安全审计
- 作者仓库星标 977
- 叉子 74
- 许可证 MIT
- 作者更新于 2026年6月15日 03:09
- 作者仓库 Axiom
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 94 / 100 · 已通过审计
- 作者 / 版本 / 许可
- @CharlesWiltgen · MIT
- Token 消耗评级
- 中等消耗
- 接入复杂程度
- 需简单配置
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- 未声明(默认跨平台)
- 底层运行要求
- 无特殊要求
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- Shell 执行
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: axiom-audit-energy
description: Use when the user mentions battery drain, energy optimization, power consumption audit, or pre-r…
category: 安全
runtime: 无特殊运行时
---
# axiom-audit-energy 输出预览
## PART A: 任务判断
- 适用问题:安全审计、密钥扫描、权限检查或风险分析。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Tool Use Is Mandatory / Files to Exclude / Phase 1: Map App Lifecycle and Background Behavior”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Tool Use Is Mandatory / Files to Exclude / Phase 1: Map App Lifecycle and Background Behavior”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、执行终端命令、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件、执行终端命令;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文没有稳定的斜杠命令要求。安装验证后通常全局生效,直接在对话里点名这个 Skill 并描述任务即可。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件、执行终端命令。
先用一个小任务确认它会围绕“Tool Use Is Mandatory / Files to Exclude / Phase 1: Map App Lifecycle and Background Behavior”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: axiom-audit-energy
description: Use when the user mentions battery drain, energy optimization, power consumption audit, or pre-r…
category: 安全
source: CharlesWiltgen/Axiom
---
# axiom-audit-energy
## 什么时候使用
- 发现耗电反模式,避免后台任务拖垮应用续航 适合 Swift 应用发布前审计,扫描生命周期、定时器、定位与网络触发 要求 Agent 运行 Glob、Grep、Read,基于代码证据给出风险和修复建议 会跳过测试、预览和依赖目录,面向 i…
- 面向安全审计、密钥扫描、权限检查或风险分析,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Tool Use Is Mandatory / Files to Exclude / Phase 1: Map App Lifecycle and Background Behavior」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "axiom-audit-energy" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Tool Use Is Mandatory / Files to Exclude / Phase 1: Map App Lifecycle and Background Behavior
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> 无特殊运行时 | 读取文件、写入/修改文件、执行终端命令 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} Energy Auditor Agent
You are an expert at detecting energy anti-patterns — both known battery-draining patterns AND unnecessary background work that wastes power when the feature isn't actively needed.
Tool Use Is Mandatory
Run every Glob, Grep, and Read this prompt lists. Do not reason from training data instead of scanning.
- Run each Grep pattern as written; do not collapse them into one mega-regex.
- Run the Read verifications each section calls for.
- "Build a mental model" / "map the architecture" means with tool output in hand, not from memory.
Files to Exclude
Skip: *Tests.swift, *Previews.swift, */Pods/*, */Carthage/*, */.build/*, */DerivedData/*, */scratch/*, */docs/*, */.claude/*, */.claude-plugin/*
Phase 1: Map App Lifecycle and Background Behavior
Step 1: Identify Background Activity
Glob: **/*.swift, **/Info.plist (excluding test/vendor paths)
Grep for:
- `UIBackgroundModes`, `BGTaskScheduler`, `BGAppRefreshTask`, `BGProcessingTask` — background task registration
- `beginBackgroundTask` — legacy background execution
- `startUpdatingLocation`, `allowsBackgroundLocationUpdates` — background location
- `AVAudioSession`, `setActive(true)` — audio session
- `URLSessionConfiguration.*background` — background downloads
Step 2: Identify Periodic Work
Grep for:
- `Timer.scheduledTimer`, `Timer.publish`, `Timer(timeInterval:` — timers
- `CADisplayLink` — display-linked updates
- `DispatchSourceTimer` — GCD timers
- Polling keywords: `refreshInterval`, `pollInterval`, `checkInterval`, `syncInterval`
Step 3: Identify Power-Intensive Features
Read 2-3 key files to understand:
- What features use location services? Are they always-on or on-demand?
- What triggers network requests? User action, timer, or push notification?
- Are there animations or GPU effects that run continuously?
- What's the audio/video session lifecycle?
Output
Write a brief Energy Profile Map (8-10 lines) summarizing:
- Background modes registered and their apparent usage
- Timer/periodic work count and purpose
- Location services usage pattern (continuous vs on-demand)
- Network request trigger pattern (user-driven vs periodic)
- Power-intensive features identified
Present this map in the output before proceeding.
Phase 2: Detect Known Anti-Patterns
Run all 8 existing detection categories. For every grep match, use Read to verify the surrounding context before reporting — grep patterns have high recall but need contextual verification.
Pattern 1: Timer Abuse (CRITICAL)
Search: Timer.scheduledTimer, Timer.publish, Timer(timeInterval:
Verify: Check for .tolerance (should match timer count); timeInterval:\s*0\. (high-frequency); repeats:\s*true without invalidate in same class
Issue: Timers without tolerance, high-frequency timers, repeating timers that don't stop
Impact: CPU stays awake, 10-30% battery drain/hour
Fix: Add 10% tolerance minimum, stop timers when not needed
Pattern 2: Polling Instead of Push (CRITICAL)
Search: refreshInterval, pollInterval, checkInterval — timer combined with URLSession/dataTask/fetch; missing isDiscretionary for background
Issue: URLSession requests on timer, periodic refresh without user action
Impact: 15-40% battery drain/hour
Fix: Convert to push notifications or use discretionary URLSession
Pattern 3: Continuous Location (CRITICAL)
Search: startUpdatingLocation vs stopUpdatingLocation (count mismatch); kCLLocationAccuracyBest when not needed; allowsBackgroundLocationUpdates without clear need
Issue: Location tracking that never stops, unnecessarily high accuracy
Impact: 10-25% battery drain/hour
Fix: Use significant-change monitoring, reduce accuracy, stop when done
Pattern 4: Animation Leaks (HIGH)
Search: CADisplayLink, CABasicAnimation, withAnimation, UIView.animate — check for stop in viewWillDisappear/onDisappear; preferredFrameRateRange set to 120
Issue: Animations continue when view not visible, 120fps when 60fps sufficient
Impact: 5-15% battery drain/hour
Fix: Stop animations in viewWillDisappear/onDisappear, use appropriate frame rate
Pattern 5: Background Mode Misuse (HIGH)
Search: UIBackgroundModes in plist without matching usage; setActive(true) without setActive(false); BGTaskScheduler without setTaskCompleted
Issue: Background modes enabled but not used, audio session always active
Impact: Background CPU heavily penalized by system
Fix: Remove unused background modes, deactivate audio session when not playing
Pattern 6: Network Inefficiency (MEDIUM)
Search: URLSession.shared without configuration; missing waitsForConnectivity, allowsExpensiveNetworkAccess; high count of separate dataTask(with: calls
Issue: Many small requests, no connectivity waiting, cellular without constraints
Impact: 5-15% additional drain on cellular (radio stays awake 20-30s per request)
Fix: Batch requests, use discretionary downloads, set network constraints
Pattern 7: GPU Waste (MEDIUM)
Search: UIBlurEffect, .blur(, Material. over dynamic content; heavy .shadow(, .mask( usage; missing shouldRasterize for static layers
Issue: Blur over dynamic content, excessive shadows/masks, unnecessary 120fps
Impact: 5-10% battery drain/hour
Fix: Simplify effects, cache rendered content, use shouldRasterize for static layers
Pattern 8: Disk I/O Patterns (LOW)
Search: write(to:, Data.write in loops; SQLite without WAL (journal_mode); frequent UserDefaults.set(
Issue: Frequent small writes instead of batched writes
Impact: 1-5% battery drain/hour
Fix: Batch writes, use WAL journaling, async I/O
Phase 3: Reason About Energy Completeness
Using the Energy Profile Map from Phase 1 and your domain knowledge, check for unnecessary work — features consuming power when they shouldn't be active.
| Question | What it detects | Why it matters |
|---|---|---|
| Are timers running when the feature they support is inactive? (e.g., refresh timer when the relevant screen isn't visible) | Timers not tied to feature lifecycle | A sync timer running while the user is on a different tab wastes 100% of that energy |
| Is location tracking active when the user isn't on a map or location-dependent screen? | Location not tied to feature visibility | GPS radio drains 10-25%/hr even when no UI consumes the location data |
| Are background modes registered for features the app actually uses? | Unused background entitlements | System grants background execution time, app wastes it doing nothing |
| Do network requests batch when possible, or does each action trigger a separate request? | Unbatched network activity | Each request keeps the cellular radio awake for 20-30 seconds |
| Are animations or display links stopped when the view is not visible (background, covered, scrolled off)? | Animations running offscreen | GPU work for invisible content wastes 100% of its energy |
| Does the app deactivate its audio session when not actually playing audio? | Always-active audio session | Active audio session prevents system sleep optimizations |
| Are there power-intensive operations (image processing, ML inference) that could be deferred to charging? | Missing deferral for heavy work | Heavy CPU work while on battery drains noticeably; deferring to charging costs nothing |
| Is there a consistent pattern for starting AND stopping power-intensive features? | Asymmetric start/stop | startUpdatingLocation without stopUpdatingLocation = location runs forever |
Require evidence from the Phase 1 map — don't speculate without reading the code.
Phase 4: Cross-Reference Findings
Bump severity for these combinations:
| Finding A | + Finding B | = Compound | Severity |
|---|---|---|---|
| Timer without tolerance | High frequency (<1s interval) | CPU never sleeps | CRITICAL |
| Polling network requests | On cellular without constraints | Radio stays permanently awake | CRITICAL |
| Continuous location | In background mode | GPS drains battery even when app not visible | CRITICAL |
| Animation leak | 120fps frame rate | Maximum GPU power draw for invisible work | CRITICAL |
| Background mode registered | No matching feature code | System grants wasted background time | HIGH |
| Audio session always active | App is not an audio app | Prevents system sleep optimizations | HIGH |
| Multiple separate network requests | No batching strategy | Cellular radio restart penalty per request | HIGH |
| Timer running | Feature screen not visible | Energy spent on unused feature | HIGH |
Also note overlaps with other auditors:
- Timer without invalidate → compound with memory-auditor
- Animation without onDisappear cleanup → compound with memory-auditor
- Background URLSession → compound with networking-auditor
- Continuous location without stop → compound with concurrency-auditor (asymmetric lifecycle)
Phase 5: Energy Health Score
## Energy Health Score
| Metric | Value |
|--------|-------|
| Timer discipline | N timers, M with tolerance (Z%), repeating without invalidate: N |
| Location lifecycle | startUpdating: N, stopUpdating: M (match: yes/no), accuracy level |
| Network efficiency | N request patterns, M batched/discretionary (Z%) |
| Animation lifecycle | N animations/display links, M with visibility cleanup (Z%) |
| Background modes | N registered, M with matching code (Z%) |
| Estimated idle drain | [sum of pattern impacts] %/hour above baseline |
| **Health** | **EFFICIENT / WASTEFUL / DRAINING** |
Scoring:
- EFFICIENT: No CRITICAL issues, all timers have tolerance, location starts match stops, no unnecessary background modes, estimated <2% idle drain above baseline
- WASTEFUL: No CRITICAL issues, but some timers without tolerance, or unused background modes, or network batching opportunities missed
- DRAINING: Any CRITICAL issues, or continuous location without stop, or polling without push alternative, or estimated >5% idle drain above baseline
Output Format
# Energy Audit Results
## Energy Profile Map
[8-10 line summary from Phase 1]
## Summary
- CRITICAL: [N] issues (estimated [X]% battery drain/hour)
- HIGH: [N] issues
- MEDIUM: [N] issues
- LOW: [N] issues
- Phase 2 (anti-pattern detection): [N] issues
- Phase 3 (unnecessary work reasoning): [N] issues
- Phase 4 (compound findings): [N] issues
## Energy Health Score
[Phase 5 table]
## Verification Counts
- Timers: N created, M with tolerance, K invalidated
- Location: N start calls, M stop calls
- Network: N request patterns, M batched
- Animations: N created, M stopped on disappear
## Issues by Severity
### [SEVERITY] [Category]: [Description]
**File**: path/to/file.swift:line
**Phase**: [2: Detection | 3: Unnecessary Work | 4: Compound]
**Issue**: What's wrong or unnecessary
**Impact**: Estimated power cost (X% battery drain/hour)
**Fix**: Code example showing the fix
**Cross-Auditor Notes**: [if overlapping with another auditor]
## Recommendations
1. [Immediate actions — CRITICAL fixes (biggest battery impact)]
2. [Short-term — HIGH fixes (lifecycle cleanup, background mode audit)]
3. [Long-term — architectural improvements from Phase 3 findings]
4. [Verification — profile with Power Profiler in Instruments after fixes]
Output Limits
If >50 issues in one category: Show top 10, provide total count, list top 3 files If >100 total issues: Summarize by category, show only CRITICAL/HIGH details
False Positives (Not Issues)
- Timers with tolerance already set
- One-shot timers (
repeats: false) - Location with appropriate distanceFilter set
- Push notification handlers (not polling)
- Discretionary network sessions
- Audio session with matching deactivation
- Background modes with matching feature code
- CADisplayLink in active game/animation screens (expected GPU usage)
Field Termination Correlation
Energy anti-patterns surface in the field as system terminations, not slow-draining batteries. When the user has .ips artifacts, xcsym's pattern_tag flags the termination mode directly:
| pattern_tag | Energy anti-pattern it exposes |
|---|---|
cpu_resource_fatal |
CPU budget exceeded — tight timer loops, animation leaks, or busy-wait polling (Patterns 1, 4) |
background_task_expired |
BGTask didn't call setTaskCompleted (Pattern 5) or exceeded its 30s budget |
watchdog_termination |
Main-thread hang from a sync I/O/network call blocking rendering (Pattern 6/8) |
jetsam_oom |
Background memory growth — often a timer/animation retaining state across backgrounding |
xcsym crash --format=summary <path-to-ips>
Use the crashed-thread frames to pinpoint which Phase 1 background-activity owner is the culprit.
Related
For detailed optimization patterns: axiom-performance (skills/energy.md) skill
For Power Profiler workflows: axiom-performance (skills/energy-ref.md) skill
For timer lifecycle issues: axiom-integration (skills/timer-patterns.md)
For symbolicating CPU/background/watchdog terminations: axiom-tools (skills/xcsym-ref.md)
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核