Stop Pasting Review Prompts: Put a 'frontend-review' Skill in Your Repo
Team rule changes now go through the same PR flow as code, so frontend review standards stop drifting across chat histories. The open standard is cross-product, so a skill written once works in Cursor, VS Code, and any AAIF-compliant agent.
The problem: teams using AI for code review end up with each person's chat history holding a slightly different version of the frontend review checklist. The fix proposed here is Agent Skills, an open standard Anthropic donated to the Linux Foundation's Agentic AI Foundation in October 2026. A skill is a folder with a mandatory SKILL.md that carries YAML frontmatter (name and description) and markdown instructions, loaded on demand via progressive disclosure. This article provides a copy-ready 'frontend-review' skill that runs a four-step procedure: scope check → typecheck → lint → deny-list scan for risky patterns like exposed secrets, unvalidated postMessage origins, and dangerouslySetInnerHTML. It outputs a structured report with pass/conditional-pass/fail, executed checks, and must/should/later buckets. Deployment is straightforward: copy the folder to .agents/skills, run a zero-dependency bash script to validate, and trigger it with natural language. The piece also covers writing an effective description (include what it does and trigger phrases), common pitfalls (name mismatches, bloated SKILL.md, security overreach), and a rollout order: start with review, then new page/component, then narrow domain skills. The core shift is moving review rules from prose in chat to versioned files in the repo, so they can be PR'd, diffed, and shared.
Moving review rules from chat to a SKILL.md changes their lifecycle: they become diffable and reviewable, which is a meaningful step toward standardizing AI behavior across a team.
The deny-list approach that only reports defensive findings without PoCs is a responsible balance, though it leaves the actual fix to a human.
Progressive disclosure solves the context-bloat problem, but it relies on a well-crafted description; the emphasis on testing triggers with real phrases shows that discoverability is the hard part.
The distinction between skill (session procedure) and CI (merge gate) is a useful boundary; it keeps AI review as an assistance layer rather than a replacement for automated checks.
Starting with a stable, command-driven process like review before introducing narrow skills suggests that process stability is a prerequisite for effective skill-building.