安全审计
- 作者仓库星标 289
- 作者更新于 实时读取
- 作者仓库 claude-night-market
- 领域
- 安全
- 兼容 Agent
-
- Claude Code
- Cursor
- Cline
- Codex
- Windsurf
- Gemini CLI
- +20
- 信任分
- 88 / 100 · 社区维护
- 作者 / 版本 / 许可
- @athola · 未声明 license
- Token 消耗评级
- 低消耗
- 接入复杂程度
- 即装即用
- 是否需要外部 API Key
- 不需要
- 兼容的系统
- macOS · Linux · Windows
- 底层运行要求
- Node.js
- 文件与系统权限
-
- 只读
- 允许写入 / 修改
- 网络行为
- 允许外网请求
- 安装命令数
- 26 条
档案由构建时根据 SKILL.md 与安装命令自动衍生，可能与作者实际意图存在差异。
需要注意： 未限定 allowed-tools，默认拥有全部工具权限。
---
name: skill-graph-audit
description: Audit Skill() refs; detect hubs, isolates, and dangling targets. Use when auditing skills. Build…
category: 安全
runtime: Node.js
---
# skill-graph-audit 输出预览
## PART A: 任务判断
- 适用问题：安全审计、密钥扫描、权限检查或风险分析。
- 输入要求：目标材料、限制条件、期望输出和验收方式。
- 证据边界：围绕“Overview / When To Use / When NOT To Use”读取原文规则，不把推断写成作者承诺。
## PART B: 执行结果
- **01** 任务判断：确认你的需求是否属于安全审计、密钥扫描、权限检查或风险分析，并标出输入、限制和预期结果。
- **02** 执行计划：优先按“Overview / When To Use / When NOT To Use”拆成步骤，说明每一步会读取什么、修改什么、产出什么。
- **03** 交付结果：给出可复制的命令、文件改动、检查清单或内容草稿，并说明如何继续迭代。
- **04** 风险边界：结合 读取文件、写入/修改文件、会按任务需要访问外部网络、通常不需要额外 API Key 给出执行前确认项。
## Running Rules
- 读取文件、写入/修改文件；会按任务需要访问外部网络；通常不需要额外 API Key。
- 先小样例验证，再放大到真实任务。
- 交付时同时给结果、检查口径和下一步迭代建议。 先确认触发方式
原文没有稳定的斜杠命令要求。安装验证后通常全局生效，直接在对话里点名这个 Skill 并描述任务即可。
给清楚输入和边界
告诉 Agent 目标文件或材料、期望结果、不可改范围、是否允许联网或执行命令。本 Skill 的权限画像是：读取文件、写入/修改文件。
小样例验证后再放大
先用一个小任务确认它会围绕“Overview / When To Use / When NOT To Use”工作；涉及文件或命令时，先看 diff、日志、预览或测试结果。
复核后再交付
检查最终产物是否包含明确结果、必要证据和下一步动作；如果输出泛泛而谈，就补充输入、边界和验收标准后重跑。
---
name: skill-graph-audit
description: Audit Skill() refs; detect hubs, isolates, and dangling targets. Use when auditing skills. Build…
category: 安全
source: athola/claude-night-market
---
# skill-graph-audit
## 什么时候使用
- 把安全方向的常用动作沉淀成 Agent 可调用的技能 适合处理安全审计、密钥扫描、权限检查和风险分析，核心价值是把输入、判断、执行、验证和交付边界固定下来，避免 Agent 泛泛回答。 把任务拆成可执行、可检查、可继续迭代的步骤；通常不…
- 面向安全审计、密钥扫描、权限检查或风险分析，优先处理能明确输入、步骤和验收标准的工作。
## 需要提供什么
- 目标材料、目录范围、期望结果和不可改动内容。
- 是否允许联网、执行命令、读写文件或调用外部服务。
## 执行规则
- 围绕「Overview / When To Use / When NOT To Use」组织步骤，不把推断写成作者事实。
- 读取文件、写入/修改文件；会按任务需要访问外部网络；通常不需要额外 API Key。
- 先跑小样例，确认结果可检查后再扩大任务范围。
## 输出要求
- 给出最终产物、关键证据、验证方式和下一步动作。
- 信息不足时标记 unknown，不编造命令、平台或依赖。 证据边界与执行链路
作者原文负责流程事实；仓库文件负责来源和命令；流狐只补充适用场景、限制和质量判断。
skill "skill-graph-audit" {
输入层 -> 用户目标 + 目标文件 + 禁止范围 + 验收标准
上下文层 -> Overview / When To Use / When NOT To Use
规则层 -> SKILL.md 触发条件 / 执行顺序 / 输出格式
运行层 -> Node.js | 读取文件、写入/修改文件 | 会按任务需要访问外部网络
安全层 -> 通常不需要额外 API Key + 小任务验证 + diff / 日志复核
输出层 -> 可复制结果 + 检查清单 + 下一步迭代
}Skill Graph Audit
Overview
Build a directed graph of Skill(plugin:name) invocations across the
marketplace and surface composition patterns: which skills are heavily
referenced (hubs), which orchestrate many others (orchestrators), which
have no incoming or outgoing references (isolates), and which point at
non-existent skills (dangling references).
The federation graph is now derivable from source rather than hand-curated.
When To Use
- Before a documentation pass on skill composition
- After a renaming or retirement to catch broken
Skill()references - During quarterly audits to spot orphaned skills
- When evaluating consolidation candidates (hubs are higher-risk to merge)
- When a new skill's outbound references should be sanity-checked
When NOT To Use
- For per-skill quality scoring, use
Skill(abstract:skills-eval)instead - For frontmatter/structure validation, use
Skill(abstract:plugin-review) - For hook-specific audits, use
Skill(abstract:hooks-eval)
Quick Start
python3 plugins/abstract/scripts/skill_graph.py \
--plugins-root plugins --top-n 10For machine-readable output:
python3 plugins/abstract/scripts/skill_graph.py \
--plugins-root plugins --format json --output reports/skill-graph.jsonSee modules/usage.md for full CLI reference and example workflows.
Core Outputs
| Output | Meaning | Action when high |
|---|---|---|
| Hubs | Most-referenced skills | Treat as core API; retire with extreme care |
| Orchestrators | Skills that call many others | Verify each ref still resolves |
| Isolates | Zero in / zero out | Check role: library? entrypoint? typo? |
| Dangling: bugs | Missing internal target | Fix immediately (typo or retired skill) |
| Dangling: external | Reference to external plugin | Document plugin dependency |
| Dangling: placeholders | Template text like -NAME |
Verify intentional |
See modules/interpretation.md for false-positive guidance and
isolation taxonomy.
Dogfood Evidence
This skill itself was scaffolded TDD-first; on first run against
plugins/, it caught two genuine dangling refs that the manual
audit (2026-04-25) had missed:
attune:makefile-generation -> abstract:makefile-dogfooder(script name confused with skill name)imbue:karpathy-principles -> spec-kit:speckit-clarify(command referenced as skill)
Both were converted to correct command-style references in the same session.
Verification
Two ways to validate the audit output is trustworthy:
- Test-suite correctness check: Run
pytest -o addopts= plugins/abstract/tests/scripts/test_skill_graph.pyto confirm extraction, graph construction, ranking, isolate detection, and dangling-ref classification all pass on the current code. The-o addopts=flag bypasses the package-wide coverage gate, which would otherwise fail on a single-file run. - Round-trip smoke check: Note the dangling-ref count from a baseline run, fix one or more flagged references, then rerun and verify the count drops by at least the number fixed. If the count does not move, the report is stale or the regex missed a syntax variant.
Exit Criteria
- The graph builds:
skill_graph.pyruns againstplugins/without error and emits a node/edge count. - Dangling references are classified into bugs, external, and
placeholders (the three
Core Outputsrows resolve). - Every
Dangling: bugsentry is either fixed in the same session or filed as a tracked issue. -
pytest -o addopts= plugins/abstract/tests/scripts/test_skill_graph.pypasses. - The round-trip smoke check shows the dangling-ref count drops by at least the number of references fixed.
Related Skills
Skill(abstract:skills-eval): per-skill quality scoringSkill(abstract:plugin-review): plugin manifest and structureSkill(abstract:hooks-eval): hook-specific validationSkill(abstract:rules-eval): rules directory validation
References
- Implementation:
plugins/abstract/scripts/skill_graph.py - Tests:
plugins/abstract/tests/scripts/test_skill_graph.py - Composition documentation:
docs/quality-gates.md#skill-level-quality-gate-composition - Skill role taxonomy:
docs/skill-integration-guide.md#skill-role-taxonomy
先判断是否适合
作者设计意图
作者的方法与取舍
边界和复核