ln-620-codebase-auditor by levnikolaevich/claude-code-skills
npx skills add https://github.com/levnikolaevich/claude-code-skills --skill ln-620-codebase-auditorPaths: 文件路径(
shared/、references/、../ln-*)是相对于技能仓库根目录的。如果在当前工作目录下找不到,请定位此 SKILL.md 文件所在的目录,然后向上返回一级以找到仓库根目录。如果缺少shared/目录,请通过 WebFetch 从https://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}获取文件。
协调 9 个专门的审计工作器,执行全面的代码库质量分析。
docs/project/codebase_audit.md(基于文件,不创建任务)广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
docs/project/codebase_audit.md加载项目元数据:
docs/project/tech_stack.md - 检测技术栈以供研究docs/principles.md - 项目特定的质量原则package.json、requirements.txt、go.mod、Cargo.tomldocs/tasks/kanban_board.md 自动发现团队 IDindex_project 并在 contextStore 中设置 graph_indexed: true。对于其他语言,继续执行而不使用图加速。仅提取元数据(非完整代码库扫描):
根据 tech_stack 元数据确定项目类型,并跳过不适用的工作器。
项目类型检测:
| 项目类型 | 检测方法 | 跳过的工作器 |
|---|---|---|
| CLI 工具 | 无 Web 框架,有 CLI 框架(Typer/Click/Commander/cobra 等) | ln-627(健康检查),ln-629(优雅关闭) |
| 库/SDK | 无入口点,仅导出 | ln-627,ln-629 |
| 脚本/Lambda | 单一入口,<500 行代码 | ln-627,ln-628(并发),ln-629 |
| Web 服务 | 有 Web 框架(Express/FastAPI/ASP.NET/Spring 等) | 无 — 全部适用 |
| 工作器/队列 | 有队列框架(Bull/Celery 等) | 无 |
算法:
project_type = detect_from_tech_stack(tech_stack, package_manifests)
skipped_workers = APPLICABILITY_TABLE[project_type].skip
applicable_workers = ALL_WORKERS - skipped_workers
FOR EACH skipped IN skipped_workers:
skipped.score = "N/A"
skipped.reason = "Not applicable for {project_type} projects"
被跳过的工作器不被委托。它们在报告中得分为 "N/A",并排除在总体分数计算之外。
针对阶段 1 中识别的每个主要依赖项:
mcp__Ref__ref_search_documentation 查询当前最佳实践mcp__context7__get-library-docs 获取最新的库文档| 类型 | 研究重点 |
|---|---|
| Web 框架 | 异步模式、中间件、错误处理、请求生命周期 |
| ML/AI 库 | 推理优化、内存管理、批处理 |
| 数据库 | 连接池、事务、查询优化 |
| 容器化 | 多阶段构建、安全性、层缓存 |
| 语言运行时 | 惯用法、性能模式、内存管理 |
构建 contextStore:
{
"tech_stack": {...},
"best_practices": {...},
"principles": {...},
"codebase_root": "...",
"output_dir": "docs/project/.audit/ln-620/{YYYY-MM-DD}"
}
必读: 加载 shared/references/audit_coordinator_domain_mode.md。
使用共享模式检测 domain_mode 和 all_domains。此协调器遵循一条本地规则:共享文件夹会被审计,但单独分组,以免扭曲每个领域的分数。
必读: 加载 shared/references/task_delegation_pattern.md 和 shared/references/audit_worker_core_contract.md。
在委托之前创建 {output_dir}。工作器文件在汇总后会被清理(见阶段 9)。
全局工作器扫描整个代码库(非领域感知)。每个工作器将报告写入 {output_dir}/。
---|---|---|---|---
1 | ln-621-security-auditor | CRITICAL | 硬编码密钥、SQL 注入、XSS、不安全的依赖项 | 621-security.md
2 | ln-622-build-auditor | CRITICAL | 编译器/linter 错误、弃用项、类型错误 | 622-build.md
5 | ln-625-dependencies-auditor | MEDIUM | 过时的包、未使用的依赖项、自定义实现 | 625-dependencies.md
6 | ln-626-dead-code-auditor | LOW | 死代码、未使用的导入/变量、注释掉的代码 | 626-dead-code.md
7 | ln-627-observability-auditor | MEDIUM | 结构化日志、健康检查、指标、追踪 | 627-observability.md
8 | ln-628-concurrency-auditor | HIGH | 异步竞争、线程安全、TOCTOU、死锁、阻塞 I/O、争用、跨进程竞争 | 628-concurrency.md
9 | ln-629-lifecycle-auditor | MEDIUM | 引导、优雅关闭、资源清理 | 629-lifecycle.md
调用(根据阶段 2 的适用性门控进行过滤):
FOR EACH worker IN applicable_workers:
Agent(description: "Codebase audit via " + worker,
prompt: "Execute audit worker.
Step 1: Invoke worker:
Skill(skill: \"" + worker + "\")
CONTEXT:
" + JSON.stringify(contextStore),
subagent_type: "general-purpose")
领域感知工作器每个领域运行一次。每个工作器写入带领域后缀的报告。
---|---|---|---|---
3 | ln-623-code-principles-auditor | HIGH | DRY/KISS/YAGNI 违规、TODO/FIXME、错误处理、依赖注入 | 623-principles-{domain}.md
4 | ln-624-code-quality-auditor | MEDIUM | 圈复杂度、O(n²)、N+1 查询、魔法数字 | 624-quality-{domain}.md
调用:
IF domain_mode == "domain-aware":
FOR EACH domain IN all_domains:
FOR EACH worker IN [ln-623, ln-624]:
domain_context = {
...contextStore,
domain_mode: "domain-aware",
current_domain: { name: domain.name, path: domain.path }
}
Agent(description: "Audit " + domain.name + " via " + worker,
prompt: "Execute audit worker.
Step 1: Invoke worker:
Skill(skill: \"" + worker + "\")
CONTEXT:
" + JSON.stringify(domain_context),
subagent_type: "general-purpose")
ELSE:
FOR EACH worker IN [ln-623, ln-624]:
Agent(description: "Codebase audit via " + worker,
prompt: "Execute audit worker.
Step 1: Invoke worker:
Skill(skill: \"" + worker + "\")
CONTEXT:
" + JSON.stringify(contextStore),
subagent_type: "general-purpose")
所有调用都在单条消息中完成,以实现最大并行度。
必读: 加载 shared/references/audit_coordinator_aggregation.md。
使用共享的汇总模式来处理输出目录检查、返回值解析、类别分数表、严重性总计和领域健康摘要。
仅读取 ln-623 报告文件以提取 FINDINGS-EXTENDED JSON 块:
principle_files = Glob("{output_dir}/623-principles-*.md")
FOR EACH file IN principle_files:
Read file → extract <!-- FINDINGS-EXTENDED [...] --> JSON
Filter findings with pattern_signature field
Group by pattern_signature across domains:
IF same signature in 2+ domains → create Cross-Domain DRY finding:
severity: HIGH
principle: "Cross-Domain DRY Violation"
list all affected domains and locations
recommendation: "Extract to shared/ module"
读取每个工作器报告文件,并将发现结果表复制到最终报告的相应部分:
FOR EACH report_file IN Glob("{output_dir}/6*.md"):
Read file → extract "## Findings" table rows
Insert into matching category section in final report
全局类别(安全性、构建等)→ 每个类别一个发现结果表。领域感知类别 → 每个领域一个子表(每个文件一个)。
必读: 加载 shared/references/context_validation.md
对已组装的发现结果应用规则 1-5。使用上下文中已有的数据:
ADR 列表(阶段 1 从 docs/reference/adrs/ 或 docs/decisions/ 加载)
tech_stack 元数据(阶段 1)
工作器报告文件(已在步骤 6.2 中读取)
FOR EACH finding IN assembled_findings WHERE severity IN (HIGH, MEDIUM):
IF finding matches ADR title/description → advisory "[Planned: ADR-XXX]"
IF DRY finding AND duplicated_lines < 5 → remove finding
IF size-based finding: Read flagged file ONCE, check 4 cohesion indicators IF cohesion >= 3 → advisory "[High cohesion module]"
IF dependency finding: cross-check ln-622 audit output IF latest + 0 CVEs → remove finding
IF DRY/schema finding: Grep import count IF import_count == 1 → advisory "[Single consumer, locality correct]" IF import_count <= 3 with different API contracts → advisory "[API contract isolation]"
Downgraded findings → "Advisory Findings" section in report. Recalculate category scores excluding advisory findings from penalty.
豁免: 安全性(ln-621)、N+1 查询、CRITICAL 构建错误、并发性(ln-628)。
必读: 加载 shared/templates/codebase_audit_template.md 以获取报告格式。
使用模板将汇总报告写入 docs/project/codebase_audit.md。用汇总的工作器数据填充所有部分,包括来自上下文验证的咨询性发现。覆盖之前的报告(每次审计都是完整快照)。
必读: 加载 shared/references/results_log_pattern.md
向 docs/project/.audit/results_log.md 追加一行,包含:Skill=ln-620、Metric=overall_score、Scale=0-10、来自阶段 7 报告的分数。计算与之前 ln-620 行的差值。如果文件缺失,则创建带标题的文件。滚动窗口:最多 50 条条目。
rm -rf {output_dir}
删除带日期的输出目录(docs/project/.audit/ln-620/{YYYY-MM-DD}/)。汇总报告和结果日志已保存所有审计数据。
docs/project/.audit/ln-620/{YYYY-MM-DD}/ 目录{output_dir}/{output_dir}/docs/project/codebase_audit.md,包含咨询性发现部分工作器 SKILL.md 文件包含详细的审计规则:
必读: 加载 shared/references/meta_analysis_protocol.md
技能类型:review-coordinator(仅限工作器)。在所有阶段完成后运行。使用 review-coordinator — workers only 格式输出到聊天。
shared/references/orchestrator_pattern.mdshared/references/task_delegation_pattern.mdshared/references/audit_coordinator_domain_mode.mdshared/references/audit_coordinator_aggregation.mdshared/templates/codebase_audit_template.mddocs/principles.mddocs/project/tech_stack.mddocs/tasks/kanban_board.mdshared/references/research_tool_fallback.md版本: 5.0.0 最后更新: 2025-12-23
每周安装
176
仓库
GitHub 星标
245
首次出现
Jan 24, 2026
安全审计
安装于
claude-code159
gemini-cli156
codex156
cursor156
opencode155
github-copilot151
Paths: File paths (
shared/,references/,../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root. Ifshared/is missing, fetch files via WebFetch fromhttps://raw.githubusercontent.com/levnikolaevich/claude-code-skills/master/skills/{path}.
Coordinates 9 specialized audit workers to perform comprehensive codebase quality analysis.
docs/project/codebase_audit.md (file-based, no task creation)docs/project/codebase_audit.mdLoad project metadata:
docs/project/tech_stack.md - detect tech stack for researchdocs/principles.md - project-specific quality principlespackage.json, requirements.txt, go.mod, Cargo.tomldocs/tasks/kanban_board.mdindex_project and set graph_indexed: true in contextStore. For other languages, continue without graph acceleration.Extract metadata only (not full codebase scan):
Determine project type from tech_stack metadata and skip inapplicable workers.
Project type detection:
| Project Type | Detection | Skip Workers |
|---|---|---|
| CLI tool | No web framework, has CLI framework (Typer/Click/Commander/cobra/etc.) | ln-627 (health checks), ln-629 (graceful shutdown) |
| Library/SDK | No entry point, only exports | ln-627, ln-629 |
| Script/Lambda | Single entry, <500 LOC | ln-627, ln-628 (concurrency), ln-629 |
| Web Service | Has web framework (Express/FastAPI/ASP.NET/Spring/etc.) | None — all applicable |
| Worker/Queue | Has queue framework (Bull/Celery/etc.) | None |
Algorithm:
project_type = detect_from_tech_stack(tech_stack, package_manifests)
skipped_workers = APPLICABILITY_TABLE[project_type].skip
applicable_workers = ALL_WORKERS - skipped_workers
FOR EACH skipped IN skipped_workers:
skipped.score = "N/A"
skipped.reason = "Not applicable for {project_type} projects"
Skipped workers are NOT delegated. They get score "N/A" in report and are excluded from overall score calculation.
For each major dependency identified in Phase 1:
mcp__Ref__ref_search_documentation for current best practicesmcp__context7__get-library-docs for up-to-date library documentation| Type | Research Focus |
|---|---|
| Web Framework | Async patterns, middleware, error handling, request lifecycle |
| ML/AI Libraries | Inference optimization, memory management, batching |
| Database | Connection pooling, transactions, query optimization |
| Containerization | Multi-stage builds, security, layer caching |
| Language Runtime | Idioms, performance patterns, memory management |
Build contextStore:
{
"tech_stack": {...},
"best_practices": {...},
"principles": {...},
"codebase_root": "...",
"output_dir": "docs/project/.audit/ln-620/{YYYY-MM-DD}"
}
MANDATORY READ: Load shared/references/audit_coordinator_domain_mode.md.
Detect domain_mode and all_domains using the shared pattern. This coordinator keeps one local rule: shared folders are audited, but grouped separately so they do not distort per-domain scores.
MANDATORY READ: Load shared/references/task_delegation_pattern.md and shared/references/audit_worker_core_contract.md.
Create {output_dir} before delegation. Worker files are cleaned up after consolidation (see Phase 9).
Global workers scan entire codebase (not domain-aware). Each writes report to {output_dir}/.
---|---|---|---|---
1 | ln-621-security-auditor | CRITICAL | Hardcoded secrets, SQL injection, XSS, insecure deps | 621-security.md
2 | ln-622-build-auditor | CRITICAL | Compiler/linter errors, deprecations, type errors | 622-build.md
5 | ln-625-dependencies-auditor | MEDIUM | Outdated packages, unused deps, custom implementations | 625-dependencies.md
6 | ln-626-dead-code-auditor | LOW | Dead code, unused imports/variables, commented-out code | 626-dead-code.md
7 | ln-627-observability-auditor | MEDIUM | Structured logging, health checks, metrics, tracing | 627-observability.md
8 | ln-628-concurrency-auditor | HIGH | Async races, thread safety, TOCTOU, deadlocks, blocking I/O, contention, cross-process races | 628-concurrency.md
9 | ln-629-lifecycle-auditor | MEDIUM | Bootstrap, graceful shutdown, resource cleanup | 629-lifecycle.md
Invocation (filter by Phase 2 applicability gate):
FOR EACH worker IN applicable_workers:
Agent(description: "Codebase audit via " + worker,
prompt: "Execute audit worker.
Step 1: Invoke worker:
Skill(skill: \"" + worker + "\")
CONTEXT:
" + JSON.stringify(contextStore),
subagent_type: "general-purpose")
Domain-aware workers run once per domain. Each writes report with domain suffix.
---|---|---|---|---
3 | ln-623-code-principles-auditor | HIGH | DRY/KISS/YAGNI violations, TODO/FIXME, error handling, DI | 623-principles-{domain}.md
4 | ln-624-code-quality-auditor | MEDIUM | Cyclomatic complexity, O(n²), N+1 queries, magic numbers | 624-quality-{domain}.md
Invocation:
IF domain_mode == "domain-aware":
FOR EACH domain IN all_domains:
FOR EACH worker IN [ln-623, ln-624]:
domain_context = {
...contextStore,
domain_mode: "domain-aware",
current_domain: { name: domain.name, path: domain.path }
}
Agent(description: "Audit " + domain.name + " via " + worker,
prompt: "Execute audit worker.
Step 1: Invoke worker:
Skill(skill: \"" + worker + "\")
CONTEXT:
" + JSON.stringify(domain_context),
subagent_type: "general-purpose")
ELSE:
FOR EACH worker IN [ln-623, ln-624]:
Agent(description: "Codebase audit via " + worker,
prompt: "Execute audit worker.
Step 1: Invoke worker:
Skill(skill: \"" + worker + "\")
CONTEXT:
" + JSON.stringify(contextStore),
subagent_type: "general-purpose")
All invocations in single message for maximum parallelism.
MANDATORY READ: Load shared/references/audit_coordinator_aggregation.md.
Use the shared aggregation pattern for output directory checks, return-value parsing, category score tables, severity totals, and domain health summaries.
Read only ln-623 report files to extract FINDINGS-EXTENDED JSON block:
principle_files = Glob("{output_dir}/623-principles-*.md")
FOR EACH file IN principle_files:
Read file → extract <!-- FINDINGS-EXTENDED [...] --> JSON
Filter findings with pattern_signature field
Group by pattern_signature across domains:
IF same signature in 2+ domains → create Cross-Domain DRY finding:
severity: HIGH
principle: "Cross-Domain DRY Violation"
list all affected domains and locations
recommendation: "Extract to shared/ module"
Read each worker report file and copy Findings table into corresponding report section:
FOR EACH report_file IN Glob("{output_dir}/6*.md"):
Read file → extract "## Findings" table rows
Insert into matching category section in final report
Global categories (Security, Build, etc.) → single Findings table per category. Domain-aware categories → subtables per domain (one per file).
MANDATORY READ: Load shared/references/context_validation.md
Apply Rules 1-5 to assembled findings. Uses data already in context:
ADR list (loaded in Phase 1 from docs/reference/adrs/ or docs/decisions/)
tech_stack metadata (Phase 1)
Worker report files (already read in Step 6.2)
FOR EACH finding IN assembled_findings WHERE severity IN (HIGH, MEDIUM):
IF finding matches ADR title/description → advisory "[Planned: ADR-XXX]"
IF DRY finding AND duplicated_lines < 5 → remove finding
IF size-based finding: Read flagged file ONCE, check 4 cohesion indicators IF cohesion >= 3 → advisory "[High cohesion module]"
IF dependency finding: cross-check ln-622 audit output IF latest + 0 CVEs → remove finding
IF DRY/schema finding: Grep import count IF import_count == 1 → advisory "[Single consumer, locality correct]" IF import_count <= 3 with different API contracts → advisory "[API contract isolation]"
Downgraded findings → "Advisory Findings" section in report. Recalculate category scores excluding advisory findings from penalty.
Exempt: Security (ln-621), N+1 queries, CRITICAL build errors, concurrency (ln-628).
MANDATORY READ: Load shared/templates/codebase_audit_template.md for report format.
Write consolidated report to docs/project/codebase_audit.md using template. Fill all sections with aggregated worker data, include Advisory Findings from context validation. Overwrite previous report (each audit is full snapshot).
MANDATORY READ: Load shared/references/results_log_pattern.md
Append one row to docs/project/.audit/results_log.md with: Skill=ln-620, Metric=overall_score, Scale=0-10, Score from Phase 7 report. Calculate Delta vs previous ln-620 row. Create file with header if missing. Rolling window: max 50 entries.
rm -rf {output_dir}
Delete the dated output directory (docs/project/.audit/ln-620/{YYYY-MM-DD}/). The consolidated report and results log already preserve all audit data.
docs/project/.audit/ln-620/{YYYY-MM-DD}/ directory created for worker reports{output_dir}/{output_dir}/docs/project/codebase_audit.md with Advisory Findings sectionWorker SKILL.md files contain the detailed audit rules:
MANDATORY READ: Load shared/references/meta_analysis_protocol.md
Skill type: review-coordinator (workers only). Run after all phases complete. Output to chat using the review-coordinator — workers only format.
shared/references/orchestrator_pattern.mdshared/references/task_delegation_pattern.mdshared/references/audit_coordinator_domain_mode.mdshared/references/audit_coordinator_aggregation.mdshared/templates/codebase_audit_template.mddocs/principles.mddocs/project/tech_stack.mddocs/tasks/kanban_board.mdVersion: 5.0.0 Last Updated: 2025-12-23
Weekly Installs
176
Repository
GitHub Stars
245
First Seen
Jan 24, 2026
Security Audits
Gen Agent Trust HubPassSocketWarnSnykFail
Installed on
claude-code159
gemini-cli156
codex156
cursor156
opencode155
github-copilot151
AI绩效改进计划PIP技能:提升AI任务执行主动性、交付质量与问题解决能力
907 周安装
shared/references/research_tool_fallback.md