Token导航 LogoToken导航

Agent Skill · 研究检索

cache-audit(缓存审计)

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

cache-audit 是研究检索类 Agent Skill,可用宿主为 Codex、Claude、Cursor、Gemini CLI,通过GitHub 仓库获取,权限为执行命令;许可证信息还不明确,第三方扫描已通过,按安装量在研究检索类的 73,675 个 Skill 里排第 55,679。

总安装 470周安装 20GitHub Stars 44下载 165核验 2026-05-01

安装说明

本站只整理中文说明,不托管安装包,也不代用户安装。
GitHub
许可证
unknown

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:cache-audit(缓存审计)
来源仓库:https://github.com/darraghh1/my-claude-setup
仓库路径:skills/cache-audit
安装命令:
npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit

这个 Skill 是做什么的

研究检索类 Skill 主要解决「找资料、核对事实、把来源整理清楚」的问题,通常会让助手先检索再总结。

cache-audit 用于审计 Claude Code 的提示缓存配置,评估是否符合最佳实践。可自动检测系统提示、规则、技能注册等前缀变化对缓存的影响。返回带分数的报告,并按节省 token 量排序修复建议。涉及生产环境时,应先脱敏敏感信息并确认最小权限原则。

适用宿主包括 Codex、Claude、Cursor、Gemini CLI,接入前应确认版本、权限和运行环境要求。

来源仓库内路径:skills/cache-audit

上手步骤

4 步
  1. 1

    确认自己的宿主工具

    公开资料标注支持 Codex、Claude、Cursor、Gemini CLI;先确认自己用的是其中之一,再按对应工具的 Skills 目录放置。

  2. 2

    拿到安装命令

    可以直接复制的命令是 npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit;命令里的占位符换成自己的路径或密钥再执行。

  3. 3

    安装后重启宿主

    命令执行完要完全退出宿主工具再打开,让新装的 Skill 被重新扫描到,否则列表里可能看不到。

  4. 4

    按最小权限试用

    它需要执行命令,先在测试目录或测试账号里跑,确认没问题再放到正式项目。

常见问题

6 条

cache-audit 怎么安装?

在终端执行 npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit。装完完全退出宿主工具再打开,让它重新扫描本地 Skill。

cache-audit 支持哪些 AI 工具?

公开资料标注支持 Codex、Claude、Cursor、Gemini CLI。其他工具只要能读取本地 Skill 目录,一般也能手动放进去,但要自己确认触发方式是否一致。

cache-audit 需要什么权限?

权限级别是执行命令。安装流程涉及命令执行,可能通过 npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit 联网下载 Skill 或依赖。用户安装前应确认命令来源、仓库内容和执行环境。

cache-audit 是免费的吗?

公开资料没有标注明确许可证,收费和商用限制都无法确认。正式使用前请到来源仓库核对授权说明。

cache-audit 用的人多吗?

公开数据是累计安装 470 次,近一周安装 20 次,下载 165 次,GitHub 44 星。这些数字来自第三方目录统计,只能当作热度参考,不代表质量或安全性。

cache-audit 安全吗?

第三方扫描结果为通过,但这只覆盖已知的静态检查项,不能替代自己读一遍源码和安装命令。

值得选的地方和要先想清楚的地方

值得选的地方

  • 同时适配 4 种工具,换客户端不用重新找替代品。
  • 第三方扫描已通过,常见的高风险行为没有命中。

先想清楚的地方

  • 需要执行命令,装到常用环境前要先评估影响面。
  • 许可证没有明确标注,能不能商用、能不能再分发都不确定。
  • 第三方目录整理,版本更新和行为细节以来源仓库为准。

适不适合你

更适合

  • 已经在用 Codex,想直接扩展它能力的人。
  • 需要处理研究检索类任务、又不想每次都手写提示词的人。

不太适合

  • 不能接受 Skill 在你机器上执行命令的人。
  • 需要明确授权才能用到公司项目里的场景。
  • 需要厂商级技术支持和 SLA 的生产系统。

研究检索类 Skill 对比

6 个同类
Skill总安装GitHub 星权限许可证扫描
find-skills

寻找技能 · Codex、Claude

31,199,81316,486操作浏览器MIT有提醒
self-improving-agent

自我改进 Agent · OpenClaw

16,464,0023,396接触敏感数据MIT-0通过
soultrace

灵魂追踪 · Codex、Claude

7,588,94412需要联网未明确有提醒
self-improving

自我完善 · OpenClaw

6,829,2841,046需要联网MIT-0通过
microsoft-foundry

微软代工厂 · Codex、Claude

6,614,144764调用外部服务未明确有提醒
cache-audit

缓存审计 · 本页

47044执行命令未明确通过

按安装量取同分类前几名;数字来自第三方目录统计,只作热度参考,不代表质量结论。

SKILL.md 原文

Prompt Cache Audit

Trigger: /cache-audit or "audit my caching" or "check my cache setup"

What it does: Reads your live Claude Code configuration and measures it against prompt caching best practices. Returns a scored report with specific, actionable fixes ranked by token savings.

Background: The API caches the prefix of each request (system prompt, tool definitions, CLAUDE.md, rules, skill registry, MEMORY.md). An identical prefix between turns = ~90% cost reduction on those tokens. ANY change to the prefix invalidates everything after the change point.


When Invoked

Run ALL 8 checks automatically. Do NOT ask for confirmation. Read the relevant files, measure sizes, and produce the full report in one pass.

Use $PROJECT to refer to the current working directory throughout.


The 8 Checks

Check 1 — Prefix Ordering (Static Before Dynamic)

Read: ~/.claude/CLAUDE.md, $PROJECT/CLAUDE.md, ~/.claude/rules/*.md, $PROJECT/.claude/rules/*.md, and the MEMORY.md file for the current project (find it under ~/.claude/projects/*/memory/MEMORY.md — match by project path).

Flag any dynamic content in these files:

  • Timestamps, new Date(), hardcoded dates that go stale
  • Git refs, commit hashes, branch names
  • Session IDs, task IDs, "currently working on X"
  • File counts, line counts, or any computed metrics
  • currentDate entries in MEMORY.md

These files are part of the static prefix. Dynamic data here means cache misses on every turn where it changes.

Scoring:

  • PASS: All prefix files contain only static instructions and conventions
  • WARNING: Low-frequency dynamic data (e.g., a date updated daily)
  • FAIL: High-churn content (timestamps, computed values) in any prefix file

Check 2 — Hook Injection Pattern

Read: ~/.claude/settings.json and $PROJECT/.claude/settings.json to find all hook commands. Then read each referenced hook file.

For each hook, verify:

  • Hooks that inject context MUST use additionalContext in their JSON output (this becomes a <system-reminder> message — part of the message history, NOT the prefix)
  • Hooks that only log/backup should produce no hookSpecificOutput at all

Specifically flag:

  • Any hook that opens and writes to CLAUDE.md, MEMORY.md, or rule files mid-session
  • Any hook that modifies tool definitions or the system prompt directly
  • Any hook that uses hookSpecificOutput keys other than additionalContext

Check each hook and report its pattern:

Hook EventExpected Pattern
SessionStartadditionalContext with compact git context OR no output
UserPromptSubmitLogging only, no additionalContext
PreCompactLogging/backup only, no context injection
All others (Stop, SessionEnd, Notification, etc.)No prefix modification

Scoring:

  • PASS: All hooks use additionalContext or no-inject patterns
  • FAIL: Any hook modifies prefix files (CLAUDE.md, rules, MEMORY.md) mid-session

Check 3 — Tool Stability

Read: ~/.claude.json for global MCP servers, $PROJECT/.mcp.json for project MCP servers (if exists).

Measure and report:

  • Total MCP server count (global + project-level)
  • Each server name and whether it's deduplicated across levels

Flag:

  • Same MCP server name at both global and project level (tool schema loaded twice?)
  • Any skill that explicitly adds or removes tools when invoked
  • 8 total MCP servers (each adds tool schema tokens to the prefix)

Note: MCP tools use deferred loading via ToolSearch by default — this is the correct pattern. Stubs are lightweight; full schemas load on demand.

Scoring:

  • PASS: Fixed tool set at session start, no conditional loading
  • WARNING: > 8 MCP servers (consider if all are needed per-project)
  • FAIL: Dynamic tool add/remove detected mid-conversation

Check 4 — Model Consistency

Read: ~/.claude/settings.json for model or alwaysThinkingEnabled fields.

Check:

  • Is there a stable model configuration? (Default model is fine if consistent)
  • Do any agent definitions (.claude/agents/*.md) specify different model: in frontmatter for inline use?
  • Subagent model delegation (Task tool with model: parameter) is FINE — separate conversations don't break parent cache

Scoring:

  • PASS: Consistent model per conversation, subagents handle model switching
  • FAIL: Evidence of inline model switching in same conversation thread

Check 5 — Dynamic Content Size

Measure actual injection sizes. For each source, read the hook code and estimate output:

SourceHow to MeasurePASSWARNINGFAIL
SessionStart hookRead code — estimate additionalContext output chars< 200200–2K> 2K
UserPromptSubmit hookRead code — does it emit additionalContext?No output< 500> 500
Built-in git statusRun `git status --porcelain \wc -c`< 2K2–10K> 10K
Use ~4 chars per token as the conversion estimate.

Also report:

  • Total hook count across all events (each hook = execution latency per trigger)
  • Any hook with timeout > 10 seconds

Overall scoring:

  • PASS: All per-turn injections total < 2K chars
  • WARNING: 2–10K chars per turn
  • FAIL: > 10K chars injected per turn into the main conversation

Check 6 — Fork Safety (Compaction & Subagents)

Read: PreCompact hook code.

Verify:

  • PreCompact hook does NOT modify the prefix (logging/backup only is correct)
  • No custom compaction logic that rebuilds the system prompt differently
  • Claude Code's built-in compaction preserves system prompt + tools by default

Scoring:

  • PASS: Using built-in compaction + additionalContext-only hook injection
  • FAIL: Any hook modifies prefix during compaction or subagent spawn

Check 7 — Static Prefix Budget

This is the most actionable check. Measure every component of the static prefix.

Read and measure (report in chars AND estimated tokens at ~4 chars/token):

ComponentHow to Find
CLAUDE.md (global)~/.claude/CLAUDE.md
CLAUDE.md (project)$PROJECT/CLAUDE.md
Rules (global)Each file in ~/.claude/rules/*.md
Rules (project)Each file in $PROJECT/.claude/rules/*.md
MEMORY.mdMatch current project under ~/.claude/projects/*/memory/MEMORY.md

Use wc -c via Bash to measure file sizes. Measure EACH file individually.

Calculate:

  1. Grand total chars across all measured files
  2. Estimated tokens (chars / 4)
  3. Percentage of 200K context window consumed by static prefix

Report the top 5 largest individual files.

Scoring:

  • PASS: Total static prefix < 60K chars (~15K tokens, ~7.5% of context)
  • WARNING: 60–120K chars (~15–30K tokens, 7.5–15% of context)
  • FAIL: > 120K chars (~30K tokens, > 15% of context)

Check 8 — Rule Layer Efficiency

Read: List filenames in ~/.claude/rules/ and $PROJECT/.claude/rules/.

Key fact: Rules at both levels are additive — Claude Code loads ALL of them. This means duplicate filenames = duplicate content = wasted tokens.

Check for:

  1. Any filename that exists at BOTH ~/.claude/rules/ and $PROJECT/.claude/rules/ — these load twice
  2. For each duplicate, read both versions and estimate content overlap
  3. Whether the project uses a single project-implementation.md for overrides (correct pattern) vs. many files that duplicate user-level rules

The correct pattern:

  • User-level (~/.claude/rules/): Generic patterns — the WHAT (applies to all projects)
  • Project-level ($PROJECT/.claude/rules/): Single project-implementation.md — the HOW (framework-specific overrides)

Scoring:

  • PASS: No duplicate filenames, project uses project-implementation.md only
  • WARNING: 1–3 duplicate files
  • FAIL: > 3 duplicate files — significant token waste from additive loading

Output Format

After running all 8 checks, output this exact report format:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  PROMPT CACHE AUDIT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Score: X/8

[✅/⚠️/❌]  Check 1 — Prefix Ordering: [PASS/WARNING/FAIL]
   → [finding]

[✅/⚠️/❌]  Check 2 — Hook Injection: [PASS/WARNING/FAIL]
   → [each hook and its pattern]

[✅/⚠️/❌]  Check 3 — Tool Stability: [PASS/WARNING/FAIL]
   → [N global + N project MCP servers, any issues]

[✅/⚠️/❌]  Check 4 — Model Consistency: [PASS/WARNING/FAIL]
   → [model config]

[✅/⚠️/❌]  Check 5 — Dynamic Content: [PASS/WARNING/FAIL]
   → [size breakdown per injection point]

[✅/⚠️/❌]  Check 6 — Fork Safety: [PASS/WARNING/FAIL]
   → [compaction + subagent pattern]

[✅/⚠️/❌]  Check 7 — Prefix Budget: [PASS/WARNING/FAIL]
   → Total: XX,XXX chars (~X,XXX tokens, X.X% of 200K)
   → Top 5 largest:
     1. filename — X,XXX chars (~X,XXX tokens)
     2. filename — X,XXX chars (~X,XXX tokens)
     3. ...

[✅/⚠️/❌]  Check 8 — Rule Efficiency: [PASS/WARNING/FAIL]
   → [duplicate count + wasted tokens]

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  TOKEN BUDGET SUMMARY
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Static prefix:          ~XX,XXX tokens (X.X% of 200K window)
Per-turn injection:     ~XXX tokens
Per-builder spawn:      ~X,XXX tokens
Per-lightweight spawn:  ~XX tokens

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  TOP FIXES (ranked by token savings)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Most impactful fix — exact steps]
2. [Second most impactful — exact steps]
3. [Third — if applicable]

If all checks pass: confirm the setup is well-optimised and estimate cost savings vs a naive configuration (no caching awareness).


Prompt Caching Cheatsheet

RuleDoDon't
OrderingStatic CLAUDE.md + rules, dynamic in messagesTimestamps/dates/git refs in prefix files
UpdatesadditionalContext → <system-reminder>Edit CLAUDE.md or rules mid-session
ToolsFixed tool set + deferred MCP stubsAdd/remove tools per turn
ModelsOne model per conversation, subagents for switchesInline model switching
SizeTrim injections to minimum neededDump full git status (40K+ chars)
ForksBuilt-in compaction, additionalContext onlyCustom prefix rebuilds
BudgetStatic prefix < 15K tokensBloated CLAUDE.md, massive rule files
LayersUser-level generic + project-level project-implementation.mdSame rule files at both levels

平台分布

Codex

39.54%
按下载量换算65

Claude

31.31%
按下载量换算52

Cursor

17.93%
按下载量换算30

Gemini CLI

8.9%
按下载量换算15

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

执行命令

安装流程涉及命令执行,可能通过 npx skills add https://github.com/darraghh1/my-claude-setup --skill cache-audit 联网下载 Skill 或依赖。用户安装前应确认命令来源、仓库内容和执行环境。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。目前只有一个公开来源,建议同时核对源仓库。

继续浏览同类 Skills