重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
bloodhound-scout by autumnsgrove/groveengine
npx skills add https://github.com/autumnsgrove/groveengine --skill bloodhound-scout寻血猎犬不会漫无目的地游荡。它找到气味——一个函数名、一个导入、一个模式——然后坚持不懈地追踪。穿过纠缠的导入,跨越模块边界,深入代码库最隐蔽的角落。寻血猎犬会绘制它发现的地图,创建可供他人跟随的踪迹。当你需要理解某物如何工作时,寻血猎犬会追踪到底。
/bloodhound-scout 或提及 bloodhound/tracking搭配使用: 探索后实施用 elephant-build,修复发现的问题用 panther-strike
SCENT → TRACK → HUNT → REPORT → RETURN
↓ ↓ ↓ ↓ ↓
拾取气味 追踪踪迹 深入探究 绘制领域图 分享知识
鼻子抽动。有东西来过这里...
确定我们要追踪的目标:
起始点: 我们有什么气味?
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
getUserByIdvalidateTokenUserProfile, PaymentFormutils/helpers.ts 在哪里被使用?搜索策略选择:
Grove Find (gf) 是寻血猎犬的主要嗅觉工具——快速、适合代理、专为特定目的构建:
# 主要 — Grove Find (寻血猎犬的最佳工具)
gf --agent search "functionName" # 在整个代码库中拾取气味
gf --agent func "getUserById" # 追踪函数的定义
gf --agent usage "UserProfile" # 追踪此名称留下的每条踪迹
gf --agent class "PaymentService" # 查找类/组件的位置
gf --agent impact "src/lib/auth.ts" # 此文件更改时会影响什么?
# Git 上下文 — 追踪前定位
gw context # 我们在哪里?分支、最近更改、状态
# 备用方案 — 当需要更精细的粒度时
grep -r "useState.*user" src/ --include="*.tsx"
glob "**/*.svelte" # 仅 Svelte 组件
glob "**/api/**/*.ts" # 仅 API 路由
范围定义:
输出: 明确的追踪目标和搜索策略已定义
爪子轻轻踏地,跟随踪迹蜿蜒穿过灌木丛...
系统地跟随连接:
导入追踪:
// 发现:组件导入 UserService
import { getUserById } from '$lib/services/user';
// 追踪到:UserService 实现
// 文件:src/lib/services/user.ts
export async function getUserById(id: string) {
return db.query('SELECT * FROM users WHERE id = ?', [id]);
}
// 追踪到:数据库层
// 文件:src/lib/db/connection.ts
export const db = createPool({...});
调用图映射:
UserProfile.svelte
↓ 调用
getUserById(id)
↓ 调用
db.query(sql, params)
↓ 调用
mysql.execute()
引用查找:
# Grove Find — 寻血猎犬最快的嗅觉
gf --agent usage "getUserById" # 谁调用这个函数?
gf --agent impact "src/lib/user.ts" # 什么依赖这个文件?
gf --agent search "UserProfile" # 这个类型在哪里使用?
# 更细粒度的追踪(备用方案)
grep -r "from.*user" src/ --include="*.ts" -l
模式识别: 在追踪过程中,注意模式:
输出: 带有调用图和文件关系的已追踪连接
踪迹变冷,但寻血猎犬转圈,在意想不到的地方再次找到它...
深入探究最重要的发现:
代码考古:
# 这个文件上次是什么时候更改的?
git log -p src/lib/auth.ts | head -100
# 谁写了这个关键函数?
git blame src/lib/auth.ts | grep "verifyToken"
# 它之前是什么样子?
git show HEAD~5:src/lib/auth.ts | grep -A 10 "verifyToken"
交叉引用分析:
// 发现:认证以 3 种不同的方式检查
// 方法 1: 中间件
app.use('/api', authMiddleware);
// 方法 2: 装饰器
@requireAuth
async function sensitiveOperation() {}
// 方法 3: 内联检查
if (!user.isAuthenticated) {
throw new UnauthorizedError();
}
// 洞察:不一致的认证模式表明是渐进式迁移
// 建议:标准化为中间件方法
边界情况搜寻: 寻找:
any 类型,as 断言)需要追踪的类型安全模式:
as any, as SomeType)safeJsonParse() 验证的裸 JSON.parse()parseFormData() 模式的原始 formData.get()isRedirect()/isHttpError() 类型守卫的 catch 块env.DB/env.STORAGE 而不是 GroveDatabase/GroveStorage依赖关系映射:
┌──────────────────────────────────────────────────────────────┐
│ 依赖关系网 │
├──────────────────────────────────────────────────────────────┤
│ │
│ UserService ◄──────► AuthService │
│ │ │ │
│ ▼ ▼ │
│ Database ◄────┬─────► Cache │
│ │ │
│ ▼ │
│ EmailService │
│ │
└──────────────────────────────────────────────────────────────┘
输出: 对关键路径、模式和潜在问题的深入分析
寻血猎犬返回,将一张地图放在猎人脚下...
为他人(以及未来的自己)记录发现:
领域地图:
## 🐕 BLOODHOUND SCOUT 报告
### 目标:用户认证流程
#### 入口点
1. `src/routes/login/+page.svelte` — 登录表单
2. `src/routes/api/auth/login/+server.ts` — API 端点
3. `src/lib/components/LoginForm.svelte` — 可复用组件
#### 核心踪迹
LoginForm.svelte ↓ 提交 +page.svelte#handleSubmit ↓ POST /api/auth/login +server.ts ↓ validateCredentials auth.service.ts ↓ verifyPassword password.utils.ts ↓ bcrypt.compare
#### 关键文件
| 文件 | 用途 | 复杂度 |
|------|---------|------------|
| auth.service.ts | 主要认证逻辑 | 中等 |
| password.utils.ts | 加密 | 低 |
| session.store.ts | 状态管理 | 高 |
| middleware.ts | 路由保护 | 中等 |
#### 发现的模式
- ✅ API 层中一致的错误处理
- ⚠️ 会话超时逻辑在 2 处重复
- ❌ 登录尝试没有速率限制
#### 连接关系
- UserService 调用 AuthService 进行验证
- AuthService 向 EventBus 发布事件
- 会话数据存储在 Redis 中
快速参考卡:
### 处理认证时:
- 检查中间件:`src/lib/middleware.ts`
- 服务层:`src/lib/services/auth.ts`
- 类型:`src/lib/types/auth.ts`
- 测试:`tests/auth.test.ts`
输出: 包含地图、模式和建议的全面报告
狩猎完成。知识留存,为下一个追踪者做好准备...
准备交接:
知识传递:
## 给下一位开发者的总结
### 整体概览
[用 2-3 句话解释系统的目的和架构]
### 从哪里开始
- 新功能? → 查看 `src/lib/services/`
- 修复错误? → 先检查 `src/lib/errors/`
- UI 更改? → `src/lib/components/` 中的组件
### 注意事项
- 数据库迁移在开发环境中自动运行,在生产环境中手动运行
- 认证令牌 15 分钟后过期,刷新令牌 7 天后过期
- 不要在客户端代码中导入 `src/lib/server/`
### 有用的命令
```bash
# 仅运行认证测试
npm test auth
# 重置数据库
npm run db:reset
# 查看 API 文档
npm run docs:api
```
**书签创建:**
创建快速访问点:
- `docs/exploration/auth-flow.md` — 此侦察报告
- 关键文件中的注释:`// BLOODHOUND: 用户操作的入口点`
- 问题标签:`area:auth`, `complexity:high`
**后续步骤:**
```markdown
### 推荐操作
1. [ ] 整合会话超时逻辑(在 2 处发现)
2. [ ] 为登录端点添加速率限制
3. [ ] 为认证事件记录事件总线模式
4. [ ] 为令牌刷新流程编写集成测试
输出: 团队就绪的文档,包含可操作的后续步骤
永不丢失气味。如果踪迹变冷,就绕回来。检查导入、导出、配置文件。代码就在那里——继续狩猎。
系统地追踪。不要随机跳跃。跟随调用图,边走边记录,一块一块地构建地图。
注意小事。那个不一致的错误信息、被注释掉的代码、六个月前的 TODO。这些都是路标。
使用追踪隐喻:
寻血猎犬不会:
用户: “支付系统是如何工作的?”
寻血猎犬流程:
🐕 SCENT — “从‘payment’关键词开始,搜索组件、服务、API 路由”
🐕 TRACK — “找到 PaymentForm 组件 → 调用 paymentService → 使用 Stripe SDK → +server.ts 中的 webhooks”
🐕 HUNT — “深入探究:错误处理、幂等键、webhook 签名验证、重试逻辑”
🐕 REPORT — “完整的流程地图,涉及 7 个文件,发现 2 个不一致的模式,1 个安全建议”
🐕 RETURN — “docs/payments/ 中的文档,标记了关键文件,提出了 3 个改进建议”
| 情况 | 方法 |
|---|---|
| 生产环境中的错误 | 从错误位置向后追踪到根本原因 |
| 添加功能 | 查找类似功能,遵循它们的模式 |
| 重构 | 映射所有依赖关系,识别安全的变更边界 |
| 代码审查准备 | 侦察更改的文件,理解上下文 |
| 新团队成员 | 整个代码库的领域地图,入口点 |
| 性能问题 | 搜寻热点路径,追踪执行流程 |
侦察前:
eagle-architect — 如果你需要先理解高层设计侦察中:
raccoon-audit — 如果在追踪过程中发现安全问题beaver-build — 为了理解测试模式侦察后:
panther-strike — 修复发现的特定问题elephant-build — 在已映射的领域内实施更改swan-design — 记录架构决策每个代码库都是一片森林。寻血猎犬知道如何导航。 🐕
每周安装量
49
代码仓库
GitHub 星标
2
首次出现
2026年2月5日
安全审计
安装于
codex49
gemini-cli49
opencode49
cline48
github-copilot48
kimi-cli48
The bloodhound doesn't wander aimlessly. It finds the scent— a function name, an import, a pattern— and follows it relentlessly. Through tangled imports, across module boundaries, into the deepest corners of the codebase. The bloodhound maps what it finds, creating trails others can follow. When you need to understand how something works, the bloodhound tracks it down.
/bloodhound-scout or mentions bloodhound/trackingPair with: elephant-build for implementing after exploration, panther-strike for fixing found issues
SCENT → TRACK → HUNT → REPORT → RETURN
↓ ↓ ↓ ↓ ↓
Pick Up Follow Deep Map the Share
Scent Trail Dive Territory Knowledge
The nose twitches. Something's been here...
Establish what we're tracking:
The Starting Point: What scent do we have?
getUserById, validateTokenUserProfile, PaymentFormutils/helpers.ts get used?Search Strategy Selection:
Grove Find (gf) is the bloodhound's primary nose -- fast, agent-friendly, purpose-built:
# PRIMARY — Grove Find (the bloodhound's best tools)
gf --agent search "functionName" # Pick up the scent across the codebase
gf --agent func "getUserById" # Track down a function's definition
gf --agent usage "UserProfile" # Follow every trail this name leaves
gf --agent class "PaymentService" # Find where a class/component lives
gf --agent impact "src/lib/auth.ts" # What trembles when this file changes?
# Git context — orient before tracking
gw context # Where are we? Branch, recent changes, state
# FALLBACK — when the scent needs a finer grain
grep -r "useState.*user" src/ --include="*.tsx"
glob "**/*.svelte" # Just Svelte components
glob "**/api/**/*.ts" # Just API routes
Scope Definition:
Output: Clear tracking target and search strategy defined
Paws pad softly, following the trail as it winds through the underbrush...
Follow connections systematically:
Import Tracing:
// Found: Component imports UserService
import { getUserById } from '$lib/services/user';
// Track to: UserService implementation
// File: src/lib/services/user.ts
export async function getUserById(id: string) {
return db.query('SELECT * FROM users WHERE id = ?', [id]);
}
// Track to: Database layer
// File: src/lib/db/connection.ts
export const db = createPool({...});
Call Graph Mapping:
UserProfile.svelte
↓ calls
getUserById(id)
↓ calls
db.query(sql, params)
↓ calls
mysql.execute()
Reference Finding:
# Grove Find — the bloodhound's fastest nose
gf --agent usage "getUserById" # Who calls this function?
gf --agent impact "src/lib/user.ts" # What depends on this file?
gf --agent search "UserProfile" # Where is this type used?
# Finer-grained tracking (fallback)
grep -r "from.*user" src/ --include="*.ts" -l
Pattern Recognition: As you track, notice patterns:
Output: Traced connections with call graphs and file relationships
The trail goes cold, but the bloodhound circles, finding it again in unexpected places...
Deep dive into the most important findings:
Code Archaeology:
# When was this file last changed?
git log -p src/lib/auth.ts | head -100
# Who wrote this critical function?
git blame src/lib/auth.ts | grep "verifyToken"
# What did it look like before?
git show HEAD~5:src/lib/auth.ts | grep -A 10 "verifyToken"
Cross-Reference Analysis:
// Find: Authentication is checked in 3 different ways
// Method 1: Middleware
app.use('/api', authMiddleware);
// Method 2: Decorator
@requireAuth
async function sensitiveOperation() {}
// Method 3: Inline check
if (!user.isAuthenticated) {
throw new UnauthorizedError();
}
// INSIGHT: Inconsistent auth patterns suggest gradual migration
// Recommendation: Standardize on middleware approach
Edge Case Hunting: Look for:
any types, as assertions)Type Safety Patterns to Track:
as any, as SomeType) at trust boundariesJSON.parse() without safeJsonParse() validationformData.get() without parseFormData() schemaisRedirect()/isHttpError() type guardsenv.DB/env.STORAGE instead of GroveDatabase/GroveStorageDependency Mapping:
┌──────────────────────────────────────────────────────────────┐
│ DEPENDENCY WEB │
├──────────────────────────────────────────────────────────────┤
│ │
│ UserService ◄──────► AuthService │
│ │ │ │
│ ▼ ▼ │
│ Database ◄────┬─────► Cache │
│ │ │
│ ▼ │
│ EmailService │
│ │
└──────────────────────────────────────────────────────────────┘
Output: Deep analysis of critical paths, patterns, and potential issues
The bloodhound returns, dropping a map at the hunter's feet...
Document findings for others (and your future self):
The Territory Map:
## 🐕 BLOODHOUND SCOUT REPORT
### Target: User Authentication Flow
#### Entry Points
1. `src/routes/login/+page.svelte` — Login form
2. `src/routes/api/auth/login/+server.ts` — API endpoint
3. `src/lib/components/LoginForm.svelte` — Reusable component
#### Core Trail
LoginForm.svelte ↓ submit +page.svelte#handleSubmit ↓ POST /api/auth/login +server.ts ↓ validateCredentials auth.service.ts ↓ verifyPassword password.utils.ts ↓ bcrypt.compare
#### Key Files
| File | Purpose | Complexity |
|------|---------|------------|
| auth.service.ts | Main auth logic | Medium |
| password.utils.ts | Encryption | Low |
| session.store.ts | State management | High |
| middleware.ts | Route protection | Medium |
#### Patterns Found
- ✅ Consistent error handling in API layer
- ⚠️ Session timeout logic duplicated in 2 places
- ❌ No rate limiting on login attempts
#### Connections
- UserService calls AuthService for verification
- AuthService publishes events to EventBus
- Session data stored in Redis
Quick Reference Card:
### When working with auth:
- Check middleware: `src/lib/middleware.ts`
- Service layer: `src/lib/services/auth.ts`
- Types: `src/lib/types/auth.ts`
- Tests: `tests/auth.test.ts`
Output: Comprehensive report with maps, patterns, and recommendations
The hunt is complete. The knowledge stays, ready for the next tracker...
Prepare for handoff:
Knowledge Transfer:
## Summary for Next Developer
### The Big Picture
[2-3 sentences explaining the system's purpose and architecture]
### Where to Start
- New feature? → Look at `src/lib/services/`
- Bug fix? → Check `src/lib/errors/` first
- UI change? → Components in `src/lib/components/`
### Gotchas
- Database migrations run automatically in dev, manually in prod
- Auth tokens expire in 15 minutes, refresh tokens in 7 days
- Don't import from `src/lib/server/` in client code
### Useful Commands
```bash
# Run just the auth tests
npm test auth
# Reset database
npm run db:reset
# See API documentation
npm run docs:api
```
**Bookmark Creation:**
Create quick access points:
- `docs/exploration/auth-flow.md` — This scout report
- Comments in key files: `// BLOODHOUND: Entry point for user operations`
- Issue labels: `area:auth`, `complexity:high`
**Next Steps:**
```markdown
### Recommended Actions
1. [ ] Consolidate session timeout logic (found in 2 places)
2. [ ] Add rate limiting to login endpoint
3. [ ] Document the event bus pattern for auth events
4. [ ] Write integration tests for token refresh flow
Output: Team-ready documentation with actionable next steps
Never lose the scent. If the trail goes cold, circle back. Check imports, exports, configuration files. The code is there—keep hunting.
Track systematically. Don't jump around randomly. Follow the call graph, document as you go, build the map piece by piece.
Notice the small things. That inconsistent error message, the commented-out code, the TODO from six months ago. These are signposts.
Use tracking metaphors:
The bloodhound does NOT:
User: "How does the payment system work?"
Bloodhound flow:
🐕 SCENT — "Starting with 'payment' keyword, searching for components, services, API routes"
🐕 TRACK — "Found PaymentForm component → calls paymentService → uses Stripe SDK → webhooks in +server.ts"
🐕 HUNT — "Deep dive: error handling, idempotency keys, webhook signature verification, retry logic"
🐕 REPORT — "Complete flow map, 7 files involved, 2 inconsistent patterns found, 1 security recommendation"
🐕 RETURN — "Documentation in docs/payments/, bookmarked key files, suggested 3 improvements"
| Situation | Approach |
|---|---|
| Bug in production | Track from error location backwards to root cause |
| Adding feature | Find similar features, follow their pattern |
| Refactoring | Map all dependencies, identify safe change boundaries |
| Code review prep | Scout changed files, understand context |
| New team member | Territory map of entire codebase, entry points |
| Performance issue | Hunt for hot paths, trace execution flow |
Before Scouting:
eagle-architect — If you need to understand high-level design firstDuring Scouting:
raccoon-audit — If you find security issues while trackingbeaver-build — To understand testing patternsAfter Scouting:
panther-strike — To fix specific issues foundelephant-build — To implement changes across mapped territoryswan-design — To document architectural decisionsEvery codebase is a forest. The bloodhound knows how to navigate. 🐕
Weekly Installs
49
Repository
GitHub Stars
2
First Seen
Feb 5, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
codex49
gemini-cli49
opencode49
cline48
github-copilot48
kimi-cli48
React 组合模式指南:Vercel 组件架构最佳实践,提升代码可维护性
122,000 周安装