simplify-and-harden-ci by pskoett/pskoett-ai-skills
npx skills add https://github.com/pskoett/pskoett-ai-skills --skill simplify-and-harden-cinpx skills add pskoett/pskoett-ai-skills/skills/simplify-and-harden-ci
在拉取请求中运行简化与加固的仅 CI 变体:
在交互式/本地编码会话中使用 simplify-and-harden。
CI 代理不具备与编写变更的编码代理相同的峰值实现上下文。请将 CI 发现结果视为结构化的审查信号,而非完整的、理解意图的重写。
这意味着:
gh auth status)gh-aw 用于编写/验证:gh extension install github/gh-aw
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
- uses: github/gh-aw/actions/setup-cli@main
with:
version: v0.2.0-beta
CI 技能必须强制执行:
simplify_and_harden 摘要负载critical:当存在严重加固发现时,检查失败advisory(可选):当配置为阻止的咨询性发现存在时,检查失败示例模板位于 references/workflow-example.md 中。在您明确希望启用自动化之前,请将其保留在 .github/workflows 目录之外。
准备启用时:
references/workflow-example.md 模板块复制到 .github/workflows/simplify-and-harden-ci.md。gh aw compile --validate --strict
gh aw run simplify-and-harden-ci --push
在您的 gh-aw 工作流程中使用此提示正文:
Run Simplify & Harden in CI (headless mode) for this pull request.
Rules:
1) Review only files changed in this PR.
2) Do not modify repository files.
3) Before reporting findings, re-read all changed code with "fresh eyes" and actively look for obvious bugs, errors, confusing logic, brittle assumptions, naming issues, and missed hardening opportunities.
4) Simplify pass: detect dead code, naming clarity issues, control-flow complexity, unnecessary API surface, and over-abstraction.
5) Harden pass: detect input-validation gaps, injection vectors, auth/authz issues, secret exposure, data leaks, and concurrency risks.
6) Document pass: suggest non-obvious rationale comments as findings (do not edit files).
7) Emit structured YAML under key `simplify_and_harden`, including:
- simplify findings
- harden findings (critical/advisory split)
- summary counts
- `review_followup_required`
- learning loop candidates for self-improvement ingestion
8) If blocking policy is enabled and matching findings exist, mark the run as failed.
通过 self-improvement 工作流程,将 simplify_and_harden.learning_loop.candidates 转发到 .learnings/LEARNINGS.md 中,以便将重复出现的模式提升为持久的代理上下文规则。
每周安装次数
261
仓库
GitHub 星标数
72
首次出现
2026年2月22日
安全审计
安装于
codex260
gemini-cli259
cursor259
opencode259
github-copilot259
kimi-cli258
npx skills add pskoett/pskoett-ai-skills/skills/simplify-and-harden-ci
Run a CI-only variant of Simplify & Harden in pull requests:
Use simplify-and-harden for interactive/local coding sessions.
CI agents do not have the same peak implementation context as the coding agent that wrote the change. Treat CI findings as structured review signals, not as full intent-aware rewrites.
Implications:
gh auth status)gh-aw installed locally for authoring/validation:gh extension install github/gh-aw
- uses: github/gh-aw/actions/setup-cli@main
with:
version: v0.2.0-beta
The CI skill must enforce:
simplify_and_harden summary payloadcritical: fail check when critical harden findings existadvisory (optional): fail check when advisory findings are configured to blockExample-only template lives in references/workflow-example.md. Keep it outside .github/workflows until you explicitly want automation enabled.
When ready to enable:
references/workflow-example.md template block into .github/workflows/simplify-and-harden-ci.md.gh aw compile --validate --strict
gh aw run simplify-and-harden-ci --push
Use this prompt body in your gh-aw workflow:
Run Simplify & Harden in CI (headless mode) for this pull request.
Rules:
1) Review only files changed in this PR.
2) Do not modify repository files.
3) Before reporting findings, re-read all changed code with "fresh eyes" and actively look for obvious bugs, errors, confusing logic, brittle assumptions, naming issues, and missed hardening opportunities.
4) Simplify pass: detect dead code, naming clarity issues, control-flow complexity, unnecessary API surface, and over-abstraction.
5) Harden pass: detect input-validation gaps, injection vectors, auth/authz issues, secret exposure, data leaks, and concurrency risks.
6) Document pass: suggest non-obvious rationale comments as findings (do not edit files).
7) Emit structured YAML under key `simplify_and_harden`, including:
- simplify findings
- harden findings (critical/advisory split)
- summary counts
- `review_followup_required`
- learning loop candidates for self-improvement ingestion
8) If blocking policy is enabled and matching findings exist, mark the run as failed.
Forward simplify_and_harden.learning_loop.candidates into .learnings/LEARNINGS.md via the self-improvement workflow so recurrent patterns can be promoted into durable agent context rules.
Weekly Installs
261
Repository
GitHub Stars
72
First Seen
Feb 22, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
codex260
gemini-cli259
cursor259
opencode259
github-copilot259
kimi-cli258
Azure Data Explorer (Kusto) 查询技能:KQL数据分析、日志遥测与时间序列处理
102,600 周安装