Token导航 LogoToken导航TokenDH.com
研究检索执行命令github未标认证来源可访问许可证需确认审计通过

cache-audit缓存审计

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

470

周安装

20

GitHub Stars

44

下载量

165
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

2

许可证

unknown

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:cache-audit(缓存审计)
来源仓库:https://github.com/darraghh1/my-claude-setup
仓库路径:skills/cache-audit
安装命令:
npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit

简介

cache-audit 用于审计 Claude Code 的提示缓存配置,评估是否符合最佳实践。

  • 可自动检测系统提示、规则、技能注册等前缀变化对缓存的影响。
  • 返回带分数的报告,并按节省 token 量排序修复建议。
  • 涉及生产环境时,应先脱敏敏感信息并确认最小权限原则。
  • 适用宿主包括 Codex、Claude、Cursor、Gemini CLI,接入前应确认版本、权限和运行环境要求。

SKILL.md

Prompt Cache Audit

Trigger: /cache-audit or "audit my caching" or "check my cache setup"

What it does: Reads your live Claude Code configuration and measures it against prompt caching best practices. Returns a scored report with specific, actionable fixes ranked by token savings.

Background: The API caches the prefix of each request (system prompt, tool definitions, CLAUDE.md, rules, skill registry, MEMORY.md). An identical prefix between turns = ~90% cost reduction on those tokens. ANY change to the prefix invalidates everything after the change point.


When Invoked

Run ALL 8 checks automatically. Do NOT ask for confirmation. Read the relevant files, measure sizes, and produce the full report in one pass.

Use $PROJECT to refer to the current working directory throughout.


The 8 Checks

Check 1 — Prefix Ordering (Static Before Dynamic)

Read: ~/.claude/CLAUDE.md, $PROJECT/CLAUDE.md, ~/.claude/rules/*.md, $PROJECT/.claude/rules/*.md, and the MEMORY.md file for the current project (find it under ~/.claude/projects/*/memory/MEMORY.md — match by project path).

Flag any dynamic content in these files:

  • Timestamps, new Date(), hardcoded dates that go stale
  • Git refs, commit hashes, branch names
  • Session IDs, task IDs, "currently working on X"
  • File counts, line counts, or any computed metrics
  • currentDate entries in MEMORY.md

These files are part of the static prefix. Dynamic data here means cache misses on every turn where it changes.

Scoring:

  • PASS: All prefix files contain only static instructions and conventions
  • WARNING: Low-frequency dynamic data (e.g., a date updated daily)
  • FAIL: High-churn content (timestamps, computed values) in any prefix file

Check 2 — Hook Injection Pattern

Read: ~/.claude/settings.json and $PROJECT/.claude/settings.json to find all hook commands. Then read each referenced hook file.

For each hook, verify:

  • Hooks that inject context MUST use additionalContext in their JSON output (this becomes a <system-reminder> message — part of the message history, NOT the prefix)
  • Hooks that only log/backup should produce no hookSpecificOutput at all

Specifically flag:

  • Any hook that opens and writes to CLAUDE.md, MEMORY.md, or rule files mid-session
  • Any hook that modifies tool definitions or the system prompt directly
  • Any hook that uses hookSpecificOutput keys other than additionalContext

Check each hook and report its pattern:

Hook EventExpected Pattern
SessionStartadditionalContext with compact git context OR no output
UserPromptSubmitLogging only, no additionalContext
PreCompactLogging/backup only, no context injection
All others (Stop, SessionEnd, Notification, etc.)No prefix modification

Scoring:

  • PASS: All hooks use additionalContext or no-inject patterns
  • FAIL: Any hook modifies prefix files (CLAUDE.md, rules, MEMORY.md) mid-session

Check 3 — Tool Stability

Read: ~/.claude.json for global MCP servers, $PROJECT/.mcp.json for project MCP servers (if exists).

Measure and report:

  • Total MCP server count (global + project-level)
  • Each server name and whether it's deduplicated across levels

Flag:

  • Same MCP server name at both global and project level (tool schema loaded twice?)
  • Any skill that explicitly adds or removes tools when invoked
  • 8 total MCP servers (each adds tool schema tokens to the prefix)

Note: MCP tools use deferred loading via ToolSearch by default — this is the correct pattern. Stubs are lightweight; full schemas load on demand.

Scoring:

  • PASS: Fixed tool set at session start, no conditional loading
  • WARNING: > 8 MCP servers (consider if all are needed per-project)
  • FAIL: Dynamic tool add/remove detected mid-conversation

Check 4 — Model Consistency

Read: ~/.claude/settings.json for model or alwaysThinkingEnabled fields.

Check:

  • Is there a stable model configuration? (Default model is fine if consistent)
  • Do any agent definitions (.claude/agents/*.md) specify different model: in frontmatter for inline use?
  • Subagent model delegation (Task tool with model: parameter) is FINE — separate conversations don't break parent cache

Scoring:

  • PASS: Consistent model per conversation, subagents handle model switching
  • FAIL: Evidence of inline model switching in same conversation thread

Check 5 — Dynamic Content Size

Measure actual injection sizes. For each source, read the hook code and estimate output:

SourceHow to MeasurePASSWARNINGFAIL
SessionStart hookRead code — estimate additionalContext output chars< 200200–2K> 2K
UserPromptSubmit hookRead code — does it emit additionalContext?No output< 500> 500
Built-in git statusRun `git status --porcelain \wc -c`< 2K2–10K> 10K
Use ~4 chars per token as the conversion estimate.

Also report:

  • Total hook count across all events (each hook = execution latency per trigger)
  • Any hook with timeout > 10 seconds

Overall scoring:

  • PASS: All per-turn injections total < 2K chars
  • WARNING: 2–10K chars per turn
  • FAIL: > 10K chars injected per turn into the main conversation

Check 6 — Fork Safety (Compaction & Subagents)

Read: PreCompact hook code.

Verify:

  • PreCompact hook does NOT modify the prefix (logging/backup only is correct)
  • No custom compaction logic that rebuilds the system prompt differently
  • Claude Code's built-in compaction preserves system prompt + tools by default

Scoring:

  • PASS: Using built-in compaction + additionalContext-only hook injection
  • FAIL: Any hook modifies prefix during compaction or subagent spawn

Check 7 — Static Prefix Budget

This is the most actionable check. Measure every component of the static prefix.

Read and measure (report in chars AND estimated tokens at ~4 chars/token):

ComponentHow to Find
CLAUDE.md (global)~/.claude/CLAUDE.md
CLAUDE.md (project)$PROJECT/CLAUDE.md
Rules (global)Each file in ~/.claude/rules/*.md
Rules (project)Each file in $PROJECT/.claude/rules/*.md
MEMORY.mdMatch current project under ~/.claude/projects/*/memory/MEMORY.md

Use wc -c via Bash to measure file sizes. Measure EACH file individually.

Calculate:

  1. Grand total chars across all measured files
  2. Estimated tokens (chars / 4)
  3. Percentage of 200K context window consumed by static prefix

Report the top 5 largest individual files.

Scoring:

  • PASS: Total static prefix < 60K chars (~15K tokens, ~7.5% of context)
  • WARNING: 60–120K chars (~15–30K tokens, 7.5–15% of context)
  • FAIL: > 120K chars (~30K tokens, > 15% of context)

Check 8 — Rule Layer Efficiency

Read: List filenames in ~/.claude/rules/ and $PROJECT/.claude/rules/.

Key fact: Rules at both levels are additive — Claude Code loads ALL of them. This means duplicate filenames = duplicate content = wasted tokens.

Check for:

  1. Any filename that exists at BOTH ~/.claude/rules/ and $PROJECT/.claude/rules/ — these load twice
  2. For each duplicate, read both versions and estimate content overlap
  3. Whether the project uses a single project-implementation.md for overrides (correct pattern) vs. many files that duplicate user-level rules

The correct pattern:

  • User-level (~/.claude/rules/): Generic patterns — the WHAT (applies to all projects)
  • Project-level ($PROJECT/.claude/rules/): Single project-implementation.md — the HOW (framework-specific overrides)

Scoring:

  • PASS: No duplicate filenames, project uses project-implementation.md only
  • WARNING: 1–3 duplicate files
  • FAIL: > 3 duplicate files — significant token waste from additive loading

Output Format

After running all 8 checks, output this exact report format:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  PROMPT CACHE AUDIT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Score: X/8

[✅/⚠️/❌]  Check 1 — Prefix Ordering: [PASS/WARNING/FAIL]
   → [finding]

[✅/⚠️/❌]  Check 2 — Hook Injection: [PASS/WARNING/FAIL]
   → [each hook and its pattern]

[✅/⚠️/❌]  Check 3 — Tool Stability: [PASS/WARNING/FAIL]
   → [N global + N project MCP servers, any issues]

[✅/⚠️/❌]  Check 4 — Model Consistency: [PASS/WARNING/FAIL]
   → [model config]

[✅/⚠️/❌]  Check 5 — Dynamic Content: [PASS/WARNING/FAIL]
   → [size breakdown per injection point]

[✅/⚠️/❌]  Check 6 — Fork Safety: [PASS/WARNING/FAIL]
   → [compaction + subagent pattern]

[✅/⚠️/❌]  Check 7 — Prefix Budget: [PASS/WARNING/FAIL]
   → Total: XX,XXX chars (~X,XXX tokens, X.X% of 200K)
   → Top 5 largest:
     1. filename — X,XXX chars (~X,XXX tokens)
     2. filename — X,XXX chars (~X,XXX tokens)
     3. ...

[✅/⚠️/❌]  Check 8 — Rule Efficiency: [PASS/WARNING/FAIL]
   → [duplicate count + wasted tokens]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  TOKEN BUDGET SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Static prefix:          ~XX,XXX tokens (X.X% of 200K window)
Per-turn injection:     ~XXX tokens
Per-builder spawn:      ~X,XXX tokens
Per-lightweight spawn:  ~XX tokens

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  TOP FIXES (ranked by token savings)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Most impactful fix — exact steps]
2. [Second most impactful — exact steps]
3. [Third — if applicable]

If all checks pass: confirm the setup is well-optimised and estimate cost savings vs a naive configuration (no caching awareness).


Prompt Caching Cheatsheet

RuleDoDon't
OrderingStatic CLAUDE.md + rules, dynamic in messagesTimestamps/dates/git refs in prefix files
UpdatesadditionalContext<system-reminder>Edit CLAUDE.md or rules mid-session
ToolsFixed tool set + deferred MCP stubsAdd/remove tools per turn
ModelsOne model per conversation, subagents for switchesInline model switching
SizeTrim injections to minimum neededDump full git status (40K+ chars)
ForksBuilt-in compaction, additionalContext onlyCustom prefix rebuilds
BudgetStatic prefix < 15K tokensBloated CLAUDE.md, massive rule files
LayersUser-level generic + project-level project-implementation.mdSame rule files at both levels

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Codex

39.54%
按下载量换算65

Claude

31.31%
按下载量换算52

Cursor

17.93%
按下载量换算30

Gemini CLI

8.9%
按下载量换算15

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

执行命令

安装流程涉及命令执行,可能通过 npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit 联网下载 Skill 或依赖。用户安装前应确认命令来源、仓库内容和执行环境。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。当前只有一个来源,正式发布前建议补源仓库或其他目录站核验。

来源信息

继续浏览同类 Skills