Skip to content
Beta Multi-model support (OpenAI, Gemini, and more) launching soon.
RBA RBA Skills

code-review-enforcer

v0.1.0 ExperimentalNo security review by Dakota Smith

Install

Pick the surface you use. Plugins run inside Claude Code, which is available in the terminal CLI, the desktop app on Mac and Windows, the web app at claude.ai/code, and the VS Code and JetBrains extensions. The slash commands are identical on every surface.

From inside any Claude Code session — terminal, desktop app, web app, or IDE extension:

  1. Add the RBA Skills marketplace (only needed once per machine):

    /plugin marketplace add rbaconsulting/rba-skills-plugin

  2. Install code-review-enforcer:

    /plugin install code-review-enforcer@rba-ai-hub

  3. Activate it without restarting:

    /reload-plugins

Overview

Code Review & Standards Enforcer

AI-assisted code review and standards enforcement for RBA digital experience projects. This plugin gives every engineer on an RBA project a consistent, thorough reviewer that never skips a checklist item — covering security, performance, accessibility, and platform-specific architecture in a single pass.

What's in this bundle

Artifact Purpose
pr-reviewer skill Full pull-request review against RBA standards: architecture, security (OWASP Top 10:2025), performance, a11y, and platform conventions
security-scan skill Focused OWASP-aligned security scan of a file, diff, or directory — outputs a severity-ranked findings report
perf-audit skill Core Web Vitals and server-side performance review: bundle size, render-blocking, caching, N+1 queries, lazy-loading
a11y-linter skill WCAG 2.2 AA compliance review of React/Razor/HTML markup with per-violation remediation steps
review-summary skill Synthesises multiple review outputs into a stakeholder-ready PR summary with a go/no-go recommendation
standards-check skill Validates a file or directory against RBA platform coding standards (Sitecore Helix, Optimizely conventions, Umbraco best practices, RBA .NET/TS patterns)
pr-reviewer agent Autonomous reviewer sub-agent that runs the full review pipeline and posts findings
/rba-review command Quick entry-point slash command that dispatches to the right skill based on what you pass it

When to use

  • Before opening a PR: run pr-reviewer on your diff to catch issues before a human reviewer sees them
  • Security-sensitive changes: run security-scan on authentication, data-access, or API layers
  • Frontend / component work: run a11y-linter + perf-audit together before design hand-off
  • Platform migrations (e.g. Sitecore XM Cloud move, Umbraco upgrade): run standards-check to surface convention drift
  • Client delivery gate: run review-summary to produce the formal "this diff is ready to merge" record

Platform adapters

All skills are platform-agnostic by default but include adapter sections for:

  • Sitecore — Helix layer discipline, rendering host / JSS patterns, SXA conventions
  • Optimizely (CMS 12+) — content-type model, visitor-group usage, A/B test implementation hygiene
  • Umbraco (13+) — composition vs inheritance, Examine index hygiene, surface forms
  • .NET / C# / ASP.NET Core — OWASP .NET Cheat Sheet patterns, minimal-API security, EF Core query hygiene
  • TypeScript / React / Next.js — strict-mode checks, RSC vs client component discipline, bundle discipline

How to install

claude plugin install code-review-enforcer@rba-ai-hub

Then invoke any skill directly or use the /rba-review slash command as a single entry point.

Bundled artifacts

Skills

  • a11y-linter — WCAG 2.2 AA accessibility review of React/TypeScript, Razor, or HTML markup. Produces per-violation findings with criterion reference (e.g. 1.4.3), impact level (critical/serious/moderate/minor per axe-core taxonomy), and a concrete code fix. Use on any component or template change before QA or client hand-off.
  • perf-audit — Core Web Vitals and server-side performance audit for RBA DX projects. Reviews frontend bundle discipline, image optimisation, render-blocking resources, N+1 query patterns, HTTP caching, and React/Next.js rendering strategy. Produces findings ranked by estimated user impact (LCP / INP / CLS deltas). Use on any frontend component PR or API layer change before client delivery.
  • pr-reviewer — Full pull-request review against RBA engineering standards: architecture, OWASP Top 10:2025 security, Core Web Vitals performance, WCAG 2.2 AA accessibility, and platform-specific conventions (Sitecore Helix, Optimizely, Umbraco, .NET, TypeScript/React). Use when you want a comprehensive, standards-backed review before a human reviewer sees your PR.
  • review-summary — Synthesises one or more review outputs (security-scan, perf-audit, a11y-linter, standards-check, pr-reviewer) into a stakeholder-ready PR summary with a clear go/no-go recommendation and a prioritised action list. Use before presenting a PR to the client delivery lead or before a formal client release gate.
  • security-scan — OWASP Top 10:2025-aligned security scan of a file, diff, or directory. Produces a severity-ranked findings report with CWE references and concrete .NET/TypeScript/platform-specific remediation steps. Use before merging any change that touches auth, data access, APIs, or third-party integrations.
  • standards-check — Validates code against RBA platform coding standards: Sitecore Helix layer discipline, Optimizely content-type conventions, Umbraco composition patterns, RBA .NET project structure, and TypeScript/React architecture rules. Use when onboarding a new developer to a project, reviewing a platform migration diff, or running a periodic standards audit between sprints.

Agents

  • pr-review-agent — Autonomous PR review agent that orchestrates the full RBA review pipeline: runs pr-reviewer, security-scan, perf-audit, a11y-linter, and standards-check in sequence, then calls review-summary to produce a consolidated delivery-gate report. Use when you want a hands-off, comprehensive review of a branch or diff.

Slash Commands

  • /rba-review — Quick entry-point for all RBA code review skills. Dispatches to the appropriate skill based on what you pass: a branch/diff for a full PR review, a file path for a targeted check, or a mode flag (--security, --perf, --a11y, --standards, --summary) to run a single focused review dimension.
Technical details
Homepage
https://rba-skills.tylerschroeder.net/plugins/code-review-enforcer/
License
MIT
Maturity
experimental
Security review
No security review
Owners
  • engineering
Platforms
azure-devops
Disciplines
engineering, security
Lifecycle
test-and-review
Tags
  • code-review
  • standards
  • lint
  • security
  • performance
  • accessibility
  • owasp
  • wcag
  • pull-request
  • sitecore
  • optimizely
  • umbraco
  • dotnet
  • typescript
  • react
  • helix
Last updated
by Tyler Schroeder
Source
plugins/code-review-enforcer/

Edit this plugin's README on GitHub — opens GitHub's web editor. No git knowledge needed.