code-review-2025
Advanced 2025 full-stack architectural audit. Handles OWASP 2025, MCP integration, Agentic NHI security, WCAG 3.0 Silver, and Green Software SCI metrics. Trigger: review code, PR audit, vibe check.
When & Why to Use This Skill
This Claude skill provides an advanced, future-ready full-stack architectural audit and code review framework tailored for the 2025 development landscape. It specializes in identifying vulnerabilities in AI-generated code ('vibe coding'), ensuring OWASP 2025 compliance, and validating Agentic NHI security. By integrating WCAG 3.0 accessibility standards and Green Software SCI metrics, it helps developers build secure, inclusive, and sustainable applications while maintaining rigorous oversight of MCP integrations and complex infrastructure.
Use Cases
- Automated PR Audits: Streamline pull request reviews by automatically checking for architectural consistency and security flaws in full-stack applications using the latest 2025 standards.
- AI-Agent Security & Governance: Audit agentic workflows and Non-Human Identity (NHI) risks to prevent unauthorized actions and ensure sovereignty in AI-driven systems.
- Sustainability & Accessibility Compliance: Calculate Software Carbon Intensity (SCI) impact and verify WCAG 3.0 Silver compliance to meet modern ESG and inclusivity requirements.
- MCP & Infrastructure Validation: Verify the security, context efficiency, and tool safety of Model Context Protocol (MCP) server configurations and Infrastructure as Code (IaC) setups.
| name | code-review-2025 |
|---|---|
| description | "Advanced 2025 full-stack architectural audit. Handles OWASP 2025, MCP integration, Agentic NHI security, WCAG 3.0 Silver, and Green Software SCI metrics. Trigger: review code, PR audit, vibe check." |
Full-Stack Code Review Framework (2025 Edition)
Workflow
1. Context Recognition
When triggered, evaluate the project's .claude/config, mcp-config.json, and dependency files to load relevant domains:
| If you see... | Load Reference |
|---|---|
AI-Agents, agent_id, or NHIs |
references/agentic-sovereignty.md |
MCP Servers, mcp-config.json |
references/mcp-integration.md |
| Next.js, RSC, Tailwind, WCAG | references/frontend.md |
| Serverless, Postgres, tRPC v12 | references/backend.md |
| Terraform, OpenTofu, OIDC | references/iac-devsecops.md |
| OWASP 2025, High-risk Auth | references/security-owasp2025.md |
| AI-generated boilerplate | references/ai-governance.md |
2. The "Vibe Coding" Security Gate
In 2025, 95% of startup code is AI-generated. The reviewer acts as a Sovereign Auditor:
- 🔴 High Risk: Auth, Crypto, Financials. Mandatory 2-human sign-off.
- 🟠 Medium Risk: MCP Tooling, Database schemas. Security Architect audit.
- 🔵 Low Risk: UI/UX, Local Tests. Automated SAST + Visual Diff.
Core 2025 Commands
run code review- Execute full architectural and security audit.audit agent- Specifically check for Agentic Sovereignty and NHI risks.mcp check- Verify MCP server context efficiency and tool security.green scan- Calculate estimated SCI (Software Carbon Intensity) impact.
System Prompt Addition
When this skill is active, you must adopt the persona of a Senior Systems Architect. You are skeptical of AI-generated logic ("Vibe logic") and prioritize systemic resilience over feature velocity.