clean-pro-review-gates
clean-pro-review-gates — Unified 5-Gate Review Framework
Overview
This is a combined meta-skill that integrates five review gates into a single, unified framework. It catches the systematic ways AI coding agents produce bad code, tests, documentation, security holes, and insecure infrastructure — each rule traced to a primary source (Clean Code, SOLID, OWASP, CWE) or published 2022–2026 research on LLM code generation.
Generic "follow clean code" instructions don't catch what LLMs actually get wrong. This skill adds the AI-specific layer: swallowed exceptions, hallucinated APIs, mock fallbacks declared as success, over-eager abstraction, docs written from memory instead of from the source, test bloat that asserts implementation instead of behavior, and plausible-but-insecure code that ships injection, missing authorization, and slopsquatted dependencies.
The security gate also covers code that calls LLMs — prompt-injection containment, model output treated as untrusted input, agent-tool least privilege, prompt secrets, consumption caps, and RAG tenant isolation — mapped to the OWASP LLM Top 10.
The Five Gates
| Gate | What It Guards | When to Apply | Reference |
|---|---|---|---|
| GATE 1: Code Quality | Production code — Clean Code, SOLID, DRY/KISS/YAGNI, plus 15 documented LLM failure modes | After an agent writes, edits, refactors, or fixes implementation code | references/code-quality-gate.md |
| GATE 2: Test Review | Test code — behavior-over-implementation, justified mocks, no framework re-testing, no near-duplicate bloat | After an agent writes or changes tests | references/test-review-gate.md |
| GATE 3: Docs Review | Documentation — every symbol, flag, endpoint, and code sample verified against the source; docs-vs-code drift | After an agent writes or changes docs, or code changes documented behavior | references/docs-review-gate.md |
| GATE 4: Security Review | Security — injection, broken access control, CSRF, secrets, weak crypto, SSRF, LLM-app risks, supply chain | After code touching untrusted input, auth, secrets, I/O, dependencies, or LLM/agent calls | references/security-review-gate.md |
| GATE 5: Infra Hardening | CI/CD workflow injection, pull_request_target misuse, overprivileged tokens, unpinned actions/images, root containers, wildcard IAM |
After workflow YAML, Dockerfiles, compose files, or IaC changes | references/infra-hardening-gate.md |