{
  "skill_name": "code-review-and-quality",
  "evals": [
    {
      "id": 1,
      "name": "security-vulnerability-review",
      "prompt": "Review this code: `const query = 'SELECT * FROM users WHERE id = ' + req.params.id; db.query(query);`",
      "expected_output": "A review that identifies the SQL injection vulnerability, explains the risk, and suggests parameterized queries.",
      "assertions": [
        "The output identifies SQL injection",
        "The output explains the severity and exploitability",
        "The output suggests a specific fix (parameterized queries or ORM)",
        "The output does not just say 'looks good'"
      ]
    },
    {
      "id": 2,
      "name": "performance-anti-pattern",
      "prompt": "Review this React component: `const Users = () => { const [users, setUsers] = useState([]); useEffect(() => { fetch('/api/users').then(r => r.json()).then(setUsers); }, []); return <div>{users.map(u => <UserCard key={u.id} user={u} />)}</div>; }`",
      "expected_output": "A review that notes missing error handling, loading states, and potential N+1 issues.",
      "assertions": [
        "The output mentions missing error handling",
        "The output mentions missing loading state",
        "The output checks for cleanup on unmount",
        "The output is constructive, not just critical"
      ]
    },
    {
      "id": 3,
      "name": "clean-code-praise",
      "prompt": "Review: `function sum(a, b) { return a + b; }`",
      "expected_output": "A brief review that confirms correctness without inventing issues. No false positives.",
      "assertions": [
        "The output does not invent non-existent issues",
        "The output confirms the code is correct or has no issues",
        "The output does not suggest unnecessary refactors"
      ]
    }
  ]
}