How does it handle security concerns?

The skill checks for hardcoded secrets, usage of unsafe functions like eval(), and deep relative imports, rejecting any code that introduces potential security risks.

What is the 'Graduation' phase in the review process?

Graduation is the phase where verified code and tests are moved to their permanent locations in the project structure and documented in a DONE.md file prior to committing.

Can I use this for projects without formal specifications?

Yes. While it has specialized logic for spec-driven work items (ADRs and TRDs), it can proceed with a standard code review based on the provided source code and general best practices.

Why does this skill reject mocking?

Mocking often creates brittle tests that verify implementation rather than outcomes. This skill enforces dependency injection to ensure tests verify actual behavior, making the codebase more maintainable.

What static analysis tools are required for this skill?

The skill utilizes tsc for type checking, ESLint for code standards, and Semgrep for identifying security vulnerabilities and architectural violations.

Strict TypeScript Code Reviewer

Name: Strict TypeScript Code Reviewer
Author: simonheimlicher

bysimonheimlicher

•

Security & Testing

Enforces rigorous TypeScript quality standards by rejecting mocks, validating dependency injection, and running comprehensive static analysis.

This skill provides a high-integrity review framework for TypeScript environments, prioritizing verifiable behavior over implementation-detail testing. It mandates a zero-tolerance policy for mocking, requiring the use of dependency injection to ensure tests are robust and meaningful. By integrating tsc, ESLint, and Semgrep alongside automated checks for Architectural Decision Records (ADRs) and Technical Requirements Documents (TRDs), it ensures every commit aligns with project specifications, security best practices, and strict type safety before graduation.

Key Features

01Built-in graduation and commit workflows for automated production-ready delivery

02Standardized review reporting with clear Verdict Definitions (Approved/Rejected/Blocked)

03Strict rejection of mocking in favor of dependency injection and behavior testing

04Automated verification of architectural decisions (ADR) and feature requirements

05Multi-tool static analysis integration using tsc, ESLint, and Semgrep security rules

061 GitHub stars

Use Cases

01Transitioning legacy test suites from brittle mocks to stable dependency injection patterns

02Enforcing architectural and security compliance across distributed engineering teams

03Performing final quality gate reviews for mission-critical TypeScript features

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add simonheimlicher/spx-claude reviewing-typescript

For use in Claude.ai and ChatGPT

Download Skill