audit

Agent Skills › ccch1mneyyy/dsh-Go › audit

audit

GitHub

对仓库或子系统执行安全、正确性和可维护性审计。识别入口点与信任边界，检查依赖漏洞，验证缺陷影响，并按严重程度报告发现项及修复建议。

.agents/skills/audit/SKILL.md ccch1mneyyy/dsh-Go

触发场景

用户发起审计请求使用 /audit 命令

安装

npx skills add ccch1mneyyy/dsh-Go --skill audit -g -y

更多选项

非标准路径

npx skills add https://github.com/ccch1mneyyy/dsh-Go/tree/main/.agents/skills/audit -g -y

不安装直接使用

npx skills use ccch1mneyyy/dsh-Go@audit

指定 Agent (Claude Code)

npx skills add ccch1mneyyy/dsh-Go --skill audit -a claude-code -g -y

安装 repo 全部 skill

npx skills add ccch1mneyyy/dsh-Go --all -g -y

预览 repo 内 skill

npx skills add ccch1mneyyy/dsh-Go --list

SKILL.md

Frontmatter

{
    "name": "audit",
    "description": "Audit the ccch1mneyyy\/dsh-Go repository or a broad subsystem for security, correctness, and maintainability risks. Use for audit requests or \/audit; use review for a specific change and vuln-check for a security-only assessment."
}

Establish the audit scope, then trace the relevant runtime paths. For a findings-only request, leave code unchanged; carry out fixes when the user has requested them.

Identify entry points, state owners, external inputs, and teardown paths within the requested scope.
Follow inputs through validation and consumers. In this app, inspect applicable host connections (local engine, SSH, relay), session APIs, bridge routes, plugin capabilities, file access, permission flows, and long-session resource bounds. Prioritize paths whose failure can lose state, cross a trust boundary, or leave the terminal unusable. Check dependencies and lockfiles for known vulnerabilities against advisory data.
Confirm suspected defects against callers, existing guards, and focused regressions. Check exports, registries, and supported compatibility paths before declaring code dead. Explain a simplification in terms of current requirements and the behavior it preserves.
Report confirmed findings by severity with location, trigger, impact, and a concrete remedy. Keep unverified leads separate. For a cross-layer failure, a short input → boundary → effect trace may be enough to explain it.
State the areas examined, checks actually run, and material gaps. No findings means none found in that scope, not proof that the whole project is safe. An audit can finish without findings or a forced list of healthy areas.