Testing

Enforces rigorous TypeScript quality standards by rejecting mocks, validating dependency injection, and running comprehensive static analysis.

About

This skill provides a high-integrity review framework for TypeScript environments, prioritizing verifiable behavior over implementation-detail testing. It mandates a zero-tolerance policy for mocking, requiring the use of dependency injection to ensure tests are robust and meaningful. By integrating tsc, ESLint, and Semgrep alongside automated checks for Architectural Decision Records (ADRs) and Technical Requirements Documents (TRDs), it ensures every commit aligns with project specifications, security best practices, and strict type safety before graduation.

Key Features

Built-in graduation and commit workflows for automated production-ready delivery
Standardized review reporting with clear Verdict Definitions (Approved/Rejected/Blocked)
Strict rejection of mocking in favor of dependency injection and behavior testing
Automated verification of architectural decisions (ADR) and feature requirements
Multi-tool static analysis integration using tsc, ESLint, and Semgrep security rules
1 GitHub stars

Use Cases

Transitioning legacy test suites from brittle mocks to stable dependency injection patterns
Enforcing architectural and security compliance across distributed engineering teams
Performing final quality gate reviews for mission-critical TypeScript features

About

Key Features

Built-in graduation and commit workflows for automated production-ready delivery
Standardized review reporting with clear Verdict Definitions (Approved/Rejected/Blocked)
Strict rejection of mocking in favor of dependency injection and behavior testing
Automated verification of architectural decisions (ADR) and feature requirements
Multi-tool static analysis integration using tsc, ESLint, and Semgrep security rules
1 GitHub stars

Use Cases

Transitioning legacy test suites from brittle mocks to stable dependency injection patterns
Enforcing architectural and security compliance across distributed engineering teams
Performing final quality gate reviews for mission-critical TypeScript features