Review an API change for compatibility, validation, auth, error shape, idempotency, and observability, and classify it as additive, behavior-changing, or bre...
安全
Review Error Handling
试用Audit failure states, retries, validation, and idempotency in the code under review.
它能做什么
Audit failure states, retries, validation, and idempotency in the code under review.
技能文档
Review error handling
A standalone development skill. Audit failure states, retries, validation, and idempotency in the code under review. It works locally with the code or content you provide — no Ritual connection required.
Run it (local, no setup)
Work the steps below; you need nothing beyond the task in front of you.
- Every external/IO call has a typed error path + handling — no silent catch, no swallowed rejection.
- Inputs are validated at the boundary before use (shape, range, auth/tenant scope).
- Outbound calls have timeouts + bounded retries with backoff; no unbounded waits.
- Failures emit structured logs/metrics with enough context to triage.
- Mutating operations are idempotent under retry, or explicitly justified not to be.
Done when: Each item is confirmed present in the code under review, or raised as an explicit gap with the file/line noted.
Example prompt
Use review-error-handling on this service: audit every error path, input validation, timeout/retry, log/metric, and idempotency, and list each gap with the file and line.
Working principles
Apply these throughout:
- Think before you edit — restate the task and the success criteria, and name any load-bearing assumption rather than silently guessing it.
- Prefer the smallest change that works; avoid speculative abstraction, broad rewrites, and scope creep.
- Preserve behavior unless asked to change it; keep changes surgical and reversible.
- Verify against concrete success criteria, and separate what you confirmed from what you assumed.
- Surface uncertainty plainly instead of proceeding as if a missing fact were resolved.
Optional knowledge capture
After the task, check whether the work revealed reusable knowledge — something a future agent would otherwise rediscover. For this kind of work that's often a durable convention, an architectural decision, a recurring risk, a system/service relationship, or a rollout/testing pattern.
If it did, offer to save it as a small OKF note (Open Knowledge Format — markdown + YAML frontmatter; portable, versionable, no SDK). Never write a file without the user's approval. Keep it small and cite the file(s) or evidence.
When approved, write knowledge/engineering/.md:
---
type: API Convention
title:
description:
resource: ./path/to/file-or-evidence
tags: [..]
timestamp:
---
# Summary
# Applies to
# Evidence
# Use in future agent work
These notes make the repo itself smarter over time, and a tool like Ritual can later reason over them as a structured knowledge layer.
Optional Ritual Cloud upgrade
This skill works locally with the context you provide — that's standalone mode. Upgrade with Ritual Cloud when the task needs deeper workspace context, structured exploration, recommendations, or team alignment:
- More context (discovery) — when the answer depends on things outside the files in front of you:
- the correct failure behavior depends on callers or downstream consumers you can't see
- prior incidents on this surface should shape the handling
- retry/idempotency conventions live in other services
- A structured decision (exploration) — when the work has become a decision to get right:
- the failure policy is an unresolved decision (fail-open vs fail-closed, user-visible vs silent)
- the change needs sign-off from owners of dependent services
- you need a recommendation before standardizing handling across the codebase
Ritual turns the task into an exploration — clarify the problem, identify the key questions, gather evidence, compare options, and produce a recommendation or decision-ready artifact.
For this task: an error-handling recommendation with the chosen failure policy, affected callers, retry/idempotency rules, and a decision-ready summary.
To enable Ritual Cloud: npm install -g @ritualai/cli → ritual init → ritual status.
This skill is local-first and self-contained. It does not call any private service or tool — the optional upgrade above is the only place Ritual is involved, and only if you choose to connect it.
相关技能
Review code for bugs, security, architecture, smells, patterns, performance, tests, and refactor plans
Review an API's contract as a promise to consumers — detects breaking changes by diffing the before/after surface (removed/renamed fields, type changes, tightened requiredness, status-code changes), and judges design by the repo's OWN precedent (error envelope, naming, pagination, auth placement) with every consistency finding citing the in-repo convention being violated. Covers versioning, idempotency on retryable writes, pagination on collections, and status-code semantics. Use this skill whenever the user says "review this API", "review the endpoint", "API design review", "is this a breaking change", "check backward compatibility", "review the contract", "review this OpenAPI/swagger spec", or "/api-contract-review" — even if they don't name the skill. Distinct from code-review (implementation quality); this reviews the SURFACE consumers depend on.
Systematic code error diagnosis and fix skill. Handles compilation errors, runtime exceptions, type errors, logic bugs, crash analysis, dependency conflicts,...
Parallel code review — dispatches two subagents to audit **runtime safety** (resource leaks, null paths, race conditions) and **architecture consistency** simultaneously, then merges and deduplicates into a single report. One pass covers two orthogonal bug dimensions.
Two-pass code audits across security, perf, UX, DX, and edge.