code-antipatterns

What this skill does

## When to Use This Skill

| Use this skill when... | Use something else instead when... |
|------------------------|------------------------------------|
| Running a parallel anti-pattern scan and producing a report | Looking up the full YAML rule catalog → see [REFERENCE.md](REFERENCE.md) |
| Specifically targeting empty catches, floating promises, or `\|\| true` | Use the dedicated scanner → `code-hidden-failures --track errors` |
| Finding success-on-empty / silent degradation patterns | Use the dedicated scanner → `code-hidden-failures --track degradation` |
| Broad code-quality review across security, perf, and architecture | Run the full review delegate → `code-review` |

## Context

- Analysis path: `$1` (defaults to current directory if not specified)
- JS/TS files: !`find . -type f \( -name "*.js" -o -name "*.ts" -o -name "*.jsx" -o -name "*.tsx" \)`
- Vue files: !`find . -name "*.vue"`
- Python files: !`find . -name "*.py"`

## Your Task

Perform comprehensive anti-pattern analysis using ast-grep and parallel agent delegation.

### Analysis Categories

Based on the detected languages, analyze for these categories:

1. **JavaScript/TypeScript Anti-patterns**
   - Callbacks, magic values, console.logs
   - var usage, deprecated patterns
   - Error swallowing (empty catch, floating promises) → **delegate** to `/code:hidden-failures --track errors`

2. **Async/Promise Patterns**
   - Nested callbacks, Promise constructor anti-pattern
   - Error-handling coverage (unhandled/floating promises) → **delegate** to `/code:hidden-failures --track errors`

3. **Framework-Specific** (if detected)
   - **Vue 3**: Props mutation, reactivity issues, Options vs Composition API mixing
   - **React**: Missing deps in hooks, inline functions, prop drilling

4. **TypeScript Quality** (if .ts files present)
   - Excessive `any` types, non-null assertions, type safety issues

5. **Code Complexity**
   - Long functions (>50 lines), deep nesting (>4 levels), large parameter lists

6. **Security Concerns**
   - eval usage, innerHTML XSS, hardcoded secrets, injection risks

7. **Memory & Performance**
   - Event listeners without cleanup, setInterval leaks, inefficient patterns

8. **Python Anti-patterns** (if detected)
   - Mutable default arguments, global variables
   - Bare except and suppression patterns → **delegate** to `/code:hidden-failures --track errors`

### Delegated Category: Error Swallowing

Do NOT re-implement empty-catch / bare-except / floating-promise detection
here. Invoke `/code:hidden-failures --track errors` via the SlashCommand tool with the
same `PATH` and severity filter, then fold its findings into the
consolidated report under a dedicated **Error Swallowing** section.

Rationale: a single source of truth prevents drift between severity
models, app-context surfacing recommendations, and privacy redaction
policies. See `code-quality-plugin/skills/code-hidden-failures/SKILL.md`.

### Execution Strategy

**CRITICAL: Use parallel agent delegation for efficiency.**

Launch multiple specialized agents simultaneously:

```markdown
## Agent 1: Language Detection & Setup (Explore - quick)
Detect project stack, identify file patterns, establish analysis scope

## Agent 2: JavaScript/TypeScript Analysis (code-analysis)
- Use ast-grep for structural pattern matching
- Focus on: magic values, var usage, deprecated patterns
- Error swallowing handled separately via `/code:hidden-failures --track errors`

## Agent 3: Async/Promise Analysis (code-analysis)
- Nested callbacks, Promise constructor anti-pattern
- Floating promises / unhandled rejections handled via `/code:hidden-failures --track errors`

## Agent 4: Framework-Specific Analysis (code-analysis)
- Vue: props mutation, reactivity issues
- React: hooks dependencies, inline functions

## Agent 5: Security Analysis (security-audit)
- eval, innerHTML, hardcoded secrets, injection risks
- Use OWASP context

## Agent 6: Complexity Analysis (code-analysis)
- Function length, nesting depth, parameter counts
- Cyclomatic complexity indicators
```

### ast-grep Pattern Examples

For the full YAML rule catalog (with `id:`, `severity:`, `message:`, `fix:`, and `note:` fields), see [REFERENCE.md](REFERENCE.md).

Use these patterns during analysis:

```bash
# Magic numbers
ast-grep -p 'if ($VAR > 100)' --lang js

# Console statements
ast-grep -p 'console.log($$$)' --lang js

# var usage
ast-grep -p 'var $VAR = $$$' --lang js

# TypeScript any
ast-grep -p ': any' --lang ts
ast-grep -p 'as any' --lang ts

# Vue props mutation
ast-grep -p 'props.$PROP = $VALUE' --lang js

# Security: eval
ast-grep -p 'eval($$$)' --lang js

# Security: innerHTML
ast-grep -p '$ELEM.innerHTML = $$$' --lang js

# Python: mutable defaults
ast-grep -p 'def $FUNC($ARG=[])' --lang py
```

### Output Format

Consolidate findings into this structure:

```markdown
## Anti-pattern Analysis Report

### Summary
- Total issues: X
- Critical: X | High: X | Medium: X | Low: X
- Categories with most issues: [list]

### Critical Issues (Fix Immediately)
| File | Line | Issue | Category |
|------|------|-------|----------|
| ... | ... | ... | ... |

### High Priority Issues
| File | Line | Issue | Category |
|------|------|-------|----------|
| ... | ... | ... | ... |

### Medium Priority Issues
[Similar table]

### Low Priority / Style Issues
[Similar table or summary count]

### Recommendations
1. [Prioritized fix recommendations]
2. [...]

### Category Breakdown
- **Security**: X issues (details)
- **Async/Promises**: X issues (details)
- **Code Complexity**: X issues (details)
- [...]
```

### Optional Flags

- `--focus <category>`: Focus on specific category (security, async, complexity, framework)
- `--severity <level>`: Minimum severity to report (critical, high, medium, low)
- `--fix`: Attempt automated fixes where safe

### Post-Analysis

After consolidating findings:
1. Prioritize issues by impact and effort
2. Suggest which issues can be auto-fixed with ast-grep
3. Identify patterns that indicate systemic problems
4. Recommend process improvements (linting rules, pre-commit hooks)

## See Also

- **Reference**: [REFERENCE.md](REFERENCE.md) - Full YAML rule catalog with ast-grep pattern library
- **Skill**: `ast-grep-search` - ast-grep usage reference
- **Command**: `/code:review` - Comprehensive code review
- **Agent**: `security-audit` - Deep security analysis
- **Agent**: `code-refactoring` - Automated refactoring

## Related Configure Skills

- If linting not configured → `/configure:linting` for automated enforcement
- If security scanning not set up → `/configure:security` for CI integration