---
name: verify-feature
description: Runs mechanical + semantic post-build checks on a set of files. Defaults to the current git diff; accepts explicit paths (folders or files) for projects not using the /build-feature flow. Catches security, styling, type, and rule violations before commit.
metadata:
  category: Quality
---

# Skill: Verify Feature

Two-phase post-build checks on a target set of files. Catches security, import, styling, type, and architectural violations before commit.

## When to use

- After editing files in a humand-create-app project
- Before commit — standalone or as final step of `/build-feature`
- When you want a quick quality gate without the full build flow

## Prerequisites

- `bun` available in the project
- `humand-react` plugin installed (for Phase 2 semantic rules)
- At least one of: files in the git diff, or explicit paths provided

## Inputs

- **`projectPath`** — repo root
- **`paths`** *(optional)* — space-separated list of files or folders to check (e.g. `src/pages/Orders/ src/components/OrderCard.tsx`). If omitted, the skill reads the target files from `git diff --name-only -- 'src/**'`.

Ask the user for `paths` only if there are no git-tracked changes (clean diff) and the context doesn't make it obvious which files to check.

## Steps

### Phase 1 — Mechanical (delegate to haiku)

Deterministic checks. No LLM judgment. Cheap in tokens.

```
Agent({
  model: "haiku",
  prompt: `
    Run these checks in {projectPath} and report results:

    1. npx tsc --noEmit
       - Ignore TS2688 and TS5101 warnings (pre-existing config issues)
       - Report any other type errors with file:line

    2. bun run biome:fix && bun run lint
       - Report if it passes or list remaining errors

    3. bun run ${CLAUDE_PLUGIN_ROOT}/skills/verify-feature/scripts/post-build-check.ts {paths}
       - If {paths} is empty, the script reads targets from git diff automatically
       - If {paths} is provided, pass them as arguments (e.g. "src/pages/Orders/ src/components/Foo.tsx")
       - Exit 0 = PASS, exit 1 = FAIL (Critical/High), exit 2 = WARN (Medium)

    Report the full output of each command.
  `
})
```

**Pattern checks performed by the script:**

| ID | What it detects | Severity |
|----|----------------|----------|
| SEC-01 | `dangerouslySetInnerHTML` (XSS) | Critical |
| SEC-02 | `eval()` / `new Function()` | Critical |
| SEC-03 | Hardcoded secrets (apiKey, password, token) | Critical |
| SEC-04 | Known secret key patterns (sk-, AKIA, sk_live) | Critical |
| SEC-05 | `VITE_` env var exposing secrets (SECRET, API_KEY, TOKEN, etc.) | High |
| SEC-06 | Direct external `fetch`/`axios` call (use `/api/` proxy) | High |
| SEC-07 | Sensitive data in `localStorage`/`sessionStorage` | High |
| SEC-08 | Direct `.innerHTML =` assignment (XSS) | Critical |
| SEC-09 | `target="_blank"` without `rel="noopener noreferrer"` | Medium |
| IMP-01 | Direct `@mui/material` imports | High |
| STY-01 | Hardcoded hex colors | High |
| STY-02 | `style` prop instead of `sx` | Medium |

If Phase 1 reports **Critical** or **High** findings, fix them before Phase 2.
**Medium**: fix if straightforward, otherwise note and continue.

### Phase 2 — Semantic review (run directly — Sonnet)

Determine the target files:
- If `{paths}` was provided: use those files/folders
- Otherwise: `git diff --name-only -- 'src/**'`

Read only those files. Verify compliance against the rules below, matched by file path.

**For every `.ts`/`.tsx` file** (requires `humand-react` installed):
- `humand-react/rules/file-types/typescript.mdc`
- `humand-react/rules/file-types/react.mdc`
- `humand-react/rules/file-types/react-styling.mdc`
- `humand-react/rules/file-types/react-accessibility.mdc`
- `humand-react/rules/file-types/react-query.mdc`

**For files in `src/pages/dashboard/`** (requires `humand-react` installed):
- `humand-react/rules/file-types/module-architecture-conventions.mdc`
- `humand-react/rules/file-types/module-architecture.mdc`
- `humand-react/rules/file-types/module-architecture-files.mdc`
- `humand-react/rules/file-types/module-architecture-hooks.mdc`

**For forms**: `humand-react/rules/file-types/forms.mdc`

**For drawers**: `humand-react/rules/file-types/drawer-layer.mdc`

**For sandbox projects:**
- `humand-frontend-sandbox/rules/file-types/sandbox.md`
- `humand-frontend-sandbox/rules/file-types/sandbox-components.md`
- `humand-frontend-sandbox/rules/file-types/sandbox-styling.md`
- `humand-frontend-sandbox/references/CONVENTIONS.md`

**Additional semantic checks (no dedicated rule yet):**

Security:
- (Critical) Hardcoded secrets (API keys, tokens, passwords, connection strings)
- (Critical) User input interpolated in URLs or queries without sanitization
- (Critical) `VITE_*` variables containing server-side-only values
- (Critical) Imports from packages not listed in `package.json`
- (Critical) External API calls that bypass the `/api/` proxy

Accessibility (beyond `react-accessibility.mdc`):
- (High) Every `TextField`, `Select`, `Autocomplete` has `label` or `aria-label`
- (High) `<img>` tags and `Avatar` components have descriptive `alt`
- (Critical) Custom interactive elements have `tabIndex`, `onKeyDown`, or `role`
- (Critical) Low-hierarchy color tokens (`text.disabled`) not used for primary content
- (High) Fields with Zod validation display a visible error message

Design system (beyond `react-styling.mdc`):
- (High) No hardcoded font sizes, weights, or font families
- (High) No custom `boxShadow` — use the 3 system elevation levels

i18n (beyond `react.mdc`):
- (Low) Translation keys are descriptive and semantic (not `label1`, `text`)
- (Medium) Texts with quantities handle plural/singular

## Expected output

Findings with: file and line, rule/check violated, suggested fix.

**Severities:**
- **Critical** — blocks commit, must resolve
- **High** — resolve before commit
- **Medium** — recommended, can defer with justification
- **Low** — suggestion, non-blocking

## Integration

`/build-feature` invokes this skill at its post-build step. Can also run standalone at any point.

If fixes are needed: apply them and re-run Phase 1 before confirming.
