Token导航 LogoToken导航TokenDH.com
研究检索只读github未标认证来源可访问许可证需确认审计未展示

tt-audittt 审核

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

264

周安装

11

GitHub Stars

公开资料未说明

下载量

88
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

2

许可证

unknown

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:tt-audit(tt 审核)
来源仓库:https://github.com/biasia/tt-impeccable
仓库路径:skills/tt-audit
安装命令:
npx skills add https://github.com/biasia/tt-impeccable --skill tt-audit
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/biasia/tt-impeccable --skill tt-audit

简介

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。

  • 适用于系统安全检查、权限管理和漏洞修复等研究检索类任务。
  • 通过 GitHub 仓库安装,使用 npx skills add 命令添加指定技能。
  • 使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限。
  • tt-audit 属于研究检索类 Skill,可作为该场景下的辅助能力补充。

SKILL.md

Context Check

  1. Read .tt-impeccable.md from the project root → check ### Fidelity Intent. If found, use it.
  2. If absent, infer from the codebase:

- Canvas ≤ 390px, mobile-first flex, safe area insets → Strict TUX-native - Desktop-first, 1440px max-width, dark #000000 canvas → TT Style - If still unclear, ask: "Is this Strict TUX-native (mobile product screen) or TT Style (web / marketing)?"

Load token values as needed from tt-impeccable/reference/tokens.md and tt-impeccable/reference/typography.md.

Rules below marked (TUX-native only) are skipped for TT Style — they are not violations. Rules marked (TT Style only) are skipped for TUX-native. Universal rules apply to both tiers.


Run systematic technical quality checks against TUX v2 standards and generate a comprehensive report. Do not fix issues — document them for /tt-impeccable extract or /tt-impeccable craft to address.

This is a code-level audit, not a design critique. Check what is measurable and verifiable in the implementation.


Diagnostic Scan

Score each of the 5 dimensions 0–4 using the criteria below.


1. Accessibility (A11y)

Check for:

  • Contrast: Text contrast < 4.5:1 (normal) or < 3:1 (large text / UI components)
  • Touch targets: Interactive elements with tap area < 44×44px
  • Missing ARIA: Interactive elements without role, label, or state attributes
  • Keyboard navigation: Missing :focus-visible, illogical tab order, keyboard traps
  • Semantic HTML: <div> used as button, missing <main>/<nav> landmarks, broken heading hierarchy
  • Form issues: <input> without <label>, errors not associated via aria-describedby, missing required

Score 0–4: 0 = Inaccessible (fails WCAG A) · 1 = Major gaps · 2 = Partial effort · 3 = WCAG AA mostly met · 4 = WCAG AA fully met


2. Performance

Check for:

  • Expensive animations: width, height, top, left, padding, margin being animated instead of transform/opacity (universal)
  • Animation duration (TUX-native only): UI feedback transitions exceeding 200ms or entrance transitions exceeding 300ms — flag as P2. (TT Style: scroll-driven hero entrances up to 800ms are acceptable; looping/idle animations remain banned.)
  • Layout thrashing: Reading and writing layout properties in the same loop (universal)
  • Missing lazy loading: Off-screen images or content loaded eagerly
  • Excessive re-renders: Missing memoization, state causing full subtree re-render
  • Unused imports: Dependencies imported but not used; heavy libraries for trivial tasks

Score 0–4: 0 = Severe · 1 = Major problems · 2 = Partial · 3 = Mostly optimized · 4 = Fast and lean


3. TUX Token Fidelity

The core TUX-specific dimension. Check every color, spacing, radius, shadow, and typography declaration against reference/tokens.md and reference/typography.md.

Colors:

  • Raw hex or rgba values not going through var(--tux-*) CSS variables
  • OKLCH, HSL, or custom color functions
  • Brand red (#FE2C55) used as section background or decorative fill
  • Neutral-first violation: UI/Shape/Primary or UI/Shape/Secondary appearing on more than one distinct element type per screen (TUX-native only; flag as P2)
  • Colored overlay (red or teal tint) applied over image or video content — Image Overlay tokens must be black-alpha or white-alpha only (universal)
  • Colored skeleton/placeholder on image or video loading states — must use UI/Shape/Neutral 4 (universal)
  • Invented dark mode values not from the official token table

Borders & Dividers:

  • Border overuse: border, border-top, or border-bottom used to separate content groups where a background color change (UI/Page/Flat 2, UI/Page/Grouped 1/2, UI/Shape/Neutral 4 fill) would achieve the same separation. Flag as P2 — borders add visual noise TUX avoids by design.
  • border-left or border-right > 1px as a colored accent stripe — flag as P0 (hard ban, universal)
  • Divider weight: prefer 0.5px hairline over 1px on retina screens
  • Hover via border-color: any :hover rule that changes border-color or adds a new border — flag as P2. Hover state must be expressed through background or opacity changes, not border changes. Ghost/outline buttons are the only exception, and even then only the background should change on hover, not the border-color.
  • Border compensating for insufficient surface contrast: if a border appears on a dark surface element (e.g., a code block or panel) whose background is nearly identical to the page background, flag as P2 — the root cause is a wrong background color, not a missing border. The fix is to use the correct UI/Page/Flat 2 (#1E1E1E) or UI/Page/Flat 3 (#2C2C2C) token, not to add an outline.

Brand Red Opacity Violations:

  • rgba(254,44,85,*) at ANY alpha value used as a content area fill, section background, blockquote tint, or card background — flag as P1 regardless of opacity. A tint of 0.06 is as much a BAN 7 violation as full opacity. Legitimate sub-full-opacity uses are interactive state fills only (pressed row, selected background).
  • Check for --red-dim, var(--tux-shape-primary-4), var(--tux-shape-primary-5) on non-interactive elements — flag as P1.

Neutral-first (expanded):

  • Primary/Secondary on non-interactive elements is a violation even if it appears only once — the "one element per screen" rule is a ceiling, not a floor. A decorative arrow, separator, bullet, or background tint in brand red or teal fails the neutral-first check regardless of count. Verify interactivity: does the element have onClick, href, role="button", or equivalent? If not, it must be neutral.

Spacing:

  • Any pixel value not in the TUX 4px grid: 4 / 8 / 12 / 16 / 20 / 24 / 32 (universal)
  • Values exceeding 32px (TUX-native only) — TT Style allows uncapped section spacing
  • Page horizontal padding deviating from 16px (TUX-native only) — TT Style uses responsive padding (80–120px desktop / 24px mobile)

Radius:

  • Values not from content radius table: 4 / 6 / 8 / 10 / 12 / 9999px
  • Values not from container radius table: 8 / 10 / 14 / 16 / 26px
  • Content and container radius mixed on the same element

Shadow:

  • Custom box-shadow values not matching the 6 TUX levels
  • Drop shadows used in dark mode for elevation (should be brightness overlays)

Typography:

  • Font family other than 'TikTok Sans', system-ui, -apple-system, sans-serif (universal)
  • Font sizes not in the 12-step scale: 32 / 24 / 20 / 17 / 16 / 15 / 14 / 13 / 12 / 11 / 10px (TUX-native only) — TT Style allows display scale (48 / 72 / 96px+) for hero text
  • Font weight above 700 (TUX-native only) — TT Style allows 800/900 via TikTokVF for hero display text
  • Non-zero letter-spacing on text below 72px (universal) — TT Style allows negative tracking at 72px+ display text only
  • Line-heights not matching the fixed per-style values from the type scale (TUX-native only)
  • More than 3 distinct size tiers visible on one screen (universal)

Score 0–4: 0 = No tokens (hard-coded everything) · 1 = Occasional tokens · 2 = Partial · 3 = Good, minor hard-coded values · 4 = Full compliance


4. TUX Component Compliance

Check that TUX components match their specified dimensions, states, and structure.

ComponentSpec✓/✗
Full-width CTA buttonheight 52px, pill radius (9999px)
Mid-page buttonheight 44px, pill radius
Inline buttonheight 32px, pill radius
Text input / search barheight 40px, radius 10px, rgba(0,0,0,0.05) bg
Toggle52×32px track, teal ON / neutral OFF
Navigation barheight 44px, horizontal padding 16px
Tab bar83px total (49px visible + 34px home indicator inset)
Status bar spacer44px top
Safe area bottom34px

Also check for bans (mark tier where applicable):

  1. Side-stripe borders (border-left/right > 1px as accent) (universal)
  2. Gradient text (background-clip: text + gradient) (universal)
  3. Invented radius values (outside the two official tables) (universal)
  4. Custom shadow values (outside the 6 TUX levels) (universal)
  5. Assumed @byted-tiktok/tux-web imports (without package.json verification) (universal)
  6. Glassmorphism (backdrop-filter: blur() decoratively) (TUX-native: hard ban. TT Style: flag as P2 if .tt-impeccable.md Glassmorphism field is absent or "No" — it requires explicit user confirmation, not assumed from the fidelity tier)
  7. Brand red as large-area background (universal)

Score 0–4: 0 = Multiple spec violations + banned patterns · 1 = Several wrong dimensions · 2 = Some violations · 3 = Minor deviations · 4 = Full compliance


5. TikTok Native Test

"If you sent a screenshot to a TikTok designer, would they say 'that's TikTok' or 'that's a clone'?"

Apply the criteria matching the declared fidelity tier:

Strict TUX-native — "Does this feel like it belongs inside the TikTok app?":

  • Is content the most visually dominant element — not chrome, not decoration?
  • Is there a single clear focal point (primary CTA or main content) identifiable in 1 second?
  • Are there more than 3 distinct visual weight tiers on screen?
  • Do same-level elements use consistent size and weight?
  • Are accent colors (brand red, teal) only on interactive elements of the appropriate type?
  • Does Primary (brand red) appear on more than one distinct interactive element type per screen? If so, the color restraint rule is broken — one of them should be neutral.
  • Do any image or video surfaces have colored overlays or colored placeholder backgrounds? They must not.
  • Does content at the viewport bottom clip slightly (signals scrollability without a label)?
  • On lists with section separators, is the first cell's top gap 8px larger than cell-to-cell gap?

TT Style — "Does this feel like tiktokbrandhub.com — or a generic dark web page?":

  • Is the dark canvas (#000000) used as the primary background?
  • Do Blaze (red) and Glint (teal) appear only in their correct semantic roles (CTA / secondary accent)?
  • Does the hero typography have presence — bold weight, clear scale hierarchy?
  • Is negative space used intentionally, not just left empty?
  • Does motion feel purposeful and brand-forward, not generic (no CSS default easings, no bounce)?
  • Is the pill button shape present on primary actions?
  • Would someone recognize this as TikTok brand — not a TikTok-adjacent third party?

Score 0–4: 0 = Clearly third-party · 1 = Significant divergence · 2 = Recognizable but rough · 3 = Close, minor tells · 4 = Indistinguishable from authentic TikTok (native app or Brand Hub depending on tier)


Generate Report

Audit Health Score

#DimensionScoreKey Finding
1Accessibility? /4[most critical issue or —]
2Performance? /4
3TUX Token Fidelity? /4
4TUX Component Compliance? /4
5TikTok Native Test? /4
Total??/20[rating]

Rating bands: 18–20 Excellent · 14–17 Good · 10–13 Acceptable · 6–9 Poor · 0–5 Critical


TUX Token Verdict

Start here. Pass/fail: does the implementation use TUX tokens throughout, or are there hard-coded values? List specific violations with file and line locations. Be specific — "rgba(254,44,85,1) hardcoded in Button.tsx line 34" not "some colors are hardcoded".


Executive Summary

  • Audit Health Score: ??/20 ([rating band])
  • Issues by severity: P0 __ · P1 __ · P2 __ · P3 __
  • Top 3–5 critical issues
  • Recommended next steps

Detailed Findings by Severity

Tag every issue with P0–P3:

  • P0 Blocking — prevents task completion or causes WCAG failure; fix before any release
  • P1 Major — significant user impact or TUX fidelity gap; fix before release
  • P2 Minor — visible deviation, workaround exists; fix in next pass
  • P3 Polish — subtle; fix if time permits

For each issue:

  • [P?] Issue name
  • Location: component / file / line number
  • Category: Accessibility · Performance · Token Fidelity · Component · TikTok Native
  • Impact: how it affects users or TUX compliance
  • Recommendation: exactly what to change and to what value
  • Suggested command: /tt-impeccable extract for token/component fixes; /tt-impeccable craft [feature] for structural rebuilds

Systemic Issues

Identify patterns that indicate a systemic gap:

  • "Hard-coded colors appear in 12+ components — needs a shared tokens CSS file"
  • "Touch targets consistently under 44px — interaction patterns need a sweep"

Positive Findings

Note what is correct and should be preserved. Good practices are as important to document as violations.


Recommended Actions

List in priority order (P0 first):

  1. [P?] /tt-impeccable extract — [specific tokens / components to align]
  2. [P?] /tt-impeccable craft [feature] — [what to rebuild and why]

After presenting the report:

tt-audit vs tt-critique: this skill checks code correctness — token values, component dimensions, accessibility, performance. /tt-critique evaluates design quality — visual hierarchy, UX patterns, IA, and copy. Run both for a complete picture.
You can ask me to run these one at a time, all at once, or in any order you prefer. Re-run /tt-audit after fixes to track score improvement.

Never

  • Report issues without explaining user impact
  • Give generic recommendations — cite specific files, lines, and values
  • Skip positive findings
  • Mark everything P0 — prioritization is the point
  • Report false positives without verifying in the actual code
  • Fix anything during audit — this is a read-only diagnostic pass

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Codex

36.34%
按下载量换算32

Claude

28.83%
按下载量换算25

Cursor

21.22%
按下载量换算19

Gemini CLI

10.12%
按下载量换算9

安全审计

暂无安全审计结果可展示。

权限和风险

只读

该 Skill 主要提供规则、说明或参考内容,本身偏只读;真正读写文件、联网或执行命令仍取决于宿主 Agent 的任务。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。当前只有一个来源,正式发布前建议补源仓库或其他目录站核验。

来源信息

继续浏览同类 Skills