360 Secure SkillHub
360 安全技能中心

no-comments

在调用者提供的文件或 diff 中启动 Comment Sicko 子代理,审查注释与抑制标记,删除不合理注释、修复范围内根因问题,并在交互批准后把约束注释编码为类型、运行时、测试或 CI 校验。

backnotprop
热度 60.55
最近更新 2026-10-19 07:29:26
分类:开发依赖:内部调用大模型 / 读写文件应用场景:代码审查 / 调试排错

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add backnotprop/pstack/no-comments
Metadata
name
no-comments
description
Spawn Comment Sicko, fix accepted findings, and offer encodings for claimed constraints.
disable-model-invocation
true

No comments

Spawn Comment Sicko. Act on accepted findings.

Defer to Comment Sicko's fresh perspective.

Scope

Use the caller's files or diff. Otherwise use the current diff against the base branch, default main, including the working tree.

Steps

  1. Spawn Task with subagent_type: "comment-sicko". Pass the scope. Pick each subagent's reasoning level and fast or standard speed for the job, per the Subagents section of the poteto-mode skill. Do not restate its rules. If your harness doesn't have comment-sicko registered as a subagent (any harness other than Cursor with the pstack plugin), spawn a general subagent instead: Agent in Claude Code (subagent_type: general-purpose), task in OpenCode (subagent_type: general), spawn_agent in Codex. Its prompt is references/comment-sicko.md verbatim, then the scope. If your harness has no subagent tool, as in Pi without an extension, run that prompt yourself in a fresh pass over the scope.
  2. Inspect its report and diff. Reject application-code edits, scope escapes, exception-protected deletions, misstated MUST KILL reasons, and flags that treat kept intentional code as guilty. Reshape flags on our-code surprises stay actionable. Do not restore those comments. A keep survives only with proof it is about something we cannot change. Audit missed scoped lint and TypeScript suppressions. Correctness or safety suppressions stay actionable MUST KILLs. Restore deletions only with exact exceptions and scoped proof. Before accepting thin IMPORTANT or do not remove kills or keeps, run /how or /why on their symbol. If a kill is ambiguous, do not restore. If a keep is refuted or still ambiguous, delete it. Revert and rerun one rejected report with the failure named. Reject a second, report it open, and fail /no-comments.
  3. Fix trivial accepted flags directly by deleting a dead path, dropping a parameter, or using the real API. If any fix needs a shape, run /architect once for the accepted set and surrounding code. Stop at the sketch. Architect shapes. Step 4 implements.
  4. Implement the smallest root-cause fix in scope. Remove every named workaround. If the root cause is out of scope, land the smallest in-scope fix and report the rest open. The principle-fix-root-causes and principle-redesign-from-first-principles skills guide intent only. Neither authorizes widening the fence nor fixing instances outside it. Never bolt on symptom guards.
  5. Constraint comments say do not remove, do not change wording, or talk to X before changing. Leave keeps about things we cannot change. Offer the cheapest in-scope type, runtime, test, or CI lint. Wait for interactive approval. Unattended and eval require caller pre-approval. If approved, encode then delete. Otherwise delete, report the constraint open, and sketch out-of-scope work.
  6. Report the deletion count, restored comments, reruns, architect sketch, fixes, encoding offers, encodings, unenforced constraints, and other open work.