Token导航 LogoToken导航TokenDH.com
研究检索只读github未标认证来源可访问clear审计提醒

ln-610-code-comments-auditorln 610 代码注释审核员

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

1,038

周安装

42

GitHub Stars

441

下载量

326
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

3

许可证

MIT

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:ln-610-code-comments-auditor(ln 610 代码注释审核员)
来源仓库:https://github.com/levnikolaevich/claude-code-skills
仓库路径:skills/ln-610-code-comments-auditor
安装命令:
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-610-code-comments-auditor
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。不同来源提供的安装方式可能略有差异;本站展示可直接复制的安装命令,安装前请核对来源页面。

skills.shnpx skills
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-610-code-comments-auditor

简介

用于安全审计、权限检查和常见漏洞排查,适合梳理敏感配置和鉴权逻辑。

  • 适用于需要分析凭据风险或生成安全复核清单的场景。
  • 使用时不能把工具输出直接当最终结论,需先确认最小权限和操作边界。
  • 涉及密钥、令牌或用户数据时应脱敏处理,避免影响生产系统。
  • 安装前建议确认权限范围和维护状态,确保不会触发不必要的网络或文件操作。

SKILL.md

Paths: File paths (shared/, references/, ../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root.

Code Comments Auditor

Audit code comments and docstrings quality. Universal for any tech stack.

Purpose

  • Verify comments explain WHY, not obvious WHAT
  • Check comment density (15-20% ratio)
  • Detect forbidden content (dates, author names, historical notes)
  • Validate docstrings match function signatures
  • Ensure comments match current code state
  • Identify legacy comments and commented-out code

Invocation

  • Direct: User invokes for code comment quality review
  • Pipeline: Called by ln-100-documents-pipeline (Phase 5, if auditComments=true)

Workflow

  1. Scan: Find all source files (auto-detect tech stack)
  2. Extract: Parse inline comments + docstrings/JSDoc
  3. Audit: Run 6 category checks (see Audit Categories below)
  4. Score: Calculate X/10 per category
  5. Context Validation: Post-filter findings (see below)
  6. Report: Output findings and recommended actions

Audit Categories

#CategoryWhat to Check
1WHY not WHATComments explain rationale, not obvious code behavior; no restating code
2Density (15-20%)Comment-to-code ratio within range; not over/under-commented
3No Forbidden ContentNo dates/authors; no historical notes; no code examples in comments
4Docstrings QualityMatch function signatures; parameters documented; return types accurate
5ActualityComments match code behavior; no stale references; examples runnable
6Legacy CleanupNo TODO without context; no commented-out code; no deprecated notes

Context Validation (Post-Filter)

MANDATORY READ: Load shared/references/context_validation.md

Apply Rule 1 + comment-specific inline filters:

FOR EACH finding WHERE severity IN (HIGH, MEDIUM):
  # Rule 1: ADR/Planned Override
  IF finding matches ADR → advisory "[Planned: ADR-XXX]"

  # Comment-specific: Per-category density targets
  IF Cat 2 (Density) finding:
    Classify file by path:
    - test/ or tests/           → target density 2-10%
    - infra/ or config/ or ci/  → target density 5-15%
    - business/domain/services  → target density 15-25%
    Recalculate with per-category target instead of fixed 15-20%.
    If >50% comments are docstrings → calculate inline density separately.

  # Comment-specific: Complexity context for WHY-not-WHAT
  IF Cat 1 (WHY not WHAT) finding:
    - If file McCabe complexity > 15 → WHAT comments acceptable (complex logic)
    - If file in domain/ or business/ → explanatory comments OK (domain knowledge)

Downgraded findings → separate "Advisory" note in report.

Output Format

## Code Comments Audit Report - [DATE]

### Compliance Score

| Category | Score | Issues |
|----------|-------|--------|
| WHY not WHAT | X/10 | N obvious comments |
| Density (15-20%) | X/10 | X% actual (target: 15-20%) |
| No Forbidden Content | X/10 | N forbidden items |
| Docstrings Quality | X/10 | N mismatches |
| Actuality | X/10 | N stale comments |
| Legacy Cleanup | X/10 | N legacy items |
| **Overall** | **X/10** | |

### Critical Findings

- [ ] **[Category]** `path/file:line` - Issue description. **Action:** Fix suggestion.

### Recommended Actions

| Priority | Action | Location | Category |
|----------|--------|----------|----------|
| High | Remove author name | src/X:45 | Forbidden |
| Medium | Update stale docstring | lib/Y:120 | Actuality |

Scoring Algorithm

MANDATORY READ: Load shared/references/audit_scoring.md for unified scoring formula.

Severity mapping:

Issue TypeSeverity
Author names, dates in commentsCRITICAL
Commented-out code blocksHIGH
Stale/outdated commentsHIGH
Obvious WHAT commentsMEDIUM
Density deviation >5%MEDIUM
Minor density deviationLOW

Reference Files

Definition of Done

  • All source files scanned (tech stack auto-detected)
  • Inline comments and docstrings/JSDoc extracted and parsed
  • All 6 categories audited with score X/10 each (WHY-not-WHAT, Density, Forbidden, Docstrings, Actuality, Legacy)
  • Comment-to-code density ratio calculated and compared against 15-20% target
  • Critical Findings listed with file:line, category, and fix suggestion
  • Recommended Actions table generated with priority, action, location, category

Critical Notes

  • Fix code, not rules: NEVER modify rules files (*_rules.md, *_standards.md) to make violations pass. Always fix the code instead.
  • Code is truth: When comment contradicts code, flag comment for update
  • WHY > WHAT: Comments explaining obvious behavior should be removed
  • Task IDs OK: Task/Story IDs in comments help with code traceability
  • Universal: Works with any language; detect comment syntax automatically
  • Based on: Claude Code comment-analyzer agent patterns

Version: 3.0.0 Last Updated: 2025-12-23

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

04

需要参考平台分布和安装热度时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

补充不同宿主或平台的使用分布数据

能力 5

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Claude Code

28.72%
按下载量换算94

Gemini CLI

25.24%
按下载量换算82

OpenCode

17.56%
按下载量换算57

Antigravity

14.05%
按下载量换算46

Codex

9.33%
按下载量换算30

Cursor

3.75%
按下载量换算12

安全审计

Gen Agent Trust Hub

通过

Socket

可疑

Snyk

通过

权限和风险

只读

该 Skill 主要提供规则、说明或参考内容,本身偏只读;真正读写文件、联网或执行命令仍取决于宿主 Agent 的任务。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。来源安全扫描存在 warning/failed 结果,不能写成本站确认安全。

来源信息

继续浏览同类 Skills