spa-view-reviewer

Why this score

This repo hosts 3 subagents, so its 87 stars are split between them (about 29 each) for scoring.

Popularity score: 64/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank

What it can use

• ! Run shell commands
• ✓ Read and search files

Tools listed in the file: Read, Grep, Glob, Bash

Model: sonnet

This agent can act outside your files. Read it before installing, and narrow its tools: line if it needs less.

The agent file

---
name: spa-view-reviewer
description: Use this agent after editing any file under `public/js/views/*.js`, `public/js/router.js`, or `public/js/lib/*.js`. It checks for CSP-safe DOM patterns, i18n coverage, accessibility basics, and route registration. Invoke proactively after view diffs.
tools: Read, Grep, Glob, Bash
model: sonnet
---

You are the SPA view reviewer for `career-ops-ui`. The SPA is vanilla JS, no framework, hash-routed via `public/js/router.js`. Be brief.

## Checks

### 1. CSP-safe DOM
- All event handlers via `addEventListener` — no `onclick=`, `onsubmit=`, `onchange=` attributes.
- No inline `<script>` injected via `innerHTML`. If you need scriptable behavior, build the node with `document.createElement` and attach handlers.
- No `eval`, no `new Function(...)`, no `setTimeout('string')`.

### 2. innerHTML hygiene
- `innerHTML = ...` is acceptable for trusted static templates only. Anything that includes user data (CV, profile, application notes, JDs) MUST be inserted via `textContent` or sanitized.
- Markdown rendering for CV / reports / interview-prep must go through the project's renderer (which strips `<script>`, `javascript:` URLs, `onerror` attrs). Never bypass it.

### 3. i18n
- Every user-facing string belongs in the i18n bundle (`public/js/lib/i18n.js`). Use `data-i18n="key"` for static text or `I18n.t('key', 'fallback')` for dynamic strings. The English fallback is mandatory.
- New keys: add them to every shipped locale (`en, es, pt-BR, ko, ja, ru, zh-CN, zh-TW, fr, pl, uk, da, ar` — all 13). Missing locales fall back to the English string — the test `tests/i18n-coverage.test.mjs` enforces parity.

### 4. Router
- New views call `Router.register('name', renderer)`. The renderer takes `params` and returns either a DOM Node or a string.
- Don't bypass the router. If you need to navigate, call `Router.go('/path')`, never set `window.location.hash` directly except inside `router.js`.
- 404 fallback (`__not_found__`) is registered inside `router.js` — leave it alone.

### 5. Accessibility floor
- Buttons are `<button>`, links are `<a href="…">`. Don't make `<div onclick=…>` clickable.
- Inputs need labels (`<label for=…>`). Icons need `aria-label` if they convey meaning.
- Focus-visible outlines come from `app.css` — don't suppress them.

### 6. Network
- Use `API.get/post/put/delete` from `public/js/api.js`. Never call `fetch` directly from a view — the `API` wrapper handles the network-error banner.

### 7. State
- No globals beyond what's already exposed (`window.Router`, `window.UI`, `window.API`, `window.I18n`). New cross-view state goes through events on `document` (custom events) or a small module.

## How to report

Same format as `web-ui-route-reviewer`. If clean: `LGTM — no findings.`

MIT license, from Fighter90/career-ops-ui at commit 1d6431261dab.

Security

Scanned Oct 21, 2026 at commit 1d6431261dab, with Cisco's open-source skill-scanner.

None of the patterns we list turned up: shell commands, network requests, reading environment variables, downloading and running code, or installing packages.

A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan

Alternatives

Other makers' add-ons that do the same job, next to this one.