Token导航 LogoToken导航TokenDH.com
研究检索需要联网github未标认证来源可访问许可证需确认审计通过

cdd-audit-and-implementCDD 审核和实施

Agent Skill

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

总安装

212

周安装

9

GitHub Stars

1

下载量

74
CodexClaudeCursorGemini CLI

安装说明

本站只整理中文说明和来源信息,不托管安装包,也不代用户安装。

GitHub

来源数

2

许可证

unknown

最后核验

2026-05-01

来源状态

来源可访问

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:cdd-audit-and-implement(CDD 审核和实施)
来源仓库:https://github.com/ruphware/cdd-skills
仓库路径:skills/cdd-audit-and-implement
安装命令:
npx skills add https://github.com/ruphware/cdd-skills --skill cdd-audit-and-implement
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/ruphware/cdd-skills --skill cdd-audit-and-implement

简介

cdd-audit-and-implement 将审计清单转化为可执行 TODO 步骤并立即实施首个步骤,适合在 Codex、Claude、Cursor、Gemini CLI 中快速落地安全整改时使用。

  • 它采用交互式规划合同,先读代码库再制定 TODO 计划,确保方案贴合实际上下文。
  • 支持安全归档与文档刷新建议,适用于维护阶段的漂移检测与医生式体检。
  • 使用前应确认 AGENTS.md 等契约文件存在,避免在无规范状态下盲目操作。
  • 适用宿主包括 Codex、Claude、Cursor、Gemini CLI,接入前应确认版本、权限和运行环境要求。

SKILL.md

CDD Audit + Implement (explicit-only)

Turn an audit list into small TODO steps, apply them, then immediately implement the first chosen step.

Interactive planning contract

Planning in this skill is interactive, review-driven, and continuously refined.

  • Start in planning mode when the runtime supports a native read-only or plan mode. If it does not, emulate that behavior by staying read-only until the user approves applying the plan.
  • Review the codebase before and during planning. Audit the relevant code, tests, entrypoints, configs, and current TODO surfaces so the TODO plan reflects the real implementation state.
  • Treat clarification as a way to resolve the right assumptions, goals, and implementation paths. Do not ask preference questions that do not materially affect the plan.
  • Ask at most one substantive clarification or decision question per message.
  • Keep refining the execution plan as new evidence appears. After each user answer or new repo finding, update boundaries, sequencing, assumptions, and proof requirements before continuing.
  • Keep messages easy to scan: concise, no fluff, and use lightweight Markdown emphasis such as **bold** and *italics* when helpful. Do not depend on color.
  • For every clarification or decision message, put the choices at the bottom under a final **Options** section:

- offer 2-4 concrete options grounded in the repo context - put the recommended option first and mark it clearly - prefix every option label with a visible selector in the label itself so plan-mode UIs still show a selectable key - default to letters: A., B., C. - use numbers only when the surrounding context is already numeric and that would be clearer - keep each option short and action-oriented - avoid open-ended options unless a free-form value is truly required - when practical, tell the user they can reply with just the selector

Audit normalization rules

Do not convert raw audit bullets directly into TODO tasks.

  • Normalize each audit item into one or more of:

- spec_delta - implementation_delta - verification_delta - defer

  • Collapse duplicate symptoms into the smallest root-cause work package that can be implemented and validated cleanly.
  • Preserve dependency order: prerequisite contract or plumbing changes should appear before downstream UI, storage, export, or cleanup work.
  • Generated execution steps must satisfy the same implementation-ready standard as cdd-plan: Goal, Constraints, Tasks, Implementation notes, Automated checks, and UAT for non-trivial work, or equivalent sections if the repo already uses a richer local template.

Flow (two approvals)

A) Plan

  1. Read AGENTS.md, README.md, the active TODO*.md, the relevant specs, and the relevant codebase surfaces.

- Review the current implementation before planning: affected modules, entrypoints, tests, manifests, configs, and recent TODO context. - Identify likely root causes, impacted boundaries, and proof surfaces for the audit items.

  1. Ask for the audit items (inline bullets or a file path + section).
  2. Before drafting TODO steps, identify only the blocking or plan-shaping clarifications that would materially change assumptions, goals, implementation paths, grouping, file placement, sequencing, or approval boundaries.
  3. Ask clarifying questions one at a time using the interaction contract above.
  4. If any material assumption would remain after the answers, list only those material assumptions and ask the user to confirm or correct them before continuing.
  5. If only minor defaults remain, disclose them briefly in the plan and proceed without blocking.
  6. Normalize the audit items:

- identify the user-visible symptom, likely root cause, affected boundary, and proof needed for each item - tag each item as spec_delta, implementation_delta, verification_delta, or defer - merge duplicates and split mixed-surface findings before drafting steps

  1. Before drafting TODO edits, present 2-3 plan shapes when there is a real grouping, sequencing, or write-location decision to make.

- Recommend one option based on the codebase review and normalized audit results. - Include the write-location choice in the same option set when possible: - default: update an existing TODO file - alternative: create TODO-audit-<tag>.md - Keep the options at the bottom of the message under **Options**, with selector-prefixed labels such as A., B., C.. - Ask for a short tag only if the user chose the new-file option.

  1. Group the normalized items into 1–N implementation-ready TODO steps using the repo’s existing Step template. Keep the plan KISS and CDD-style: minimal steps, minimal diffs, no invented structure.
  2. Ask: Approve and apply the TODO plan?
  3. Apply the approved plan.

B) Implement

  1. Ask which newly created step should be implemented now using the same bottom-positioned, selector-prefixed guided options; recommend the first runnable new step by default. Prefer dependency order and prerequisite work when choosing that recommendation. The selected implementation option serves as the explicit approval to start that step immediately. Include a clear stop-after-plan option.
  2. If the user chooses the stop-after-plan option, stop and report the next recommended step.
  3. If the user chooses a step, implement that step immediately using the same workflow as $cdd-implement-todo.

适合场景

01

用户想查找某类 Agent Skill 时

02

需要根据任务场景推荐可安装能力包时

03

需要对比不同来源的安装命令和来源信息时

能力概览

能力 1

按任务关键词查找相关 Skills

能力 2

展示可复制的安装命令

能力 3

保留来源站点、仓库和原始说明,方便继续核验

能力 4

展示第三方安全扫描或审计结果

安装后应在对应宿主中按原始 README 的触发条件使用;具体调用方式请以来源页面和 README 为准。

平台分布

Codex

34.33%
按下载量换算25

Claude

28.96%
按下载量换算21

Cursor

19.08%
按下载量换算14

Gemini CLI

9.45%
按下载量换算7

安全审计

Gen Agent Trust Hub

通过

Socket

通过

Snyk

通过

权限和风险

需要联网

该 Skill 可能需要联网访问来源站点、仓库或外部 API;具体网络访问范围需要结合源码和 README 复核。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。当前只有一个来源,正式发布前建议补源仓库或其他目录站核验。

来源信息

继续浏览同类 Skills