Token导航 LogoToken导航TokenDH.com
研究检索需要联网github未标认证来源可访问许可证需确认审计通过

audit-plan审计计划

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

569

周安装

23

GitHub Stars

44

下载量

178
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

2

许可证

unknown

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:audit-plan(审计计划)
来源仓库:https://github.com/darraghh1/my-claude-setup
仓库路径:skills/audit-plan
安装命令:
npx skills add https://github.com/darraghh1/my-claude-setup --skill audit-plan
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/darraghh1/my-claude-setup --skill audit-plan

简介

对多阶段实施方案进行结构性流程审计,评估各阶段是否连贯构成合理 pipeline。

  • 聚焦设计意图与计划结构的一致性,而非模板合规性,适合在 per-phase review 之前使用。
  • 解析用户提供的路径参数(如 plans/detector-refactor),无需重复询问目标文件夹位置。
  • 安装方式:通过 npx skills add 命令从指定 GitHub 仓库添加,支持 Codex、Claude、Cursor 等宿主环境。
  • 输出包含连接性评估和潜在断裂点分析,帮助优化实施顺序和依赖关系管理。

SKILL.md

Plan Flow Audit

YOUR ARGUMENTS: $ARGUMENTS

Arguments are provided above via $ARGUMENTS. Parse them to determine the plan folder path (e.g., plans/detector-refactor). Do NOT ask the user to re-provide the path.

This skill performs a structural flow audit of a multi-phase implementation plan. It assesses whether phases connect coherently as a pipeline — NOT whether individual phases comply with templates (that's /review-plan's job).

Positioning: This audit runs BEFORE per-phase reviews. Phases have NOT been reviewed or polished yet. Focus on intended design vs. planned structure, not on template completeness or placeholder content.

Critical

  • Do NOT modify plan files, phase files, or codebase files — this skill only writes the audit report
  • Read ALL phase files, not just a sample — the value of this audit is completeness
  • Ground findings in actual codebase files, not just plan documents
  • When you claim a phase targets a file that doesn't exist, verify with Glob first
  • Distinguish between intentional design choices and actual discrepancies
  • Tolerate rough edges — phases may have incomplete sections, placeholder content, or imperfect formatting. That's /review-plan's job to fix. You're checking whether the PLAN DESIGN is sound.

Task Tracking

Tasks survive context compacts — skipping this check causes lost progress and repeated work.

Before starting work, run TaskList to check if tasks already exist from a previous session or before a compact. If tasks exist:

  1. Read existing tasks with TaskGet for each task ID
  2. Find the first task with status pending or in_progress
  3. Resume from that task — do NOT recreate the task list

If no tasks exist, create them after reading the master plan (Step 1):

Example task list:

Task 1: Read the master plan
Task 2: Read all phase files and extract metadata
Task 3: Build dependency graph + bail-out check
Task 4: Assess data flow consistency
Task 5: Evaluate phase ordering
Task 6: Identify stale artifacts
Task 7: Assess risk for pending phases
Task 8: Write audit report
Task 9: Return summary

Mark each task in_progress when starting and completed when done.

Why This Audit Exists

/review-plan checks individual files for template compliance and codebase patterns. This audit checks the connections between them — structural design issues that only appear at the whole-plan level.

This runs FIRST (before /review-plan) because structural issues invalidate all per-phase review work. No point polishing Phase 5's code blocks if Phase 5 depends on a table that Phase 3 doesn't actually create.

ProblemHow It ManifestsCost If Missed
Circular dependenciesPhase A waits for B, B waits for A — deadlockImplementation stalls, requires plan restructuring
Missing dependenciesPhase 5 uses a table from Phase 3 but doesn't declare itPhase 5 fails at runtime, debugging time wasted
Wrong orderingConsumer phase runs before its data producerCode compiles but crashes, phase must be re-sequenced
Stale artifactsplan.md says "Done" but phase file says "Pending"/implement picks the wrong next phase
Incoherent data flowPhases disagree on table names, patterns, or sourcesEvery downstream phase builds on wrong assumptions

The audit report feeds into /implement — it checks the flow audit verdict before building. A structural audit catches design problems that per-phase reviews cannot see.

Output Location

The flow audit report goes in the reviews/planning/ subfolder alongside per-phase reviews:

Write to: {plan-folder}/reviews/planning/flow-audit.md

Examples:

  • plans/250202-voice-assistant/reviews/planning/flow-audit.md
  • plans/250202-api-refactor/reviews/planning/flow-audit.md

Create the reviews/planning/ directory if it doesn't exist.

Note: Per-phase template/codebase reviews go in the same folder — see /review-plan. Code/implementation reviews go in reviews/code/ — see /code-review.

Step 1: Read the Master Plan

Read {plan-folder}/plan.md completely. Extract:

  1. Phase table — all phases with titles, status, and any noted issues
  2. ADRs / Decision Log — decisions that constrain phase design
  3. Critical Issues section — known problems already documented
  4. Architectural North Star — patterns all phases must follow

Note any phases marked as deprecated, renumbered, or amended.

Step 2: Read All Phase Files

Use Glob to find all phase files: {plan-folder}/phase-*.md

For EACH phase file, extract from the frontmatter and overview:

FieldWhere to Find
Phase numberFilename phase-NN-*
TitleFrontmatter title:
StatusFrontmatter status:
DependenciesFrontmatter dependencies:
What it producesOverview section
What it consumes"How This Phase Fits" or "Prerequisites" sections
Key files it targetsImplementation steps (file paths mentioned)

Build a mental model of the full dependency graph as you read.

Placeholder Check (Informational Only)

Run the placeholder validator to note which phases still have skeleton content:

echo '{"cwd":"."}' | uv run $CLAUDE_PROJECT_DIR/.claude/hooks/validators/validate_no_placeholders.py \
  --directory {plan-folder} --extension .md

This is NOT a blocker. Since this audit runs before /review-plan, phases may still contain [To be detailed], TBD, or skeleton markers. Note these in the report for awareness, but do NOT fail the audit because of them. Reviewers will clean them up. Only flag placeholders in critical structural sections (dependencies, data flow descriptions) as a concern.

Step 3: Build Dependency Graph + Bail-Out Check

From the data collected in Step 2, construct the full dependency graph.

For each phase, document:

  • Declared dependencies (from frontmatter dependencies: field)
  • Implicit dependencies (phase references data/files/services created by another phase but doesn't declare it)
  • What downstream phases depend on it

Check for:

Issue TypeHow to Detect
Circular dependenciesPhase A depends on B, B depends on A (directly or transitively)
Missing dependenciesPhase X uses output from Phase Y but doesn't list Y in dependencies
Unnecessary dependenciesPhase X lists Phase Y but doesn't actually use any of Y's output
Orphaned phasesPhase exists but no other phase depends on it AND it doesn't depend on anything
Dependency on deprecated phaseA phase depends on a phase marked status: deprecated

Bail-Out Assessment

After building the dependency graph, evaluate whether the plan is fundamentally broken. If ANY of these conditions are true, STOP the audit immediately — write a short report with assessment "Unusable" and return:

Bail-Out ConditionWhy It's Fatal
Circular dependencies existCannot be resolved by review — requires plan restructuring
>50% of phases have missing/wrong dependenciesDependency graph is unreliable — plan needs redesign
No coherent execution order existsPhases cannot be sequenced — plan is incoherent
Plan has no discernible architecturePhases are disconnected fragments, not a pipeline

If the plan is bail-out level broken: Skip Steps 4-7. Write a minimal report (Step 8) with:

  • Overall Assessment: Unusable — Needs Restructuring
  • The specific bail-out condition(s) detected
  • A brief recommendation for what needs to change
  • Return immediately (Step 9)

This saves the user from waiting through a full audit of a plan that needs to be thrown out and rewritten.

Step 4: Assess Data Flow Consistency

Trace how data flows through the plan pipeline. For plans involving data transformations (API -> storage -> consumption), check:

  1. Source consistency — Do all phases agree on where data comes from?
  2. Schema consistency — Do phases that share data structures use the same types/interfaces?
  3. Pattern consistency — Is there one architectural pattern or do different phases use contradictory approaches?

- Example: Some phases have components query the database directly while others expect data passed via context/props

  1. Table/entity naming — Do all phases reference the same table names consistently?
  2. File path consistency — Do phases reference files that actually exist at those paths?

Verify against codebase: For key files referenced by "Done" phases, use Glob to check they exist. For critical claims (e.g., "Phase 11 updated the orchestrator to load summary data"), read the actual file to confirm.

Step 5: Evaluate Phase Ordering

Assess whether the current phase sequence makes logical sense:

  1. Infrastructure before consumers — Are foundational phases (schemas, services, APIs) ordered before phases that use them?
  2. Producers before consumers — Does the phase that creates data run before phases that read it?
  3. Refactoring order — For refactoring plans, is the new system built before the old system is deprecated/removed?
  4. Test timing — Are testing phases positioned to test code that already exists?
  5. Cleanup last — Are deprecation, migration, and drop phases at the end?

Flag ordering issues like:

  • A consumer phase runs before its data producer
  • A centralized service is created AFTER the things that should use it
  • Tests are written before the code they test exists
  • Cleanup runs before all references are migrated

Step 6: Identify Stale Artifacts

Check for:

ArtifactHow to Find
Deprecated phase filesstatus: deprecated in frontmatter but file still exists
Duplicate phase numbersMultiple files with same phase-NN- prefix
Broken inter-phase links[[phase-XX]] or [Phase XX](./phase-XX-*) links that point to non-existent files
Renumbered but not updatedPhase file title says "Phase 17" but filename says phase-18-*
Phase table mismatchesplan.md phase table lists a phase title/file that doesn't match the actual file
Stale statusplan.md says "Done" but phase file says "Pending" (or vice versa)

Step 7: Assess Risk for Pending Phases

For each pending phase, evaluate risk based on:

Risk FactorHigh RiskLow Risk
DependenciesDepends on phases with known issuesDependencies are clean and verified
File targetsReferences files that don't exist or are uncertainTargets well-known, stable files
ScopeTouches many files across many directoriesFocused on 1-2 files
Pattern clarityIntroduces new patterns not seen in codebaseFollows established patterns from earlier phases or codebase
BlockingMany downstream phases depend on itFew or no downstream dependencies

Step 8: Write Audit Report

Write the report to: {plan-folder}/reviews/planning/flow-audit.md

Create the reviews/planning/ directory if it doesn't exist.

If the report already exists (re-auditing after fixes), Read the existing file first — the Write tool silently fails on existing files without a prior Read. A re-audit should fully overwrite the previous report since the value is a fresh holistic view, not incremental updates.

Report Structure

# Flow Audit: {Plan Title}

**Audited:** {date}
**Phases reviewed:** {count} ({done count} Done, {pending count} Pending, {deprecated count} Deprecated)
**Overall Assessment:** {Coherent | Minor Issues | Significant Issues | Major Restructuring Needed | Unusable}

---

## 1. Dependency Graph

{Visual or textual representation. Use indentation to show dependency chains.}

### Dependency Issues

| #   | Issue | Phases Affected | Severity | Suggested Fix |
| --- | ----- | --------------- | -------- | ------------- |
| 1   | ...   | P05, P12        | High     | ...           |

---

## 2. Data Flow Analysis

### Architecture Pattern(s)

{Describe the data flow pattern(s) used across the plan}

### Inconsistencies

| #   | Issue | Phases Affected | Details |
| --- | ----- | --------------- | ------- |
| 1   | ...   | ...             | ...     |

---

## 3. Phase Ordering Assessment

### Current Order

{List phases in order with one-line description}

### Ordering Issues

| #   | Issue | Current Order | Suggested Order | Rationale                                       |
| --- | ----- | ------------- | --------------- | ----------------------------------------------- |
| 1   | ...   | P12 after P11 | P12 before P11  | Loader should exist before orchestrator uses it |

---

## 4. Stale Artifacts

| #   | Artifact | Type            | Location                      | Action Needed     |
| --- | -------- | --------------- | ----------------------------- | ----------------- |
| 1   | ...      | Deprecated file | phase-17-unit-tests-update.md | Delete or archive |

---

## 5. Risk Assessment (Pending Phases)

| Phase | Risk   | Key Risk Factors                                   | Recommendation                    |
| ----- | ------ | -------------------------------------------------- | --------------------------------- |
| P12   | High   | Depends on P11 which may have ordering issues      | Review dependency direction       |
| P14   | Medium | Modifies Edge Function with complex existing logic | Read function before implementing |

---

## 6. Recommendations (Priority Order)

1. **[Critical]** {Description} — Fix before continuing implementation
2. **[High]** {Description} — Fix before implementing affected phases
3. **[Medium]** {Description} — Fix for plan hygiene
4. **[Low]** {Description} — Nice to have

Step 9: Return Summary

After writing the report, return to the main agent:

  1. Report location — file path
  2. Overall assessment — one-line verdict
  3. Critical/High issues count — how many need attention before implementation continues
  4. Top 3 findings — the most impactful discoveries
  5. Recommendation — whether to proceed, fix first, or restructure
  6. Context hygiene: "Consider running /compact before starting the next workflow step."

Resuming After Context Compact

If you notice context was compacted or you're unsure of current progress:

  1. Run TaskList to see all tasks and their status
  2. Find the in_progress task — that's where you were
  3. Run TaskGet {id} on that task to read full details
  4. Continue from that task — don't restart from the beginning

Tasks persist across compacts. The task list is your source of truth for progress, not your memory.

Pattern for every work session:

TaskList → find in_progress or first pending → TaskGet → continue work → TaskUpdate (completed) → next task

Constraints

  • Source files are read-only — do NOT modify plan files, phase files, or codebase files. The only file you write is the audit report at {plan-folder}/reviews/planning/flow-audit.md
  • All phases — read every phase file, not just a sample
  • Codebase grounding — verify that key files referenced in phases actually exist at those paths. Use Glob to spot-check
  • No template checking — that's /review-plan's job. Focus on structural design, not format or polish
  • Tolerate rough edges — phases have NOT been reviewed yet. Placeholder content, incomplete sections, and formatting issues are expected. Only flag these if they obscure structural intent (e.g., dependencies section is entirely TBD)
  • Severity calibration — only mark issues as Critical if they would cause implementation failure (circular deps, fundamentally wrong ordering). Use High for likely problems, Medium for structural concerns, Low for suggestions
  • Bail-out early — if the plan is fundamentally broken (Step 3), stop and say so. Don't spend tokens auditing an unusable plan
  • Pipeline awareness — this audit runs BEFORE /review-plan. Your verdict determines whether per-phase reviews proceed or the plan gets sent back to the planner

Troubleshooting

Too Many Phase Files

Symptom: Plan has 30+ phases and reading all of them is slow.

Fix: Read frontmatter + overview section only (first 60 lines) for initial pass. Deep-read only phases flagged as problematic during the dependency/flow analysis.

Plan Has No Dependency Metadata

Symptom: Phase files don't have dependencies: in frontmatter.

Fix: Infer dependencies from content — look for "requires Phase X", "uses table from Phase Y", "after Phase Z is complete" in the overview and prerequisites sections. Flag the missing metadata as a stale artifact.

Phases Have Lots of Placeholders

Symptom: Many phases have [To be detailed] or TBD in their content.

Fix: This is expected — the audit runs before reviews clean these up. Only flag placeholders if they appear in structural sections (dependencies, data flow, key file paths) where you can't assess the design without them. Note the count in the report for the reviewers' benefit.

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Claude

33.04%
按下载量换算59

Codex

31.82%
按下载量换算57

Cursor

17.58%
按下载量换算31

Gemini CLI

9.05%
按下载量换算16

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

需要联网

该 Skill 可能需要联网访问来源站点、仓库或外部 API;具体网络访问范围需要结合源码和 README 复核。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。当前只有一个来源,正式发布前建议补源仓库或其他目录站核验。

来源信息

继续浏览同类 Skills