← ClaudeAtlas

pattern-reviewer-vitelisted

Vite audit: stack choice (Vite for CSR, Next for SSR/SSG/SEO); `VITE_` prefix on every client-exposed `import.meta.env` read; `VITE_` is NOT a security boundary (secret-shaped `VITE_*` is HIGH); `loadEnv(..., '')` leaks server secrets; `.env.example` mirrors every `VITE_*`; type-check gap (no `tsc --noEmit`); prod sourcemap without Sentry; route-boundary lazy-load. Activate when the diff touches `vite.config.*`, `vitest.config.*`, or `import.meta.env` reads.
MartinKChen/harness-claude-code · ★ 0 · Code & Development · score 72
Install: claude install-skill MartinKChen/harness-claude-code
# pattern-reviewer-vite ## When to activate - Reviewing a diff that touches `vite.config.*`, `vitest.config.*`, `import.meta.env` reads, or Vite-served static assets. - A user says "review the Vite config / dev-server proxy / bundle setup". ## Project memory overlay After loading this skill, also check `$MAIN_ROOT/.claude/memory/patterns/pattern-reviewer-vite.md` in the consuming project (resolve `MAIN_ROOT="$(dirname "$(git rev-parse --path-format=absolute --git-common-dir)")"`). If present, load it as an **additive overlay** to the rules below; if absent, skip silently. See `memory-convention` for the full contract (additivity, severity floor, conflict surfacing). ## Iron rules - **>80% confidence filter.** Report only when you are >80% confident. Consolidate similar findings. - **Cite `path/to/file.ext:line`.** Quote the offending snippet in a BAD block; show the fix in a GOOD block. - **Severity is load-bearing.** CRITICAL / HIGH block the gate; MEDIUM / LOW are informational. Use the per-pattern severity assigned below. - **Never refer to a finding as `#N`** — GitHub auto-links those to issues. Use a non-numeric handle (quoted title, `F1` / `F2`, `Finding 1`). ## Patterns to review ### Stack choice (HIGH) - Vite picked for an app that needs SSR / SSG / ISR / SEO / file-based routing / server components → flag and recommend Next.js. - Next picked for a pure-CSR internal tool / dashboard / embedded widget → flag (overkill). ### `VITE_` prefix (HIGH) - `import.me