后端审计
- 作者仓库星标 0
- 作者更新于 实时读取
- 作者仓库 skills-registry
- 领域
- 通用
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @tomevault-io · 未声明 license
- Token 消耗评级
- 低消耗
- 接入复杂程度
- 需手动接入
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- Docker
- 底层运行要求
- Node.js · Bun · Python · Docker
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- Shell 执行
- 读取环境变量
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生,可能与作者实际意图存在差异。
需要注意: 未限定 allowed-tools,默认拥有全部工具权限。
---
name: dev-server
description: > Use when this capability is needed. Start the project's dev server and watch its output for er…
category: 通用
runtime: Node.js / Bun / Python / Docker
---
# dev-server 输出预览
## PART A: 任务判断
- 适用问题:通用任务拆解、检查和交付。
- 输入要求:目标材料、限制条件、期望输出和验收方式。
- 证据边界:围绕“Workflow / 1. Detect the stack / 2. Pre-flight checks”读取原文规则,不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断:确认你的需求是否属于通用任务拆解、检查和交付,并标出输入、限制和预期结果。
- **02** 执行计划:优先按“Workflow / 1. Detect the stack / 2. Pre-flight checks”拆成步骤,说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果:给出可复制的命令、文件改动、检查清单或内容草稿,并说明如何继续迭代。
- **04** 风险边界:结合 读取文件、写入/修改文件、执行终端命令、读取环境变量、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件、执行终端命令、读取环境变量;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先小样例验证,再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 原文出现了 `/dev`、`/health`、`/api` 这类斜杠命令;如果你的 Agent 支持命令触发,优先用命令开场,再补充目标和边界。
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是:读取文件、写入/修改文件、执行终端命令、读取环境变量。
先用一个小任务确认它会围绕“Workflow / 1. Detect the stack / 2. Pre-flight checks”工作;涉及文件或命令时,先看 diff、日志、预览或测试结果。
检查最终产物是否包含明确结果、必要证据和下一步动作;如果输出泛泛而谈,就补充输入、边界和验收标准后重跑。
---
name: dev-server
description: > Use when this capability is needed. Start the project's dev server and watch its output for er…
category: 通用
source: tomevault-io/skills-registry
---
# dev-server
## 什么时候使用
- 把通用方向的常用动作沉淀成 Agent 可调用的技能 适合处理通用任务拆解、检查、交付和复盘,核心价值是把输入、判断、执行、验证和交付边界固定下来,避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤;通常不需要额外…
- 面向通用任务拆解、检查和交付,优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Workflow / 1. Detect the stack / 2. Pre-flight checks」组织步骤,不把推断写成作者事实。
- 读取文件、写入/修改文件、执行终端命令、读取环境变量;会按任务需要访问外部网络;通常不需要额外 API Key。
- 先跑小样例,确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown,不编造命令、平台或依赖。 作者原文负责流程事实;仓库文件负责来源和命令;流狐只补充适用场景、限制和质量判断。
skill "dev-server" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Workflow / 1. Detect the stack / 2. Pre-flight checks
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> Node.js / Bun / Python / Docker | 读取文件、写入/修改文件、执行终端命令、读取环境变量 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
} Dev Server — Start & Monitor
Start the project's dev server and watch its output for errors. The user says "start dev" and you handle detection, startup, and monitoring — they only hear from you when something breaks.
Workflow
1. Detect the stack
Scan the working directory for project markers. Check in this order — first match wins:
| Marker file | Stack | Dev command | Default port |
|---|---|---|---|
package.json |
Node.js (see framework table) | varies | 3000 |
manage.py |
Django | python manage.py runserver |
8000 |
Pipfile or pyproject.toml with [tool.poetry] |
Python (check for framework) | varies | 8000 |
requirements.txt with fastapi |
FastAPI | uvicorn main:app --reload |
8000 |
requirements.txt with flask |
Flask | flask run --reload |
5000 |
Gemfile with rails |
Rails | bin/rails server |
3000 |
Gemfile with sinatra |
Sinatra | ruby app.rb |
4567 |
go.mod |
Go | go run . |
8080 |
Cargo.toml |
Rust | cargo run |
8080 |
pom.xml |
Maven/Spring | ./mvnw spring-boot:run |
8080 |
build.gradle / build.gradle.kts |
Gradle/Spring | ./gradlew bootRun |
8080 |
mix.exs with phoenix |
Phoenix | mix phx.server |
4000 |
composer.json with laravel |
Laravel | php artisan serve |
8000 |
docker-compose.yml |
Docker | docker compose up |
varies |
Makefile with dev target |
Make | make dev |
varies |
Node.js framework detection — when package.json exists, check dependencies:
| Dependency | Framework | Default command |
|---|---|---|
next |
Next.js | next dev |
vite or @vitejs/* |
Vite | vite |
@remix-run/dev |
Remix | remix dev |
astro |
Astro | astro dev |
@sveltejs/kit |
SvelteKit | vite dev |
nuxt |
Nuxt | nuxt dev |
@angular/cli |
Angular | ng serve |
gatsby |
Gatsby | gatsby develop |
expo |
Expo | expo start |
| (none match) | npm scripts | <pm> run dev |
Node.js package manager — check in order:
bun.lockorbun.lockb→bunx/bun runpnpm-lock.yaml→pnpm exec/pnpm runyarn.lock→yarn/yarn run- Default →
npx/npm run
Python environment — check in order:
.venv/orvenv/exists →source .venv/bin/activate &&poetry.lock→poetry runPipfile.lock→pipenv run- Default → direct command
If nothing matches, tell the user you couldn't detect the stack and ask what command to run.
If the detection picks a stack that seems wrong for the directory (e.g. package.json exists but it's just dev tooling in a Python project, or both manage.py and package.json present and unclear which is primary), show the user your guess and confirm before starting. Don't silently commit to a wrong stack.
2. Pre-flight checks
Before starting:
Port conflict — check if the default (or user-specified) port is taken:
lsof -i :<port> -t 2>/dev/nullIf occupied, identify the occupying process (
ps -p <pid>) and present two options to the user: kill PID N, or bind to port+1. Pick a default — don't block on the question if the occupying process is clearly another dev-server instance of the same project.Dependencies installed?
- Node: check
node_modules/exists - Python: check virtualenv exists or key packages importable
- Ruby: check
bundle checkpasses - Go/Rust/Java: no check needed (build tools handle it)
If missing, ask the user if you should install first.
- Node: check
3. Start with Monitor
Use the Monitor tool with persistent: true so the server runs for the session.
The grep filter matters because a raw dev-server stdout stream is mostly routine request logs — thousands of lines of noise that would flood the conversation and hide real errors. The pattern below surfaces only startup failures, runtime exceptions, build errors, and warnings:
<dev-command> 2>&1 | grep --line-buffered -iE \
'(error[:\[]| ERR[!_]|EADDRINUSE|EACCES|ENOENT|ECONNREFUSED|FATAL|panic|Segmentation|Module not found|Cannot find module|ModuleNotFoundError|ImportError|SyntaxError|TypeError|ReferenceError|NameError|AttributeError|KeyError|ValueError|RuntimeError|IndentationError|failed to|build failed|compile error|compilation error|WARN[:\[]|warning[:\[]|deprecated|port.*already|address already in use|unhandled|rejected|crash|killed|Traceback|Exception|FAILED|ActionView|ActiveRecord|LoadError|undefined method|NoMethodError|cannot find|not found|Permission denied|exit code [1-9]|exit status [1-9]|thread.*panic|cannot compile)'
Set the Monitor description to something specific: "Next.js dev :3000" or "Django dev :8000".
Port flag by stack (when user specifies a port):
- Next.js:
-p PORT - Vite/Astro/SvelteKit/Nuxt/Remix/Angular:
--port PORT - Django:
0.0.0.0:PORT - Flask:
--port PORT - FastAPI/Uvicorn:
--port PORT - Rails:
-p PORT - Phoenix: via
PORT=PORTenv var - Laravel:
--port PORT - Go/Rust: usually via env var or arg (check the code)
Announce once started and verified:
Started Next.js dev server (
bun run dev) on :3000 — root URL returned 200, no error overlay. Monitoring for errors.
3.5. Verify it's actually serving
"No error in the Monitor" ≠ "the app works." After the dev command announces readiness, confirm the server is reachable before handing control back to the user:
- HTTP probe —
curl -sS -o /dev/null -w "%{http_code}\n" http://localhost:<port>with a 5s timeout. Expect 2xx/3xx. Non-2xx, connection refused, or timeout → investigate. - UI smoke check (frontend projects) — when the project is a frontend framework (Next.js, Vite, Remix, Astro, SvelteKit, Nuxt, Angular, Gatsby, Expo web), invoke the
browser-useskill to load the root URL, take a screenshot, and check for a visible error overlay (Next.js red box, Vite overlay, React error boundary fallback). Report what you see. - Backend-only projects — if there's a known health/root route (
/health,/api/health,/),curlit and show the status code. Otherwise one HTTP probe is enough.
If verification fails, surface it with the same classification as §4 (build/runtime/dependency/port) — don't just re-announce success.
4. React to errors
When a Monitor notification fires, surface everything the filter caught — do not silently drop items because they look minor. Claude's job is coverage; the user decides what to ignore.
- Classify — build error, runtime exception, missing dependency, port conflict, type error, syntax error, warning, deprecation.
- Context — quote the error, name the file and line if visible.
- Fix or ask — for obvious issues (missing dep, typo, known pattern), suggest or apply the fix. For ambiguous ones, ask.
- Severity shape — label each item (error / warning / info) so the user can filter; do not pre-filter on their behalf.
5. Stopping
When the user says "stop", "kill it", "shut down", or similar:
TaskStopthe Monitor- Confirm stopped
Edge cases
- Monorepo: If
package.jsonhasworkspacesor there's aturbo.json/nx.json, ask which package. Or check for a rootdevscript. - Multiple servers: Frontend + backend? Start each Monitor in the same turn (parallel Bash calls) with distinct descriptions like
"Rails API :3001"and"Vite web :5173". Don't serialize — they're independent. - Docker Compose: If
docker-compose.ymlexists alongside a framework, mention both options. - Custom commands: If the user says "run
XYZand watch it", skip detection — just run their command through the Monitor filter. - Turbopack: If Next.js dev script includes
--turbo, preserve it.
Session continuity
The Monitor is persistent: true and outlives context compaction. If the conversation has been compacted and the user asks about the server, restate: framework, port, PID (from startup), and how long it's been running. Don't assume the user remembers which dev server was started.
Source: alexandrbasis/claudops — distributed by TomeVault.
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核