360 Secure SkillHub
360 安全技能中心

Repo Discovery Auditor

该 Skill 指导对陌生代码库做静态审计:从包管理文件、入口与路由、配置、数据与认证层入手,梳理框架、路由模型、状态管理、数据层与 UI 体系;逐功能映射用户流程,标注成熟度与风险信号,并按证据规则区分已验证事实与静态推断,最后给出下一步建议及面向实现工作的交接要点。

nalendrax8
nalendrax8
热度 44.17
最近更新 2026-05-11 17:46:25
分类:开发依赖:读写文件 / 内部调用大模型应用场景:代码审查 / 报告撰写 / 研究

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add repo-discovery-auditor
Metadata
name
repo-discovery-auditor
description
Audit an unfamiliar codebase and map architecture, user-facing features, maturity, and risks. Use when the user asks to inspect a repo, summarize the stack, explain structure, list implemented features, judge what looks mature vs rough, or prepare a coding brief from an existing project.
user-invocable
true

Repo Discovery Auditor

Inspect a repo before planning or coding.

Core workflow

  1. Start with high-signal files:
    • package manager files
    • app entrypoints and route layouts
    • config files
    • backend or data client setup
    • representative feature pages or modules
  2. Identify:
    • framework and runtime
    • routing model
    • state management
    • data layer and auth
    • UI system
  3. Map user-facing flows page by page or feature by feature.
  4. Look for maturity signals:
    • validation
    • loading and error states
    • empty states
    • access control
    • reusable abstractions
    • side-effect handling
  5. Look for risk signals:
    • stale schema references
    • duplicated business logic
    • weak typing
    • inconsistent auth or role checks
    • debug code and ad-hoc branching

Evidence rule

Tie claims to actual files or patterns you inspected. Do not claim runtime behavior you did not verify. If something is inferred from static code only, say so.

Suggested output

Return results in this order when useful:

  1. Architecture summary
  2. Key stack and structure
  3. User-facing feature map
  4. What looks mature
  5. What looks rough or incomplete
  6. Important risks or inconsistencies
  7. Best next move

Maturity labels

Use simple bands:

  • mature
  • working but rough
  • unclear or likely incomplete

Explain each label with concrete evidence.

Handoff use

If the repo audit will feed implementation work, end with a short section for Codex:

  • likely files to touch
  • architecture constraints
  • risky areas to avoid breaking
  • missing information that should be confirmed first