Community程式設計與開發github.com

tderoussel/codebase-audit

對產品、程式碼庫或子系統執行有排名、有證據支援的稽核,最終產出可驗證清單,區分已確認發現與推測發現。

codebase-audit 是什麼?

此技能專為需要深度分析程式碼庫、產品或子系統的開發者與AI代理設計。它會產出一個包含排名發現、盲點、缺失功能、改進建議和架構變更的稽核報告,並以一個「可驗證清單」作結,清楚標示哪些發現有證據支持(如檔案路徑、查詢結果),哪些僅為推測。此技能的核心價值在於強制要求所有發現必須附有證據,並特別關注「文件與程式碼不一致」這類高價值發現。它支援透過觸發詞如「audit(稽核)」、「gap analysis(缺口分析)」、「what am I missing(我忽略了什麼)」等來啟動,並可與其他驗證技能搭配,以執行實際的資料庫查詢或Pr檢查。此技能僅產出分析與清單,不會自動修復問題。

相容平台~Claude Code~Codex CLI~Cursor
npx skills add https://github.com/tderoussel/agent-skills/tree/main/skills/codebase-audit

Installed? Explore more 程式設計與開發 skills: steipete/bluebubbles, steipete/eightctl, steipete/blucli · View all 6 →

在你喜歡的 AI 中提問

開啟一個已預先載入此 Agent Skill 的新對話。

說明文件

程式碼庫稽核

稽核的價值在於排名與證據,而非篇幅長度。一項沒有檔案路徑、查詢結果、PR 編號或行數的發現,就是一個假說——請將其標示為假說。

將稽核根植於程式碼與生產環境,而非文件

專案筆記、計畫與狀態文件是檢查點,而非權威來源。從它們開始學習宣稱的內容,然後對照現實進行驗證:即時提交狀態、資料庫狀態、PR 檢查結果、分支 head。

當文件與程式碼不一致時,這個不一致本身就是一項發現——通常是稽核中最有價值的一項。

對生產環境的主張需要透過對生產環境的查詢來驗證。請將此技能與驗證閘門技能搭配使用來執行實際操作。

結構

# <範圍> 稽核 (YYYY-MM-DD)

## 摘要
<最重要的三件事,以及你會優先採取的行動。>

## 第一部分 — 你沒看到的東西(盲點,依序排名)
## 第二部分 — 缺失的功能(依序排名,每個附上粗略的工時估算)
## 第三部分 — 需要改進的現有功能(依序排名)
## 第四部分 — 架構變更(依序排名,使用白話文)
## 第五部分 — 如果我來主導接下來30天
## 可驗證清單(稽核期間發現的不一致事項)

所有項目都必須排名。 一份未經排名的40項發現清單,就是一份無法採取行動的40項清單。

在估算前檢查是否存在閒置的框架

為每個缺口附上粗略的工時估算,並說明其成本高低的原因。

單一最有價值的稽核發現通常如下:大部分高價值的「缺口」只需要數天的工作量,而非數週,因為倉庫中已存在框架,但沒有任何呼叫者。 一個已完成了80%的功能,其決策性質與一個完全未開發的功能截然不同。

在宣告某個東西缺失之前,先搜尋看看。函式沒有呼叫者是典型情況——程式碼存在,但沒有任何東西叫用它,而所有狀態文件都描述該功能為不存在。

可驗證清單

每次稽核都以無法解決的不一致事項作結。每個項目需說明:

  • 宣稱的內容
  • 觀察到的內容
  • 哪個查詢或檢查可以釐清此事

這是下一個工作階段實際會使用的章節。 即使內容很短,也請務必撰寫。

明確標示為不值得做的事項

列出你檢查過並刻意拒絕的項目,並附上理由。

只會增加待辦事項的稽核,會讓待辦事項清單變得無用。你審視過並排除的發現,其價值遠高於從未提及的發現,因為它能防止下一次稽核再次提出相同的問題。

已擱置項目不是缺口

任何已標示為刻意延遲、或待明確人為決策的項目,都是刻意被擱置。請勿將其列為缺口。

將刻意擱置的項目重新作為發現提出,可能會導致擱置的決策被意外執行。

輸出

將稽核報告寫在專案存放這些報告的地方。如果它取代了先前的稽核,請說明哪一份報告被取代,以及什麼改變了——稽核資料夾應保持可依時間順序閱讀的連貫性,而不是一堆雜亂的文件。

Individual skills in this repo

This repo contains 8 individual skills — each has its own dedicated page.

tderoussel/competitive-teardown

Researches a competing product against your own and produces a ranked build-or-ignore verdict, plus optional comparison-page copy. Use when the user names a competitor or asks how their product stacks up against one. Trigger phrases include "vs us", "competitor", "what does X have", "should we copy", "competitive gap", "teardown", "are we behind". Produces a ranked verdict with effort estimates and an explicit not-worth-copying list.

tderoussel/decision-council

Run a structured multi-perspective review of a decision instead of getting one agreeable answer. Use when the user says run a council, get me perspectives on this, should I do X, stress-test this decision, or is this a good idea.

tderoussel/fleet-brief

Authors a workstream brief for dispatching multiple parallel build agents across one codebase, with per-lane file ownership, shared-ground warnings, and a derived DO-NOT list. Use whenever work is about to be split across concurrent agents, workers, lanes, or waves — even if the user does not say "write a brief". Trigger phrases include "fan out", "parallel agents", "orchestrate this", "split into lanes", "workstreams", "run these in parallel", "review-gated build". Produces the brief; does not dispatch.

tderoussel/inbox-triage

Triage an email inbox — sort what needs a reply, draft the replies, flag what needs a decision, and surface what can be ignored or unsubscribed. Use when the user says triage my inbox, do my email, what's in my inbox, or clean up my email.

tderoussel/overnight-build

Composes an autonomous unattended Claude Code build prompt that survives usage-limit resets via BUILD_LOG.md checkpointing, plus the launcher that restarts it. Use when the user asks for an overnight build, an autonomous build, a build to run while they sleep, an unattended or unsupervised session, or any long build they will not be monitoring. Trigger phrases include "overnight build", "run overnight", "build while I sleep", "autonomous build", "let it run", "unattended". Produces a single copyable prompt; does not run the build.

tderoussel/session-log

Write a durable record of a work session — what was built, root-caused, or shipped — into the project's notes. Use when the user says log this session, write a session log, record this, or when a substantial piece of work has just finished and needs to be handed off to a future session.

tderoussel/ship-gate

Verification gate for a Next.js-on-Vercel + Supabase + GitHub Actions stack, to run before claiming anything is shipped, deployed, live, merged, passing, or done. Use before saying a change is in production, before merging a PR, before reporting CI green, and before writing any status into a document — even if the user does not ask for verification. Trigger phrases include "is it live", "did it deploy", "ship it", "merge it", "is CI green", "confirm prod", "did that work". Encodes traps where the obvious check returns a false pass.

tderoussel/vault-doctor

Audits and repairs an Obsidian vault's structural health — broken [[wikilinks]], ambiguous duplicate filenames, missing or malformed frontmatter, stale status markers, and hub notes whose state sections have gone cold. Use when the user asks about vault health, broken links, vault cleanup, dead links, orphan notes, tag consistency, or says the vault feels messy or out of date. Trigger phrases include "vault health", "broken links", "clean up the vault", "audit the vault", "is the vault current". Read-only by default; every repair is proposed before it is made.

相關技能