Token导航 LogoToken导航TokenDH.com
研究检索external-servicegithub未标认证来源可访问clear审计提醒

ln-626-dead-code-auditorln 626 死代码审计员

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

7,409

周安装

315

GitHub Stars

437

下载量

2,596
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

3

许可证

MIT

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:ln-626-dead-code-auditor(ln 626 死代码审计员)
来源仓库:https://github.com/levnikolaevich/claude-code-skills
仓库路径:skills/ln-626-dead-code-auditor
安装命令:
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-626-dead-code-auditor
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。不同来源提供的安装方式可能略有差异;本站展示可直接复制的安装命令,安装前请核对来源页面。

skills.shnpx skills
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-626-dead-code-auditor

简介

用于安全审计、权限检查和常见漏洞排查,适合梳理敏感配置和鉴权逻辑。

  • 适用于需要分析凭据风险或生成安全复核清单的场景。
  • 使用时不能把工具输出直接当最终结论,需先确认最小权限和操作边界。
  • 涉及密钥、令牌或用户数据时应脱敏处理,避免影响生产系统。
  • 安装前建议确认权限范围和维护状态,确保不会触发不必要的网络或文件操作。

SKILL.md

Paths: File paths (shared/, references/, ../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root. If shared/ is missing, fetch files via WebFetch from https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}.

Dead Code Auditor (L3 Worker)

Type: L3 Worker

Specialized worker auditing unused and unreachable code.

Purpose & Scope

  • Audit dead code (Category 9: Low Priority)
  • Find unused imports, variables, functions, commented-out code
  • Calculate compliance score (X/10)

Inputs

MANDATORY READ: Load shared/references/audit_worker_core_contract.md. MANDATORY READ: Load shared/references/mcp_tool_preferences.md and shared/references/mcp_integration_patterns.md

Receives contextStore with tech stack, codebase root, output_dir.

Use hex-graph first when export liveness or workspace hotspots materially improve the audit. Use hex-line first for local code reads when available. If MCP is unavailable, unsupported, or not indexed, continue with built-in Read/Grep/Glob/Bash and state the fallback in the report.

Workflow

MANDATORY READ: Load shared/references/two_layer_detection.md for detection methodology.

  1. Parse context + output_dir
  2. Run dead code detection (Layer 1: linters, grep)

- Graph-capable projects: For JavaScript, TypeScript/TSX, Python, C#, and PHP, use index_project then bounded audit_workspace(verbosity="minimal", limit=5) as primary detection for unused exports when graph indexing is available. Raise limit only for deliberate drill-down. - Keep grep/linter fallback for unsupported languages, graph-unavailable runs, and checks outside export liveness.

  1. Analyze context per candidate (Layer 2):

- Unused functions: used via dynamic import/reflection? Exported in public API? Used in other packages (monorepo)? - Commented code: TODO with context or algorithm explanation -> FP. Truly dead code block -> confirmed - Legacy shims: read git blame -- age? Is there an issue/PR tracking removal?

  1. Collect confirmed findings
  2. Calculate score
  3. Write Report: Build full markdown report in memory per shared/templates/audit_worker_report_template.md, write to {output_dir}/ln-626--global.md in single Write call
  4. Return Summary: Return minimal summary to coordinator

Audit Rules

MANDATORY READ: Load shared/references/clean_code_checklist.md for universal dead code patterns and severity definitions.

1. Unreachable Code

Detection:

  • Linter rules: no-unreachable (ESLint)
  • Check code after return, throw, break

Severity: MEDIUM

2. Unused Imports/Variables/Functions

Detection:

  • ESLint: no-unused-vars
  • TypeScript: noUnusedLocals, noUnusedParameters
  • Python: flake8 with F401, F841

Severity:

  • MEDIUM: Unused functions (dead weight)
  • LOW: Unused imports (cleanup needed)

3. Commented-Out Code

Detection:

  • Grep for //.*{ or /*.*function patterns
  • Large comment blocks (>10 lines) with code syntax

Severity: LOW

Recommendation: Delete (git preserves history)

4. Legacy Code & Backward Compatibility

What: Backward compatibility shims, unsupported patterns, old code that should be removed

Detection:

  • Renamed variables/functions with old aliases:

- Pattern: const oldName = newName or export {newModule as oldModule} - Pattern: function oldFunc() {return newFunc();} (wrapper for backward compatibility)

  • Unsupported exports/re-exports:

- Grep for // DEPRECATED, @obsolete JSDoc tags - Pattern: export.*as.*old.* or export.*legacy.*

  • Conditional code for old versions:

- Pattern: if.*legacy.* or if.*old.*version.* or isOldVersion? oldFunc(): newFunc()

  • Migration shims and adapters:

- Pattern: migrate.*, Legacy.*Adapter, .*Shim, .*Compat

  • Comment markers:

- Grep for // backward compatibility, // legacy support, // TODO: remove in v - Grep for // old implementation, // unsupported, // kept for backward

Severity:

  • HIGH: Backward compatibility shims in critical paths (auth, payment, core features)
  • MEDIUM: Unsupported exports still in use, migration code from >6 months ago
  • LOW: Recent migration code (<3 months), planned deprecation with clear removal timeline

Recommendation:

  • Remove backward compatibility shims - breaking changes are acceptable when properly versioned
  • Delete old implementations - keep only the correct/new version
  • Remove unsupported exports - update consumers to use new API
  • Delete migration code after grace period (3-6 months)
  • Clean legacy support comments - git history preserves old implementations

Effort:

  • S: Remove simple aliases, delete unsupported exports
  • M: Refactor code using old APIs to new APIs
  • L: Remove complex backward compatibility layer affecting multiple modules

Scoring Algorithm

MANDATORY READ: Load shared/references/audit_worker_core_contract.md and shared/references/audit_scoring.md.

Output Format

MANDATORY READ: Load shared/references/audit_worker_core_contract.md and shared/templates/audit_worker_report_template.md.

Write JSON summary per shared/references/audit_summary_contract.md. In managed mode the caller passes both runId and summaryArtifactPath; in standalone mode the worker generates its own run-scoped artifact path per shared contract.

Write report to {output_dir}/ln-626--global.md with category: "Dead Code" and checks: unreachable_code, unused_exports, commented_code, legacy_shims.

Return summary per shared/references/audit_summary_contract.md.

When summaryArtifactPath is absent, write the standalone runtime summary under .hex-skills/runtime-artifacts/runs/{run_id}/evaluation-worker/{worker}--{identifier}.json and optionally echo the same summary in structured output.

Report written: .hex-skills/runtime-artifacts/runs/{run_id}/audit-report/ln-626--global.md
Score: X.X/10 | Issues: N (C:N H:N M:N L:N)

Reference Files

  • Clean code checklist: shared/references/clean_code_checklist.md
  • Audit output schema: shared/references/audit_output_schema.md

Critical Rules

MANDATORY READ: Load shared/references/audit_worker_core_contract.md.

  • Do not auto-fix: Report only, never delete code
  • Age-aware severity: Legacy shims >6 months = MEDIUM, <3 months = LOW
  • Effort realism: S = <1h, M = 1-4h, L = >4h
  • Exclusions: Skip generated code, vendor, migrations, test fixtures
  • Git-aware: Recommend deletion confidently -- git history preserves old code

Definition of Done

MANDATORY READ: Load shared/references/audit_worker_core_contract.md.

  • contextStore parsed (including output_dir)
  • All 4 checks completed (unreachable code, unused imports/vars/functions, commented-out code, legacy shims)
  • Clean code checklist loaded from shared/references/clean_code_checklist.md
  • Findings collected with severity, location, effort, recommendation
  • Score calculated per shared/references/audit_scoring.md
  • Report written to {output_dir}/ln-626--global.md (atomic single Write call)
  • Summary written per contract

Version: 3.0.0 Last Updated: 2025-12-23

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

04

需要参考平台分布和安装热度时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

补充不同宿主或平台的使用分布数据

能力 5

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Claude Code

32.38%
按下载量换算841

Gemini CLI

21.82%
按下载量换算566

OpenCode

19.15%
按下载量换算497

Antigravity

13.25%
按下载量换算344

Codex

7.72%
按下载量换算200

Cursor

3.61%
按下载量换算94

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

可疑

权限和风险

external-service

该 Skill 可能调用第三方服务、云服务或外部模型 API,使用前需要确认账号、额度、数据发送范围和服务条款。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。来源安全扫描存在 warning/failed 结果,不能写成本站确认安全。

来源信息

继续浏览同类 Skills