重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
pre-ship-review by terrylica/cc-skills
npx skills add https://github.com/terrylica/cc-skills --skill pre-ship-review在任何检查点(如 PR、发布、里程碑)提交代码前进行的结构化质量审查。捕获发生在集成边界的失败——即合约、示例、常量和测试必须全部一致的地方。
核心论点:AI 生成的代码在独立组件方面表现出色,但在组件之间的边界处会系统性失败。此技能系统地检查这些边界。
在任何重要的代码提交前使用:
不需要用于:单文件的表面更改、仅文档更新、依赖项升级。
强制要求:在开始审查前,选择并加载适当的模板。
1. 检测更改的文件和范围(针对基础分支运行 `git diff --name-only`)
2. 运行阶段 1 - 外部工具检查(Pyright, Vulture, import-linter, deptry, Semgrep, Griffe)
3. 运行阶段 2 - cc-skills 编排(code-hardcode-audit, dead-code-detector, pr-gfm-validator)
4. 根据更改的文件类型运行阶段 2 的条件检查
5. 阶段 3 - 验证每个函数参数至少有一个调用者通过名称传递它
6. 阶段 3 - 验证每个配置/示例参数映射到实际的函数关键字参数
7. 阶段 3 - 检查架构边界违规(硬编码的功能列表、跨层耦合)
8. 阶段 3 - 验证领域常量和公式正确(交叉引用引用的来源)
9. 阶段 3 - 审计测试质量 - 测试是否测试了它们声称的内容(而非副作用)?
10. 阶段 3 - 检查新组件之间的隐式依赖关系
11. 阶段 3 - 寻找 O(n^2) 模式,其中 O(n) 就足够了
12. 阶段 3 - 验证错误消息提供了可操作的指导
13. 阶段 3 - 确认示例反映了实际行为,而非期望行为
14. 编译包含严重性和建议修复的发现报告
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
1. 验证修复是否针对根本原因,而非症状
2. 验证修复是否没有掩盖信息流
3. 检查新测试是否重现了原始错误(在没有修复的情况下失败)
4. 在更改的文件上运行阶段 1 - 外部工具检查
5. 在更改的文件上运行阶段 2 - cc-skills 检查
6. 如果任何值发生更改,验证常量一致性
7. 编译发现报告
1. 验证所有调用者已更新以匹配新签名
2. 运行阶段 1 - 外部工具检查(特别是 Griffe 用于 API 漂移)
3. 运行阶段 2 - cc-skills 检查(特别是 dead-code-detector)
4. 验证示例/文档已更新以匹配新参数名称
5. 验证没有因移除功能而产生的死导入
6. 检查是否引入了跨边界耦合
7. 编译发现报告
在更改的文件上运行静态分析工具。跳过任何未安装的工具(优雅降级)。
Detect scope:
git diff --name-only $(git merge-base HEAD main)...HEAD
Run in parallel:
pyright --outputjson <changed_py_files> # Type contracts
vulture <changed_py_files> --min-confidence 80 # Dead code / YAGNI
lint-imports # Architecture boundaries
deptry . # Dependency hygiene
semgrep --config .semgrep/ <changed_files> # Custom pattern rules
griffe check --against main <package> # API signature drift
每个工具捕获的内容:
| 工具 | 反模式 | 安装 |
|---|---|---|
| Pyright (严格模式) | 接口合约、返回类型、跨文件类型错误 | pip install pyright |
| Vulture | 死代码、未使用的常量/导入 (YAGNI) | pip install vulture |
| import-linter | 架构边界违规、禁止的导入 | pip install import-linter |
| deptry | 未使用/缺失/传递依赖项 | pip install deptry |
| Semgrep | 非确定性、静默参数吸收、禁止的模式 | brew install semgrep |
| Griffe | 破坏性 API 更改、与基础分支的签名漂移 | pip install griffe |
优雅降级:如果某个工具未安装,记录警告并跳过它。绝不因为一个可选工具缺失而使整个审查失败。
调用补充外部工具的现有 cc-skills。
始终运行:
根据更改的文件类型有条件地运行:
| 条件 | 要调用的技能 |
|---|---|
| Python 文件更改 | impl-standards(错误处理、常量、日志记录) |
| 500+ 行更改 | code-clone-assistant(重复代码检测) |
| 插件/钩子文件更改 | plugin-validator(结构、静默失败) |
| Markdown/文档更改 | link-validation(损坏的链接、路径策略) |
这些检查需要理解意图、领域正确性和架构适用性。手动检查每一项。
检查 1:架构边界
检查 2:领域正确性
检查 3:测试质量
检查 4:依赖透明度
检查 5:性能
检查 6:错误消息质量
检查 7:示例准确性
**kwargs 或 **_ 静默吸收的参数?有关详细检查程序,请参阅判断检查参考。
Phase 1 (Tools):
- [ ] Pyright strict passes on changed files (no type errors)
- [ ] Vulture finds no unused code in new files (or allowlisted)
- [ ] import-linter passes (no architecture boundary violations)
- [ ] deptry passes (no unused/missing dependencies)
- [ ] Semgrep custom rules pass (no non-determinism, no silent param absorption)
- [ ] Griffe shows no unintended API breaking changes vs base branch
Phase 2 (cc-skills):
- [ ] code-hardcode-audit passes (no magic numbers or secrets)
- [ ] dead-code-detector passes (no unused code)
- [ ] PR description links valid (pr-gfm-validator)
Phase 3 (Judgment):
- [ ] No new cross-boundary coupling introduced
- [ ] Domain constants and formulas are mathematically correct
- [ ] Tests actually test what they claim (not side effects)
- [ ] Implicit dependencies between components are documented
- [ ] No O(n^2) where O(n) suffices
- [ ] Error messages give actionable guidance
- [ ] Examples reflect actual behavior, not aspirational behavior
此技能基于 9 种集成边界反模式的分类法构建。有关完整目录(包含示例、检测启发式方法和修复方法),请参阅反模式目录。
---|---|---
1 | 接口合约违规 | Pyright + Griffe + 手动追踪
2 | 误导性示例 | Semgrep + 手动配置到代码比较
3 | 架构边界违规 | import-linter + 手动审查
4 | 不正确的领域常量 | Semgrep + 领域专业知识
5 | 测试覆盖缺口 | mutmut + 手动测试审计
6 | 非确定性 | Semgrep 自定义规则
7 | YAGNI | Vulture + dead-code-detector
8 | 隐藏的依赖关系 | 手动依赖关系追踪
9 | 性能反模式 | 手动复杂度分析
修改此技能后:
references/ 链接解析正确references/evolution-log.md此技能完成后,在关闭任务前进行反思:
不要推迟。下一次调用将继承你留下的任何内容。
| 问题 | 原因 | 解决方案 |
|---|---|---|
| 工具未找到 | 外部工具未安装 | 按照 tool-install-guide.md 安装或跳过(优雅降级) |
| Vulture 误报过多 | 框架入口点看起来未使用 | 创建允许列表:vulture --make-whitelist > whitelist.py |
| Semgrep 太慢 | 大型代码库扫描 | 仅限定在更改的文件:semgrep --include=<changed> |
| import-linter 没有合约 | 项目未配置 | 在 pyproject.toml 中添加 [importlinter] 部分 |
| Griffe 报告错误的破坏性更改 | 故意的 API 更改 | 使用 griffe check --against main --allow-breaking |
| 阶段 3 未发现问题但审查者发现问题 | 新的反模式类别 | 添加到目录和 evolution-log.md |
| cc-skill 未触发 | 技能未在市场中安装 | 使用 /plugin list 验证 |
有关详细信息,请参阅:
每周安装数
56
仓库
GitHub 星标数
28
首次出现
2026年2月13日
安全审计
安装于
opencode54
github-copilot53
codex53
kimi-cli53
gemini-cli53
amp53
Structured quality review before shipping code at any checkpoint: PRs, releases, milestones. Catches the failures that occur at integration boundaries -- where contracts, examples, constants, and tests must all agree.
Core thesis : AI-generated code excels at isolated components but fails systematically at boundaries between components. This skill systematically checks those boundaries.
Use before any significant code shipment:
NOT needed for: single-file cosmetic changes, documentation-only updates, dependency bumps.
MANDATORY : Select and load the appropriate template before starting review.
1. Detect changed files and scope (git diff --name-only against base branch)
2. Run Phase 1 - External tool checks (Pyright, Vulture, import-linter, deptry, Semgrep, Griffe)
3. Run Phase 2 - cc-skills orchestration (code-hardcode-audit, dead-code-detector, pr-gfm-validator)
4. Run Phase 2 conditional checks based on file types changed
5. Phase 3 - Verify every function parameter has at least one caller passing it by name
6. Phase 3 - Verify every config/example parameter maps to an actual function kwarg
7. Phase 3 - Check for architecture boundary violations (hardcoded feature lists, cross-layer coupling)
8. Phase 3 - Verify domain constants and formulas are correct (cross-reference cited sources)
9. Phase 3 - Audit test quality - do tests test what they claim (not side effects)?
10. Phase 3 - Check for implicit dependencies between new components
11. Phase 3 - Look for O(n^2) patterns where O(n) suffices
12. Phase 3 - Verify error messages give actionable guidance
13. Phase 3 - Confirm examples reflect actual behavior, not aspirational behavior
14. Compile findings report with severity and suggested fixes
1. Verify the fix addresses root cause, not symptom
2. Verify the fix does not mask information flow
3. Check that new test reproduces the original bug (fails without fix)
4. Run Phase 1 - External tool checks on changed files
5. Run Phase 2 - cc-skills checks on changed files
6. Verify constants consistency if any values changed
7. Compile findings report
1. Verify all callers updated to match new signatures
2. Run Phase 1 - External tool checks (especially Griffe for API drift)
3. Run Phase 2 - cc-skills checks (especially dead-code-detector)
4. Verify examples/docs updated to match new parameter names
5. Verify no dead imports from removed features
6. Check for introduced cross-boundary coupling
7. Compile findings report
Run static analysis tools on changed files. Skip any tool that is not installed (graceful degradation).
Detect scope:
git diff --name-only $(git merge-base HEAD main)...HEAD
Run in parallel:
pyright --outputjson <changed_py_files> # Type contracts
vulture <changed_py_files> --min-confidence 80 # Dead code / YAGNI
lint-imports # Architecture boundaries
deptry . # Dependency hygiene
semgrep --config .semgrep/ <changed_files> # Custom pattern rules
griffe check --against main <package> # API signature drift
What each tool catches:
| Tool | Anti-Pattern | Install |
|---|---|---|
| Pyright (strict) | Interface contracts, return types, cross-file type errors | pip install pyright |
| Vulture | Dead code, unused constants/imports (YAGNI) | pip install vulture |
| import-linter | Architecture boundary violations, forbidden imports | pip install import-linter |
| deptry | Unused/missing/transitive dependencies | pip install deptry |
| Semgrep | Non-determinism, silent param absorption, banned patterns |
Graceful degradation : If a tool is not installed, log a warning and skip it. Never fail the entire review because one optional tool is missing.
For detailed tool procedures, see Automated Checks Reference. For installation instructions, see Tool Install Guide.
Invoke existing cc-skills that complement external tools.
Always run:
Run conditionally based on changed file types:
| Condition | Skill to invoke |
|---|---|
| Python files changed | impl-standards (error handling, constants, logging) |
| 500+ lines changed | code-clone-assistant (duplicate code detection) |
| Plugin/hook files changed | plugin-validator (structure, silent failures) |
| Markdown/docs changed | link-validation (broken links, path policy) |
These checks require understanding intent, domain correctness, and architectural fitness. Go through each one manually.
Check 1: Architecture Boundaries
Check 2: Domain Correctness
Check 3: Test Quality
Check 4: Dependency Transparency
Check 5: Performance
Check 6: Error Message Quality
Check 7: Example Accuracy
**kwargs or **_?For detailed check procedures, see Judgment Checks Reference.
Phase 1 (Tools):
- [ ] Pyright strict passes on changed files (no type errors)
- [ ] Vulture finds no unused code in new files (or allowlisted)
- [ ] import-linter passes (no architecture boundary violations)
- [ ] deptry passes (no unused/missing dependencies)
- [ ] Semgrep custom rules pass (no non-determinism, no silent param absorption)
- [ ] Griffe shows no unintended API breaking changes vs base branch
Phase 2 (cc-skills):
- [ ] code-hardcode-audit passes (no magic numbers or secrets)
- [ ] dead-code-detector passes (no unused code)
- [ ] PR description links valid (pr-gfm-validator)
Phase 3 (Judgment):
- [ ] No new cross-boundary coupling introduced
- [ ] Domain constants and formulas are mathematically correct
- [ ] Tests actually test what they claim (not side effects)
- [ ] Implicit dependencies between components are documented
- [ ] No O(n^2) where O(n) suffices
- [ ] Error messages give actionable guidance
- [ ] Examples reflect actual behavior, not aspirational behavior
This skill is built on a taxonomy of 9 integration boundary anti-patterns. For the full catalog with examples, detection heuristics, and fix approaches, see Anti-Pattern Catalog.
---|---|---
1 | Interface contract violation | Pyright + Griffe + manual trace
2 | Misleading examples | Semgrep + manual config-to-code comparison
3 | Architecture boundary violation | import-linter + manual review
4 | Incorrect domain constants | Semgrep + domain expertise
5 | Testing gaps | mutmut + manual test audit
6 | Non-determinism | Semgrep custom rules
7 | YAGNI | Vulture + dead-code-detector
8 | Hidden dependencies | Manual dependency trace
9 | Performance anti-patterns | Manual complexity analysis
After modifying THIS skill:
references/ links resolve correctlyreferences/evolution-log.mdAfter this skill completes, reflect before closing the task:
Do NOT defer. The next invocation inherits whatever you leave behind.
| Issue | Cause | Solution |
|---|---|---|
| Tool not found | External tool not installed | Install per tool-install-guide.md or skip (graceful degradation) |
| Too many Vulture false positives | Framework entry points look unused | Create allowlist: vulture --make-whitelist > whitelist.py |
| Semgrep too slow | Large codebase scan | Scope to changed files only: semgrep --include=<changed> |
| import-linter has no contracts | Project not configured | Add [importlinter] section to pyproject.toml |
| Griffe reports false breaking changes | Intentional API change |
For detailed information, see:
Weekly Installs
56
Repository
GitHub Stars
28
First Seen
Feb 13, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykPass
Installed on
opencode54
github-copilot53
codex53
kimi-cli53
gemini-cli53
amp53
GitHub Actions 官方文档查询助手 - 精准解答 CI/CD 工作流问题
49,000 周安装
Cloudflare MCP Server 教程:在Cloudflare Workers上构建远程模型上下文协议服务器
328 周安装
Google Gemini 文件搜索设置教程 - 完全托管RAG系统,支持100+格式,集成最佳实践
328 周安装
OpenClaw Token 优化器:管理上下文、提升AI助手性能的完整指南
328 周安装
Seaborn 统计可视化库教程:Python 数据可视化与多变量分析指南
336 周安装
AI研究查询工具 - 实时学术文献、技术文档与统计数据查找,智能模型选择
334 周安装
AI电影剧本创作器 - 专业剧本生成与角色一致性工具,助力AI视频制作
333 周安装
brew install semgrep| Griffe | Breaking API changes, signature drift vs base branch | pip install griffe |
Use griffe check --against main --allow-breaking |
| Phase 3 finds nothing but reviewer finds issues | New anti-pattern category | Add to catalog and evolution-log.md |
| cc-skill not triggering | Skill not installed in marketplace | Verify with /plugin list |