Token导航 LogoToken导航

Agent Skill · 研究检索

audit-plan(审计计划)

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

audit-plan 是研究检索类 Agent Skill,可用宿主为 Codex、Claude、Cursor、Gemini CLI,通过GitHub 仓库获取,权限为需要联网;许可证信息还不明确,第三方扫描已通过,按安装量在研究检索类的 73,675 个 Skill 里排第 51,954。

总安装 569周安装 23GitHub Stars 44下载 178核验 2026-05-01

安装说明

本站只整理中文说明,不托管安装包,也不代用户安装。
GitHub
许可证
unknown

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:audit-plan(审计计划)
来源仓库:https://github.com/darraghh1/my-claude-setup
仓库路径:skills/audit-plan
安装命令:
npx skills add https://github.com/darraghh1/my-claude-setup --skill audit-plan
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/darraghh1/my-claude-setup --skill audit-plan

这个 Skill 是做什么的

研究检索类 Skill 主要解决「找资料、核对事实、把来源整理清楚」的问题,通常会让助手先检索再总结。

对多阶段实施方案进行结构性流程审计,评估各阶段是否连贯构成合理 pipeline。聚焦设计意图与计划结构的一致性,而非模板合规性,适合在 per-phase review 之前使用。解析用户提供的路径参数(如 plans/detector-refactor),无需重复询问目标文件夹位置。

安装方式:通过 npx skills add 命令从指定 GitHub 仓库添加,支持 Codex、Claude、Cursor 等宿主环境。输出包含连接性评估和潜在断裂点分析,帮助优化实施顺序和依赖关系管理。

来源仓库内路径:skills/audit-plan

上手步骤

4 步
  1. 1

    确认自己的宿主工具

    公开资料标注支持 Codex、Claude、Cursor、Gemini CLI;先确认自己用的是其中之一,再按对应工具的 Skills 目录放置。

  2. 2

    拿到安装命令

    可以直接复制的命令是 npx skills add https://github.com/darraghh1/my-claude-setup --skill audit-plan;命令里的占位符换成自己的路径或密钥再执行。

  3. 3

    安装后重启宿主

    命令执行完要完全退出宿主工具再打开,让新装的 Skill 被重新扫描到,否则列表里可能看不到。

  4. 4

    按最小权限试用

    它需要需要联网,先在测试目录或测试账号里跑,确认没问题再放到正式项目。

常见问题

6 条

audit-plan 怎么安装?

在终端执行 npx skills add https://github.com/darraghh1/my-claude-setup --skill audit-plan。装完完全退出宿主工具再打开,让它重新扫描本地 Skill。

audit-plan 支持哪些 AI 工具?

公开资料标注支持 Codex、Claude、Cursor、Gemini CLI。其他工具只要能读取本地 Skill 目录,一般也能手动放进去,但要自己确认触发方式是否一致。

audit-plan 需要什么权限?

权限级别是需要联网。该 Skill 可能需要联网访问来源站点、仓库或外部 API;具体网络访问范围需要结合源码和 README 复核。

audit-plan 是免费的吗?

公开资料没有标注明确许可证,收费和商用限制都无法确认。正式使用前请到来源仓库核对授权说明。

audit-plan 用的人多吗?

公开数据是累计安装 569 次,近一周安装 23 次,下载 178 次,GitHub 44 星。这些数字来自第三方目录统计,只能当作热度参考,不代表质量或安全性。

audit-plan 安全吗?

第三方扫描结果为通过,但这只覆盖已知的静态检查项,不能替代自己读一遍源码和安装命令。

值得选的地方和要先想清楚的地方

值得选的地方

  • 同时适配 4 种工具,换客户端不用重新找替代品。
  • 第三方扫描已通过,常见的高风险行为没有命中。

先想清楚的地方

  • 许可证没有明确标注,能不能商用、能不能再分发都不确定。
  • 第三方目录整理,版本更新和行为细节以来源仓库为准。

适不适合你

更适合

  • 已经在用 Codex,想直接扩展它能力的人。
  • 需要处理研究检索类任务、又不想每次都手写提示词的人。

不太适合

  • 需要明确授权才能用到公司项目里的场景。
  • 需要厂商级技术支持和 SLA 的生产系统。

研究检索类 Skill 对比

6 个同类
Skill总安装GitHub 星权限许可证扫描
find-skills

寻找技能 · Codex、Claude

31,199,81316,486操作浏览器MIT有提醒
self-improving-agent

自我改进 Agent · OpenClaw

16,464,0023,396接触敏感数据MIT-0通过
soultrace

灵魂追踪 · Codex、Claude

7,588,94412需要联网未明确有提醒
self-improving

自我完善 · OpenClaw

6,829,2841,046需要联网MIT-0通过
microsoft-foundry

微软代工厂 · Codex、Claude

6,614,144764调用外部服务未明确有提醒
audit-plan

审计计划 · 本页

56944需要联网未明确通过

按安装量取同分类前几名;数字来自第三方目录统计,只作热度参考,不代表质量结论。

SKILL.md 原文

Plan Flow Audit

YOUR ARGUMENTS: $ARGUMENTS

Arguments are provided above via $ARGUMENTS. Parse them to determine the plan folder path (e.g., plans/detector-refactor). Do NOT ask the user to re-provide the path.

This skill performs a structural flow audit of a multi-phase implementation plan. It assesses whether phases connect coherently as a pipeline — NOT whether individual phases comply with templates (that's /review-plan's job).

Positioning: This audit runs BEFORE per-phase reviews. Phases have NOT been reviewed or polished yet. Focus on intended design vs. planned structure, not on template completeness or placeholder content.

Critical

  • Do NOT modify plan files, phase files, or codebase files — this skill only writes the audit report
  • Read ALL phase files, not just a sample — the value of this audit is completeness
  • Ground findings in actual codebase files, not just plan documents
  • When you claim a phase targets a file that doesn't exist, verify with Glob first
  • Distinguish between intentional design choices and actual discrepancies
  • Tolerate rough edges — phases may have incomplete sections, placeholder content, or imperfect formatting. That's /review-plan's job to fix. You're checking whether the PLAN DESIGN is sound.

Task Tracking

Tasks survive context compacts — skipping this check causes lost progress and repeated work.

Before starting work, run TaskList to check if tasks already exist from a previous session or before a compact. If tasks exist:

  1. Read existing tasks with TaskGet for each task ID
  2. Find the first task with status pending or in_progress
  3. Resume from that task — do NOT recreate the task list

If no tasks exist, create them after reading the master plan (Step 1):

Example task list:

Task 1: Read the master plan
Task 2: Read all phase files and extract metadata
Task 3: Build dependency graph + bail-out check
Task 4: Assess data flow consistency
Task 5: Evaluate phase ordering
Task 6: Identify stale artifacts
Task 7: Assess risk for pending phases
Task 8: Write audit report
Task 9: Return summary

Mark each task in_progress when starting and completed when done.

Why This Audit Exists

/review-plan checks individual files for template compliance and codebase patterns. This audit checks the connections between them — structural design issues that only appear at the whole-plan level.

This runs FIRST (before /review-plan) because structural issues invalidate all per-phase review work. No point polishing Phase 5's code blocks if Phase 5 depends on a table that Phase 3 doesn't actually create.

ProblemHow It ManifestsCost If Missed
Circular dependenciesPhase A waits for B, B waits for A — deadlockImplementation stalls, requires plan restructuring
Missing dependenciesPhase 5 uses a table from Phase 3 but doesn't declare itPhase 5 fails at runtime, debugging time wasted
Wrong orderingConsumer phase runs before its data producerCode compiles but crashes, phase must be re-sequenced
Stale artifactsplan.md says "Done" but phase file says "Pending"/implement picks the wrong next phase
Incoherent data flowPhases disagree on table names, patterns, or sourcesEvery downstream phase builds on wrong assumptions

The audit report feeds into /implement — it checks the flow audit verdict before building. A structural audit catches design problems that per-phase reviews cannot see.

Output Location

The flow audit report goes in the reviews/planning/ subfolder alongside per-phase reviews:

Write to: {plan-folder}/reviews/planning/flow-audit.md

Examples:

  • plans/250202-voice-assistant/reviews/planning/flow-audit.md
  • plans/250202-api-refactor/reviews/planning/flow-audit.md

Create the reviews/planning/ directory if it doesn't exist.

Note: Per-phase template/codebase reviews go in the same folder — see /review-plan. Code/implementation reviews go in reviews/code/ — see /code-review.

Step 1: Read the Master Plan

Read {plan-folder}/plan.md completely. Extract:

  1. Phase table — all phases with titles, status, and any noted issues
  2. ADRs / Decision Log — decisions that constrain phase design
  3. Critical Issues section — known problems already documented
  4. Architectural North Star — patterns all phases must follow

Note any phases marked as deprecated, renumbered, or amended.

Step 2: Read All Phase Files

Use Glob to find all phase files: {plan-folder}/phase-*.md

For EACH phase file, extract from the frontmatter and overview:

FieldWhere to Find
Phase numberFilename phase-NN-*
TitleFrontmatter title:
StatusFrontmatter status:
DependenciesFrontmatter dependencies:
What it producesOverview section
What it consumes"How This Phase Fits" or "Prerequisites" sections
Key files it targetsImplementation steps (file paths mentioned)

Build a mental model of the full dependency graph as you read.

Placeholder Check (Informational Only)

Run the placeholder validator to note which phases still have skeleton content:

echo '{"cwd":"."}' | uv run $CLAUDE_PROJECT_DIR/.claude/hooks/validators/validate_no_placeholders.py \
  --directory {plan-folder} --extension .md

This is NOT a blocker. Since this audit runs before /review-plan, phases may still contain [To be detailed], TBD, or skeleton markers. Note these in the report for awareness, but do NOT fail the audit because of them. Reviewers will clean them up. Only flag placeholders in critical structural sections (dependencies, data flow descriptions) as a concern.

Step 3: Build Dependency Graph + Bail-Out Check

From the data collected in Step 2, construct the full dependency graph.

For each phase, document:

  • Declared dependencies (from frontmatter dependencies: field)
  • Implicit dependencies (phase references data/files/services created by another phase but doesn't declare it)
  • What downstream phases depend on it

Check for:

Issue TypeHow to Detect
Circular dependenciesPhase A depends on B, B depends on A (directly or transitively)
Missing dependenciesPhase X uses output from Phase Y but doesn't list Y in dependencies
Unnecessary dependenciesPhase X lists Phase Y but doesn't actually use any of Y's output
Orphaned phasesPhase exists but no other phase depends on it AND it doesn't depend on anything
Dependency on deprecated phaseA phase depends on a phase marked status: deprecated

Bail-Out Assessment

After building the dependency graph, evaluate whether the plan is fundamentally broken. If ANY of these conditions are true, STOP the audit immediately — write a short report with assessment "Unusable" and return:

Bail-Out ConditionWhy It's Fatal
Circular dependencies existCannot be resolved by review — requires plan restructuring
>50% of phases have missing/wrong dependenciesDependency graph is unreliable — plan needs redesign
No coherent execution order existsPhases cannot be sequenced — plan is incoherent
Plan has no discernible architecturePhases are disconnected fragments, not a pipeline

If the plan is bail-out level broken: Skip Steps 4-7. Write a minimal report (Step 8) with:

  • Overall Assessment: Unusable — Needs Restructuring
  • The specific bail-out condition(s) detected
  • A brief recommendation for what needs to change
  • Return immediately (Step 9)

This saves the user from waiting through a full audit of a plan that needs to be thrown out and rewritten.

Step 4: Assess Data Flow Consistency

Trace how data flows through the plan pipeline. For plans involving data transformations (API -> storage -> consumption), check:

  1. Source consistency — Do all phases agree on where data comes from?
  2. Schema consistency — Do phases that share data structures use the same types/interfaces?
  3. Pattern consistency — Is there one architectural pattern or do different phases use contradictory approaches?

- Example: Some phases have components query the database directly while others expect data passed via context/props

  1. Table/entity naming — Do all phases reference the same table names consistently?
  2. File path consistency — Do phases reference files that actually exist at those paths?

Verify against codebase: For key files referenced by "Done" phases, use Glob to check they exist. For critical claims (e.g., "Phase 11 updated the orchestrator to load summary data"), read the actual file to confirm.

Step 5: Evaluate Phase Ordering

Assess whether the current phase sequence makes logical sense:

  1. Infrastructure before consumers — Are foundational phases (schemas, services, APIs) ordered before phases that use them?
  2. Producers before consumers — Does the phase that creates data run before phases that read it?
  3. Refactoring order — For refactoring plans, is the new system built before the old system is deprecated/removed?
  4. Test timing — Are testing phases positioned to test code that already exists?
  5. Cleanup last — Are deprecation, migration, and drop phases at the end?

Flag ordering issues like:

  • A consumer phase runs before its data producer
  • A centralized service is created AFTER the things that should use it
  • Tests are written before the code they test exists
  • Cleanup runs before all references are migrated

Step 6: Identify Stale Artifacts

Check for:

ArtifactHow to Find
Deprecated phase filesstatus: deprecated in frontmatter but file still exists
Duplicate phase numbersMultiple files with same phase-NN- prefix
Broken inter-phase links[[phase-XX]] or [Phase XX](./phase-XX-*) links that point to non-existent files
Renumbered but not updatedPhase file title says "Phase 17" but filename says phase-18-*
Phase table mismatchesplan.md phase table lists a phase title/file that doesn't match the actual file
Stale statusplan.md says "Done" but phase file says "Pending" (or vice versa)

Step 7: Assess Risk for Pending Phases

For each pending phase, evaluate risk based on:

Risk FactorHigh RiskLow Risk
DependenciesDepends on phases with known issuesDependencies are clean and verified
File targetsReferences files that don't exist or are uncertainTargets well-known, stable files
ScopeTouches many files across many directoriesFocused on 1-2 files
Pattern clarityIntroduces new patterns not seen in codebaseFollows established patterns from earlier phases or codebase
BlockingMany downstream phases depend on itFew or no downstream dependencies

Step 8: Write Audit Report

Write the report to: {plan-folder}/reviews/planning/flow-audit.md

Create the reviews/planning/ directory if it doesn't exist.

If the report already exists (re-auditing after fixes), Read the existing file first — the Write tool silently fails on existing files without a prior Read. A re-audit should fully overwrite the previous report since the value is a fresh holistic view, not incremental updates.

Report Structure

# Flow Audit: {Plan Title}

**Audited:** {date}
**Phases reviewed:** {count} ({done count} Done, {pending count} Pending, {deprecated count} Deprecated)
**Overall Assessment:** {Coherent | Minor Issues | Significant Issues | Major Restructuring Needed | Unusable}

---

## 1. Dependency Graph

{Visual or textual representation. Use indentation to show dependency chains.}

### Dependency Issues

| #   | Issue | Phases Affected | Severity | Suggested Fix |
| --- | ----- | --------------- | -------- | ------------- |
| 1   | ...   | P05, P12        | High     | ...           |

---

## 2. Data Flow Analysis

### Architecture Pattern(s)

{Describe the data flow pattern(s) used across the plan}

### Inconsistencies

| #   | Issue | Phases Affected | Details |
| --- | ----- | --------------- | ------- |
| 1   | ...   | ...             | ...     |

---

## 3. Phase Ordering Assessment

### Current Order

{List phases in order with one-line description}

### Ordering Issues

| #   | Issue | Current Order | Suggested Order | Rationale                                       |
| --- | ----- | ------------- | --------------- | ----------------------------------------------- |
| 1   | ...   | P12 after P11 | P12 before P11  | Loader should exist before orchestrator uses it |

---

## 4. Stale Artifacts

| #   | Artifact | Type            | Location                      | Action Needed     |
| --- | -------- | --------------- | ----------------------------- | ----------------- |
| 1   | ...      | Deprecated file | phase-17-unit-tests-update.md | Delete or archive |

---

## 5. Risk Assessment (Pending Phases)

| Phase | Risk   | Key Risk Factors                                   | Recommendation                    |
| ----- | ------ | -------------------------------------------------- | --------------------------------- |
| P12   | High   | Depends on P11 which may have ordering issues      | Review dependency direction       |
| P14   | Medium | Modifies Edge Function with complex existing logic | Read function before implementing |

---

## 6. Recommendations (Priority Order)

1. **[Critical]** {Description} — Fix before continuing implementation
2. **[High]** {Description} — Fix before implementing affected phases
3. **[Medium]** {Description} — Fix for plan hygiene
4. **[Low]** {Description} — Nice to have

Step 9: Return Summary

After writing the report, return to the main agent:

  1. Report location — file path
  2. Overall assessment — one-line verdict
  3. Critical/High issues count — how many need attention before implementation continues
  4. Top 3 findings — the most impactful discoveries
  5. Recommendation — whether to proceed, fix first, or restructure
  6. Context hygiene: "Consider running /compact before starting the next workflow step."

Resuming After Context Compact

If you notice context was compacted or you're unsure of current progress:

  1. Run TaskList to see all tasks and their status
  2. Find the in_progress task — that's where you were
  3. Run TaskGet {id} on that task to read full details
  4. Continue from that task — don't restart from the beginning

Tasks persist across compacts. The task list is your source of truth for progress, not your memory.

Pattern for every work session:

TaskList → find in_progress or first pending → TaskGet → continue work → TaskUpdate (completed) → next task

Constraints

  • Source files are read-only — do NOT modify plan files, phase files, or codebase files. The only file you write is the audit report at {plan-folder}/reviews/planning/flow-audit.md
  • All phases — read every phase file, not just a sample
  • Codebase grounding — verify that key files referenced in phases actually exist at those paths. Use Glob to spot-check
  • No template checking — that's /review-plan's job. Focus on structural design, not format or polish
  • Tolerate rough edges — phases have NOT been reviewed yet. Placeholder content, incomplete sections, and formatting issues are expected. Only flag these if they obscure structural intent (e.g., dependencies section is entirely TBD)
  • Severity calibration — only mark issues as Critical if they would cause implementation failure (circular deps, fundamentally wrong ordering). Use High for likely problems, Medium for structural concerns, Low for suggestions
  • Bail-out early — if the plan is fundamentally broken (Step 3), stop and say so. Don't spend tokens auditing an unusable plan
  • Pipeline awareness — this audit runs BEFORE /review-plan. Your verdict determines whether per-phase reviews proceed or the plan gets sent back to the planner

Troubleshooting

Too Many Phase Files

Symptom: Plan has 30+ phases and reading all of them is slow.

Fix: Read frontmatter + overview section only (first 60 lines) for initial pass. Deep-read only phases flagged as problematic during the dependency/flow analysis.

Plan Has No Dependency Metadata

Symptom: Phase files don't have dependencies: in frontmatter.

Fix: Infer dependencies from content — look for "requires Phase X", "uses table from Phase Y", "after Phase Z is complete" in the overview and prerequisites sections. Flag the missing metadata as a stale artifact.

Phases Have Lots of Placeholders

Symptom: Many phases have [To be detailed] or TBD in their content.

Fix: This is expected — the audit runs before reviews clean these up. Only flag placeholders if they appear in structural sections (dependencies, data flow, key file paths) where you can't assess the design without them. Note the count in the report for the reviewers' benefit.

平台分布

Claude

33.04%
按下载量换算59

Codex

31.82%
按下载量换算57

Cursor

17.58%
按下载量换算31

Gemini CLI

9.05%
按下载量换算16

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

需要联网

该 Skill 可能需要联网访问来源站点、仓库或外部 API;具体网络访问范围需要结合源码和 README 复核。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。目前只有一个公开来源,建议同时核对源仓库。

继续浏览同类 Skills