360 Secure SkillHub
360 安全技能中心

Concept Audit

核心功能是从适配性、独立性、组合性、漂移、产品子集五个维度,审计概念与应用设计是否匹配目标,及代码是否符合设计。典型场景包括概念设计评审、应用架构验证、代码合规检查。输入为设计文档、代码等材料,输出结构化审计报告,标注问题、证据、影响及修复路径,全程只读不修改内容。

agenticweb4
agenticweb4
热度 25.41
最近更新 2026-09-15 10:04:21
分类:开发依赖:读写文件应用场景:代码审查 / 报告撰写

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add concept-audit
Metadata
name
concept-audit
description
Audits concept and application design arguments and optional code conformance only when the user explicitly invokes $concept-audit. Read-only; use for purpose fitness, independence, composition, drift, and product-subset review.
metadata
{"language":"en","translation_of":"concept-audit-cn","openclaw":{"homepage":"https://github.com/ontology-of-everything/concept-skills/tree/main/skills/en/concept-audit"}}

Concept Audit

Focus: can the concept and application designs fulfill their respective purposes, and does the implementation conform? Run only on explicit $concept-audit invocation and remain read-only. Design can be reviewed without code; without specifications, review only observable code properties. Mark conclusions unsupported by missing material as unverified.

Model

A concept is a behavioral unit designed for one purpose. A concept argument connects its purpose to its operational principle (OP), state, and actions. An application argument connects the application purpose to concept selection, synchronizations, and end-to-end scenarios. Conformance to an unsuitable model does not establish fitness; successful OP tests do not prove the purpose, and locally sound concepts do not prove the application purpose.

Review five dimensions:

  • Fitness: behavior meets the real need under stated assumptions.
  • Independence: concept definitions do not depend on other concepts; this repository also requires concept modules not to reference one another.
  • Composition: synchronizations coordinate public actions without expanding or corrupting allowed concept behavior.
  • Drift: implementation differs from a confirmed behavioral contract; distinguish omissions from contradictions.
  • Product subsets: each subset preserves its purpose, entry points, required synchronizations, and resources.

Evidence means a fact supported by inspected requirements, models, code, or tests. Missing evidence is not evidence of absence.

Audit

  1. Scope — Read references/spec-format.md, requirements, concept and synchronization specifications, the overall PRD, and staged links. With code, trace real entry points, calls, state/schema, migrations, and tests. Record versions, terms, facts, inferences, coverage, and gaps.
  2. Design arguments — State concept and application purposes. For every concept, test the contract → OP → purpose argument and specificity, completeness, independence, and familiarity. Review application selection and synchronizations against end-to-end scenarios. Novelty or infrastructure identity alone is not a defect.
  3. Drift and independence — When code exists, use references/drift-checklist.md to compare signatures, outputs, invariants, state, and dependencies, including public calls, shared mutable state, private access, and DTO/protocol leakage. Same-named local type parameters are not semantic dependencies.
  4. Composition — Use references/composition-checklist.md to trace each action and synchronization from the application purpose. Check completion events, bindings, isolation, failure, replay, loops, under-synchronization, and over-synchronization.
  5. Dependencies and subsets — Check product inclusion dependencies separately from code restrictions. A product graph need not mirror a code graph.
  6. Aggregate — Cross-check includes, actions and queries, parameters, outputs, bindings, and diagrams. Merge findings by root cause and report all five dimensions; an unexecuted check cannot pass.

Report

# Audit Report <date>

Scope: <requirements/spec/code versions; verified and unverified material> Summary: <coverage,
finding count, severity>

| Proposition or finding | Scenario and evidence | Failed relation or assumption | Impact/severity | Fix route |
| ---------------------- | --------------------- | ----------------------------- | --------------- | --------- |

Coverage: <five dimensions and every concept, entry point, or rule group> Fix order: <merged root
causes, affected locations, current fix, dependencies>

Medium or higher severity needs current specification or code evidence; pure design review is a specification-level projection. Separate missing OP tests from purpose failure. Without implementation, do not report implementation violations. Attach a scenario to every under- or over-synchronization claim.

Route model defects to concept-design, transcription/index errors to concept-prd, and code violations to concept-implementation. Read references/sources.md when source definitions or criteria must be verified. Do not write specifications, code, or history.