Chore(project): AI 에이전트 스킬 시스템 셋업 (#334) - #335
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Warning Review limit reached
Next review available in: 48 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (4)
Walkthrough에이전트용 중앙 가이드와 요청 유형별 Changes에이전트 작업 체계 문서화
Estimated code review effort: 3 (Moderate) | ~25 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Storybook chromatic 배포 확인: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 10
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.agents/skills/git/commit/SKILL.md:
- Line 16: Update the change-review instruction in SKILL.md to use a command
that includes both staged and unstaged changes, such as git diff HEAD, or
explicitly combine git diff with git diff --cached; retain the existing git
status and recent git log checks.
In @.agents/skills/meta/orchestrate/SKILL.md:
- Around line 17-24: Update the orchestrate workflow so Phase 1 reads every
chained skill’s SKILL.md before generating the Phase 2 plan and requesting
approval. Preserve the existing Phase 3 sequential execution and each skill’s
own Phase 1 approval gate, while ensuring the plan reflects the procedures
actually read.
In `@AGENTS.md`:
- Around line 10-15: 작업 요청 절차에 트리거가 없는 경우의 fallback을 추가하세요. 트리거 표와 `SKILL.md` 선행
읽기 규칙을 유지하면서, 일치하는 항목이 없으면 요청 유형을 확인해 적절한 스킬(코드 리뷰의 경우 `code/review`)로 연결하거나 해당
스킬을 추가하고, 이를 적용해 절차 없이 중단되지 않도록 하세요.
In `@docs/conventions/architecture.md`:
- Around line 8-34: Update the architecture directory-tree fenced code block to
include the text language identifier, preserving the existing tree content and
formatting.
In `@docs/conventions/branch.md`:
- Around line 18-22: Update the branch creation command in the branch convention
documentation to use the `{타입}` placeholder instead of hardcoding `feat`, while
preserving the existing `#{이슈번호}/{기능명}` format.
In `@docs/conventions/commit.md`:
- Around line 15-20: Clarify the commit convention by separating commit types
from breaking and hotfix modifiers: distinguish `setting` from `chore` with
non-overlapping selection criteria, and represent `!HOTFIX` and `!BREAKING
CHANGE` as modifiers rather than types. Update the corresponding syntax and
selection guidance in the git/commit skill to match the revised convention.
In `@docs/conventions/component.md`:
- Around line 38-44: 문서의 processUser 및 checkIsUser 예시를 function 키워드 대신 화살표 함수
문법으로 변경하고, 상단의 function 금지 규칙은 그대로 유지하세요.
In `@docs/conventions/merge.md`:
- Line 7: Update the approval requirement in merge.md to match the policy
defined by the git/pr skill, requiring at least two approvals before merging.
Ensure both documents consistently state the same merge approval policy.
- Line 6: Update the merge convention step and the related branch workflow in
SKILL.md to first switch to the develop branch, then run git pull --ff-only
origin develop, and only afterward create or switch to the working branch. Keep
both documents’ ordering consistent and remove the instruction to pull develop
directly from the current working branch.
In `@docs/setup/figma-mcp.md`:
- Around line 31-32: Update the Figma MCP configuration in the documented setup
example to run a verified, pinned installation artifact instead of resolving
figma-developer-mcp through npx with -y. Use an exact approved package version
and enforce integrity verification for the artifact, while preserving the
existing MCP launch configuration.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 0a4274d1-1941-40f7-a28d-f7fcd76dff14
📒 Files selected for processing (17)
.agents/skills/code/component/SKILL.md.agents/skills/code/page/SKILL.md.agents/skills/figma/to-code/SKILL.md.agents/skills/figma/to-figma/SKILL.md.agents/skills/git/branch/SKILL.md.agents/skills/git/commit/SKILL.md.agents/skills/git/pr/SKILL.md.agents/skills/meta/manage/SKILL.md.agents/skills/meta/orchestrate/SKILL.mdAGENTS.mddocs/conventions/architecture.mddocs/conventions/branch.mddocs/conventions/commit.mddocs/conventions/component.mddocs/conventions/merge.mddocs/design/tokens.mddocs/setup/figma-mcp.md
|
|
||
| ## Phase 1 — 계획 확인 | ||
|
|
||
| 1. `git status`, `git diff`(staged+unstaged), 최근 `git log`를 확인해 변경 내용을 파악한다. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
staged 변경을 포함하도록 diff 확인 명령을 수정하세요.
git diff는 unstaged 변경만 표시합니다. 문서의 요구사항은 staged와 unstaged 변경을 모두 확인하는 것입니다. git diff HEAD 또는 git diff와 git diff --cached를 함께 사용하세요. 현재 명령으로는 일부 변경이 계획과 커밋 범위에서 누락될 수 있습니다.
🧰 Tools
🪛 SkillSpector (2.5.1)
[error] 18: [PE3] Credential Access: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Remediation: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
(Privilege Escalation (PE3))
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/git/commit/SKILL.md at line 16, Update the change-review
instruction in SKILL.md to use a command that includes both staged and unstaged
changes, such as git diff HEAD, or explicitly combine git diff with git diff
--cached; retain the existing git status and recent git log checks.
| ## Phase 2 — 계획 출력 및 승인 | ||
|
|
||
| 도출된 스킬 체인과 각 스킬에서 수행할 작업을 요약해 출력하고, 사용자 승인을 기다린다. | ||
|
|
||
| ## Phase 3 — 순차 실행 | ||
|
|
||
| 1. 각 스킬의 SKILL.md를 순서대로 Read하고 그 Phase를 그대로 따른다. | ||
| 2. 각 스킬은 자신의 Phase 1(계획+승인)을 그대로 유지한다 — orchestrate 단계의 승인이 개별 스킬의 승인 게이트를 대체하지 않는다. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
계획 승인 전에 체인의 모든 SKILL.md를 읽으세요.
AGENTS.md는 작업 전에 해당 SKILL.md를 먼저 Read하도록 요구합니다. 그러나 이 파일은 Phase 2에서 계획과 승인을 먼저 출력하고, Phase 3에서야 개별 스킬을 Read합니다. 이 순서에서는 실제 Phase 절차를 확인하지 않은 계획이 승인될 수 있습니다. Phase 1에서 체인의 모든 SKILL.md를 Read한 뒤 계획을 작성하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.agents/skills/meta/orchestrate/SKILL.md around lines 17 - 24, Update the
orchestrate workflow so Phase 1 reads every chained skill’s SKILL.md before
generating the Phase 2 plan and requesting approval. Preserve the existing Phase
3 sequential execution and each skill’s own Phase 1 approval gate, while
ensuring the plan reflects the procedures actually read.
| 작업 요청을 받으면 아래 순서를 반드시 지킨다: | ||
|
|
||
| 1. 아래 트리거 표에서 요청에 해당하는 스킬을 찾는다. | ||
| 2. **해당 SKILL.md 파일을 Read 도구로 먼저 읽는다. 읽기 전에 어떤 작업도 시작하지 않는다.** | ||
| 3. 스킬 파일의 Phase 순서를 그대로 따른다. | ||
| 4. 트리거가 두 스킬 이상에 걸리면 `meta/orchestrate`로 위임한다. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
트리거가 없는 요청의 처리 규칙을 추가하세요.
현재 규칙은 모든 작업 요청에서 트리거를 찾아야 하지만, 트리거 표에는 코드 리뷰와 같은 요청이 없습니다. code/review 스킬을 추가하거나, 일치하는 트리거가 없을 때 작업 유형을 확인하는 fallback을 정의하세요. 현재 상태에서는 표에 없는 요청이 절차 없이 중단됩니다.
Also applies to: 27-56
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@AGENTS.md` around lines 10 - 15, 작업 요청 절차에 트리거가 없는 경우의 fallback을 추가하세요. 트리거
표와 `SKILL.md` 선행 읽기 규칙을 유지하면서, 일치하는 항목이 없으면 요청 유형을 확인해 적절한 스킬(코드 리뷰의 경우
`code/review`)로 연결하거나 해당 스킬을 추가하고, 이를 적용해 절차 없이 중단되지 않도록 하세요.
| ``` | ||
| Pinback Service | ||
| ├─ apps | ||
| │ ├─ client | ||
| │ │ └─ src | ||
| │ │ ├─ shared // 공통으로 재사용하는 코드 위치 | ||
| │ │ │ ├─ components | ||
| │ │ │ ├─ hooks | ||
| │ │ │ ├─ utils | ||
| │ │ │ ├─ types | ||
| │ │ │ └─ ETC | ||
| │ │ └─ pages | ||
| │ │ ├─ dashBoard | ||
| │ │ │ ├─ components | ||
| │ │ │ ├─ hooks | ||
| │ │ │ ├─ utils | ||
| │ │ │ ├─ types | ||
| │ │ │ └─ ETC | ||
| │ │ └─ detail | ||
| │ ├─ extension | ||
| │ └─ landing | ||
| ├─ config // 모노레포 공통 config | ||
| │ ├─ eslint | ||
| │ └─ typescript | ||
| └─ packages // 모노레포 공통 packages (ex. design-system) | ||
| └─ design-system | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
코드 블록에 언어 식별자를 추가하세요.
이 블록은 언어 식별자가 없어 markdownlint MD040 경고가 발생합니다. 폴더 트리에는 text를 지정하세요.
🧰 Tools
🪛 markdownlint-cli2 (0.23.2)
[warning] 8-8: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/conventions/architecture.md` around lines 8 - 34, Update the
architecture directory-tree fenced code block to include the text language
identifier, preserving the existing tree content and formatting.
Source: Linters/SAST tools
| ```bash | ||
| # 브랜치 생성 + 이동 | ||
| # 🚨 develop에서 만들었는지 무조건 확인하기 | ||
| $ git checkout -b feat/#{이슈번호}/{기능명} | ||
| ``` |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
브랜치 생성 명령에서 타입을 고정하지 마세요.
브랜치 형식은 {타입}/#{이슈번호}/{기능명}이지만 명령은 feat를 고정합니다. fix 또는 setting 작업에서 잘못된 브랜치 이름이 생성됩니다. 명령을 git checkout -b {타입}/#{이슈번호}/{기능명}으로 수정하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/conventions/branch.md` around lines 18 - 22, Update the branch creation
command in the branch convention documentation to use the `{타입}` placeholder
instead of hardcoding `feat`, while preserving the existing `#{이슈번호}/{기능명}`
format.
| | `setting` | 패키지 설치, 개발 설정 | | ||
| | `feat` | 새로운 기능 추가 / 퍼블리싱 | | ||
| | `fix` | 버그 수정 | | ||
| | `api` | api 연결 로직 작성 | | ||
| | `refactor` | 프로덕션 코드 리팩토링, QA 반영 | | ||
| | `chore` | 빌드 테스트 업데이트, 패키지 매니저 설정 (프로덕션 코드 변경 X) | |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win
커밋 타입과 변경 표기의 경계를 명확히 하세요.
setting과 chore가 모두 패키지 또는 개발 설정을 포함합니다. .agents/skills/git/commit/SKILL.md는 이 목록에서 하나의 타입을 선택하도록 하므로 선택 기준이 모호합니다.
!HOTFIX와 !BREAKING CHANGE는 타입처럼 정의되어 있지만 설명은 modifier에 가깝습니다. 특히 !BREAKING CHANGE는 {타입}: {메시지} 형식에 그대로 넣기 어렵습니다. 타입 목록과 breaking 또는 hotfix 표기를 분리하고, git/commit 스킬에도 동일한 문법을 적용하세요.
정리 예시
-| `!HOTFIX` | 코드 포맷 변경, 세미콜론 누락, 코드 수정이 없는 경우 |
-| `!BREAKING CHANGE` | 커다란 API 변경의 경우 |
+| `hotfix` | 긴급 버그 수정 |
+
+### 추가 표기
+
+- Breaking change는 `{타입}!: {메시지}` 형식으로 표시한다.Also applies to: 27-28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/conventions/commit.md` around lines 15 - 20, Clarify the commit
convention by separating commit types from breaking and hotfix modifiers:
distinguish `setting` from `chore` with non-overlapping selection criteria, and
represent `!HOTFIX` and `!BREAKING CHANGE` as modifiers rather than types.
Update the corresponding syntax and selection guidance in the git/commit skill
to match the revised convention.
| ```jsx | ||
| // early return 패턴 | ||
| function processUser(user) { | ||
| if (!user || !user.isActive) return; // 조건이 맞지 않으면 일찍 반환 | ||
| // 나머지 처리 코드... | ||
| } | ||
| ``` |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
함수 예시를 규칙과 일치시키세요.
이 문서는 function 키워드를 금지하지만 두 예시는 function processUser와 function checkIsUser를 사용합니다. 예시를 화살표 함수로 변경하세요. function을 허용하려면 상단 규칙을 수정하세요.
As per coding guidelines: function 키워드를 금지하고 화살표 함수를 사용합니다.
Also applies to: 79-88
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/conventions/component.md` around lines 38 - 44, 문서의 processUser 및
checkIsUser 예시를 function 키워드 대신 화살표 함수 문법으로 변경하고, 상단의 function 금지 규칙은 그대로 유지하세요.
Source: Coding guidelines
| 1. 메인 브랜치(`main`, `develop`)에서 직접 커밋하지 않는다. | ||
| 2. 작업 브랜치(`feat` 등)에서만 커밋하고, 병합은 PR(Pull Request)을 통해서만 한다. | ||
| - 병합 방식은 `squash merge`를 사용한다. | ||
| 3. 작업 전에는 항상 `git pull origin develop`으로 최신화한다. |
There was a problem hiding this comment.
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win
develop에서 최신화하는 순서를 명시하세요.
현재 브랜치에서 git pull origin develop을 실행하면 origin/develop이 작업 브랜치에 병합될 수 있습니다. .agents/skills/git/branch/SKILL.md는 먼저 develop으로 이동하도록 정의합니다.
develop으로 전환한 뒤 git pull --ff-only origin develop을 실행하고, 그 후 작업 브랜치를 생성하거나 전환하도록 두 문서의 순서를 통일하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/conventions/merge.md` at line 6, Update the merge convention step and
the related branch workflow in SKILL.md to first switch to the develop branch,
then run git pull --ff-only origin develop, and only afterward create or switch
to the working branch. Keep both documents’ ordering consistent and remove the
instruction to pull develop directly from the current working branch.
| "command": "npx", | ||
| "args": ["-y", "figma-developer-mcp"], |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== changed file context =="
if [ -f docs/setup/figma-mcp.md ]; then
nl -ba docs/setup/figma-mcp.md | sed -n '1,80p'
else
echo "docs/setup/figma-mcp.md not found"
fi
echo
echo "== related references =="
rg -n "figma-developer-mcp|npx -y|npx" docs .github README.md 2>/dev/null | head -100 || true
echo
echo "== possible lockfiles/package files =="
git ls-files | rg '(^|/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|package\.json)$' || trueRepository: Pinback-Team/pinback-client
Length of output: 232
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== changed file context =="
if [ -f docs/setup/figma-mcp.md ]; then
cat -n docs/setup/figma-mcp.md | sed -n '1,90p'
else
echo "docs/setup/figma-mcp.md not found"
fi
echo
echo "== related references =="
grep -RInE "figma-developer-mcp|npx -y|\"command\": \"npx\"" docs .github README.md 2>/dev/null | head -100 || true
echo
echo "== package/lockfile candidates =="
git ls-files | grep -E '(^|/)(package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|yarn\.lock|package\.json)$' || trueRepository: Pinback-Team/pinback-client
Length of output: 1912
🌐 Web query:
npm npx install executable package npx without version installs latest documentation
💡 Result:
When using npx (which executes the npm exec command), the behavior regarding package versions depends on whether a version or tag is specified [1][2]. If you run npx without specifying a version (e.g., npx ), npm will typically attempt to fetch and use the latest version of that package from the registry if it is not already available locally in your project's dependencies or global installations [1][3]. However, there are important nuances to this behavior: 1. Local Priority: By design, npx first checks for the package in your local project's dependencies (node_modules/.bin) or global path [1][4]. If it finds an executable there, it will use that version rather than fetching a new one [3][5]. 2. Caching: Once a package is fetched by npx, it is stored in an npx-specific cache [6][7]. If you run the same command again, npx may use the cached version rather than checking the registry for a newer one, unless you force an update or provide a specific tag like @latest [6][7]. 3. Explicit Versions/Ranges: If you provide a version or a semver range (e.g., npx @1.0.0 or npx @^1.0.0), npx will attempt to satisfy that specific requirement [1][7]. If you want to ensure you are always using the newest available version of a package regardless of local or cached copies, explicitly appending @latest (e.g., npx @latest) is the most reliable way to force npx to fetch the latest version from the registry [8][6][7]. In summary, while npx aims to provide the latest version when no specifier is provided, local availability and internal caching can cause it to use older versions [6][7]. Using @latest explicitly bypasses ambiguity and ensures the most recent version is fetched [8][7].
Citations:
- 1: https://docs.npmjs.com/cli/v11/commands/npx/
- 2: https://docs.npmjs.com/cli/v12/commands/npm-exec/
- 3: https://docs.npmjs.com/cli/v8/commands/npx/
- 4: https://www.npmjs.com/package/npx
- 5: https://manpages.debian.org/unstable/npm/npx.1.en.html
- 6: [BUG] npx not getting latest version, yes again! npm/rfcs#700
- 7: [BUG] npx does not fetch latest possible semvar match npm/cli#7838
- 8: https://docs.npmjs.com/cli/v11/commands/npm-install/?v=true
Security Misconfiguration (CWE-494): Download of Code Without Integrity Check
Reachability: External
MCP 패키지 실행을 고정한 설치 아티팩트로 바꾸세요.
docs/setup/figma-mcp.md의 "command": "npx", "args": ["-y", "figma-developer-mcp"]는 npx가 package.json/node_modules/.bin 또는 npm cache에 없으면 외부 npm 레지스트리에서 패키지를 해석해 실행합니다. -y는 설치 프롬프트만 생략하므로 버전 또는 무결성 검증을 대체하지 않습니다. 검증된 정확한 버전과 무결성 검증이 적용된 설치 아티팩트를 사용하세요.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/setup/figma-mcp.md` around lines 31 - 32, Update the Figma MCP
configuration in the documented setup example to run a verified, pinned
installation artifact instead of resolving figma-developer-mcp through npx with
-y. Use an exact approved package version and enforce integrity verification for
the artifact, while preserving the existing MCP launch configuration.
- .agents/skills/git/issue/SKILL.md (신규) - .agents/skills/git/commit/SKILL.md (secret guard, atomic 분리 추가) - .agents/skills/git/pr/SKILL.md (핵심 원칙, 사전 검증 추가) - AGENTS.md (git/issue 트리거 추가)
1 participant
📌 Related Issues
📄 Tasks
⭐ PR Point (To Reviewer)
Summary by CodeRabbit
새로운 기능
문서