Beforemerge Skills
AI-native code review rules for Claude Code, Cursor, Codex & more. 104 rules across React, Next.js, Supabase, SOLID architecture, and WordPress β each with bad/good examples, CWE/OWASP mappings, and detection hints.
Ask AI about Beforemerge Skills
Powered by Claude Β· Grounded in docs
I know everything about Beforemerge Skills. Ask me about installation, configuration, usage, or troubleshooting.
0/500
Reviews
Documentation
BeforeMerge
The comprehensive, AI-native code review knowledge base.
Know what to check β before you merge.
BeforeMerge is a structured collection of code review rules, anti-patterns, and best practices designed for AI coding agents and human reviewers. Each rule includes bad β good code examples, impact ratings, CWE/OWASP mappings, and detection hints.
Why BeforeMerge?
Existing code review resources are fragmented:
- Linters catch syntax issues but don't educate.
- AI review tools are shallow β no structured knowledge base behind them.
- OWASP/CWE docs are exhaustive but not actionable or AI-consumable.
BeforeMerge combines detection + education + AI-native format in one place.
Quick Start
Install as an Agent Skill (works with Claude Code, Cursor, Codex, OpenCode):
# Pick a skill
npx skills add BeforeMerge/beforemerge-skills --skill nextjs-review
npx skills add BeforeMerge/beforemerge-skills --skill react-review
npx skills add BeforeMerge/beforemerge-skills --skill supabase-review
npx skills add BeforeMerge/beforemerge-skills --skill fullstack-architecture-review
npx skills add BeforeMerge/beforemerge-skills --skill wordpress-review
Or browse the rules directly in skills/*/rules/.
Available Skills
| Skill | Rules | Focus | Status |
|---|---|---|---|
nextjs-review | 31 | Security (XSS, CSRF, auth), performance (RSC, dynamic imports, closures), architecture | β Ready |
react-review | 16 | XSS, prototype pollution, re-renders, virtualization, composition, hooks | β Ready |
supabase-review | 20 | RLS security, auth patterns, query performance, migrations, type safety | β Ready |
fullstack-architecture-review | 19 | DRY/SOLID, layered architecture, service/repository patterns, factory DI | β Ready |
wordpress-review | 18 | SQL injection, XSS, CSRF nonces, query optimization, caching | β Ready |
104 rules total across 5 skills.
Structure
skills/
βββ nextjs-review/ # Next.js / React / TypeScript
βββ react-review/ # React (framework-agnostic)
βββ supabase-review/ # Supabase / PostgreSQL / RLS
βββ fullstack-architecture-review/ # DRY / SOLID / Clean Architecture
βββ wordpress-review/ # WordPress / PHP
βββ SKILL.md # Agent-facing metadata + trigger description
βββ AGENTS.md # Compiled output (all rules in one doc)
βββ metadata.json # Version and organization info
βββ README.md # Skill-specific documentation
βββ rules/
βββ _sections.md # Section metadata and ordering
βββ _template.md # Template for contributing new rules
βββ security/ # Security anti-patterns (CWE/OWASP mapped)
βββ performance/ # Performance patterns
βββ architecture/ # Architecture and design patterns
βββ quality/ # Code quality and maintainability
Rule Format
Each rule is a markdown file with YAML frontmatter:
---
title: Descriptive Rule Title
description: "One-line summary for search results"
impact: CRITICAL | HIGH | MEDIUM | LOW
tags: [security, nextjs, server-actions]
cwe: ["CWE-862"]
owasp: ["A01:2021"]
detection_grep: "pattern-to-find-violations"
---
## Rule Title
Why this matters and what to look for.
**Incorrect (what's wrong and why):**
\```typescript
// Bad code example with explanation
\```
**Correct (what's right and why):**
\```typescript
// Good code example with explanation
\```
Reference: [link to official docs]
Contributing
We welcome contributions! See CONTRIBUTING.md for guidelines.
- Pick a skill and category (
security/,performance/,architecture/,quality/) - Copy
rules/_template.mdto the appropriate directory - Follow the naming convention:
prefix-description.md(e.g.,sec-sql-injection.md) - Include bad β good code examples with explanations
- Add CWE/OWASP mappings where applicable
- Submit a PR
Philosophy
- Framework-specific: Generic advice is useless. Rules target specific frameworks with specific code.
- AI-native: Structured for consumption by Claude Code, Cursor, Codex, and other AI agents.
- Education-first: Every rule explains why, not just what.
- Formally mapped: Rules link to CWE, OWASP, and other standards where applicable.
- Community-driven: Open source. The more teams contribute patterns, the better everyone's code gets.
License
MIT β use it, fork it, improve it.
Built by BeforeMerge β’ Created by Peter Krzyzek
