Token导航 LogoToken导航

Agent Skill · 研究检索

tt-audit(tt 审核)

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限、脱敏方式和操作边界。

tt-audit 是研究检索类 Agent Skill,可用宿主为 Codex、Claude、Cursor、Gemini CLI,通过GitHub 仓库获取,权限为只读;许可证信息还不明确,暂无第三方扫描结果,按安装量在研究检索类的 73,675 个 Skill 里排第 66,424。

总安装 264周安装 11GitHub Stars 公开资料未说明下载 88核验 2026-05-01

安装说明

本站只整理中文说明,不托管安装包,也不代用户安装。
GitHub
许可证
unknown

安装方式

通过对话安装

复制提示词发给支持本地命令或 Skills 的 AI 助手,先确认命令和权限,再让它执行。

请帮我安装这个 Agent Skill:tt-audit(tt 审核)
来源仓库:https://github.com/biasia/tt-impeccable
仓库路径:skills/tt-audit
安装命令:
npx skills add https://github.com/biasia/tt-impeccable --skill tt-audit
安装前请先检查当前环境是否支持对应 CLI,并向我确认将要执行的命令、安装目录、联网范围和文件读写权限;确认后再执行。

命令行安装

复制命令到本机终端执行。该命令会通过 npx skills 从第三方来源获取 Skill;本站只展示命令,不托管安装包,也不自动执行。

skills.shnpx skills
npx skills add https://github.com/biasia/tt-impeccable --skill tt-audit

这个 Skill 是做什么的

研究检索类 Skill 主要解决「找资料、核对事实、把来源整理清楚」的问题,通常会让助手先检索再总结。

用于辅助安全审计、权限检查、凭据风险、认证流程和常见漏洞排查。它适合让 Agent 梳理敏感配置、检查依赖风险、分析鉴权逻辑或生成安全复核清单。适用于系统安全检查、权限管理和漏洞修复等研究检索类任务。通过 GitHub 仓库安装,使用 npx skills add 命令添加指定技能。

使用时不能把工具输出直接当最终结论,涉及密钥、令牌、用户数据或生产系统时,应先确认最小权限。tt-audit 属于研究检索类 Skill,可作为该场景下的辅助能力补充。

来源仓库内路径:skills/tt-audit

上手步骤

4 步
  1. 1

    确认自己的宿主工具

    公开资料标注支持 Codex、Claude、Cursor、Gemini CLI;先确认自己用的是其中之一,再按对应工具的 Skills 目录放置。

  2. 2

    拿到安装命令

    可以直接复制的命令是 npx skills add https://github.com/biasia/tt-impeccable --skill tt-audit;命令里的占位符换成自己的路径或密钥再执行。

  3. 3

    安装后重启宿主

    命令执行完要完全退出宿主工具再打开,让新装的 Skill 被重新扫描到,否则列表里可能看不到。

  4. 4

    按最小权限试用

    它标注为只读,先用只读任务试一次,确认行为符合预期再扩大使用范围。

常见问题

6 条

tt-audit 怎么安装?

在终端执行 npx skills add https://github.com/biasia/tt-impeccable --skill tt-audit。装完完全退出宿主工具再打开,让它重新扫描本地 Skill。

tt-audit 支持哪些 AI 工具?

公开资料标注支持 Codex、Claude、Cursor、Gemini CLI。其他工具只要能读取本地 Skill 目录,一般也能手动放进去,但要自己确认触发方式是否一致。

tt-audit 需要什么权限?

权限级别是只读。该 Skill 主要提供规则、说明或参考内容,本身偏只读;真正读写文件、联网或执行命令仍取决于宿主 Agent 的任务。

tt-audit 是免费的吗?

公开资料没有标注明确许可证,收费和商用限制都无法确认。正式使用前请到来源仓库核对授权说明。

tt-audit 用的人多吗?

公开数据是累计安装 264 次,近一周安装 11 次,下载 88 次。这些数字来自第三方目录统计,只能当作热度参考,不代表质量或安全性。

tt-audit 安全吗?

没有查到第三方扫描结果,安全性无法从公开资料判断,安装前请自行审查源码、依赖和命令行为。

值得选的地方和要先想清楚的地方

值得选的地方

  • 同时适配 4 种工具,换客户端不用重新找替代品。
  • 标注为只读权限,试用阶段不容易误改本地文件。

先想清楚的地方

  • 许可证没有明确标注,能不能商用、能不能再分发都不确定。
  • 没有第三方扫描结果,安全性只能靠自己读源码判断。
  • 第三方目录整理,版本更新和行为细节以来源仓库为准。

适不适合你

更适合

  • 已经在用 Codex,想直接扩展它能力的人。
  • 需要处理研究检索类任务、又不想每次都手写提示词的人。
  • 只想先试试效果、不希望它改动本地文件的人。

不太适合

  • 需要明确授权才能用到公司项目里的场景。
  • 要求有安全扫描结论才肯安装的团队。
  • 需要厂商级技术支持和 SLA 的生产系统。

研究检索类 Skill 对比

6 个同类
Skill总安装GitHub 星权限许可证扫描
find-skills

寻找技能 · Codex、Claude

31,199,81316,486操作浏览器MIT有提醒
self-improving-agent

自我改进 Agent · OpenClaw

16,464,0023,396接触敏感数据MIT-0通过
soultrace

灵魂追踪 · Codex、Claude

7,588,94412需要联网未明确有提醒
self-improving

自我完善 · OpenClaw

6,829,2841,046需要联网MIT-0通过
microsoft-foundry

微软代工厂 · Codex、Claude

6,614,144764调用外部服务未明确有提醒
tt-audit

tt 审核 · 本页

264—只读未明确未收录

按安装量取同分类前几名;数字来自第三方目录统计,只作热度参考,不代表质量结论。

SKILL.md 原文

Context Check

  1. Read .tt-impeccable.md from the project root → check ### Fidelity Intent. If found, use it.
  2. If absent, infer from the codebase:

- Canvas ≤ 390px, mobile-first flex, safe area insets → Strict TUX-native - Desktop-first, 1440px max-width, dark #000000 canvas → TT Style - If still unclear, ask: "Is this Strict TUX-native (mobile product screen) or TT Style (web / marketing)?"

Load token values as needed from tt-impeccable/reference/tokens.md and tt-impeccable/reference/typography.md.

Rules below marked (TUX-native only) are skipped for TT Style — they are not violations. Rules marked (TT Style only) are skipped for TUX-native. Universal rules apply to both tiers.


Run systematic technical quality checks against TUX v2 standards and generate a comprehensive report. Do not fix issues — document them for /tt-impeccable extract or /tt-impeccable craft to address.

This is a code-level audit, not a design critique. Check what is measurable and verifiable in the implementation.


Diagnostic Scan

Score each of the 5 dimensions 0–4 using the criteria below.


1. Accessibility (A11y)

Check for:

  • Contrast: Text contrast < 4.5:1 (normal) or < 3:1 (large text / UI components)
  • Touch targets: Interactive elements with tap area < 44×44px
  • Missing ARIA: Interactive elements without role, label, or state attributes
  • Keyboard navigation: Missing :focus-visible, illogical tab order, keyboard traps
  • Semantic HTML: <div> used as button, missing <main>/<nav> landmarks, broken heading hierarchy
  • Form issues: <input> without <label>, errors not associated via aria-describedby, missing required

Score 0–4: 0 = Inaccessible (fails WCAG A) · 1 = Major gaps · 2 = Partial effort · 3 = WCAG AA mostly met · 4 = WCAG AA fully met


2. Performance

Check for:

  • Expensive animations: width, height, top, left, padding, margin being animated instead of transform/opacity (universal)
  • Animation duration (TUX-native only): UI feedback transitions exceeding 200ms or entrance transitions exceeding 300ms — flag as P2. (TT Style: scroll-driven hero entrances up to 800ms are acceptable; looping/idle animations remain banned.)
  • Layout thrashing: Reading and writing layout properties in the same loop (universal)
  • Missing lazy loading: Off-screen images or content loaded eagerly
  • Excessive re-renders: Missing memoization, state causing full subtree re-render
  • Unused imports: Dependencies imported but not used; heavy libraries for trivial tasks

Score 0–4: 0 = Severe · 1 = Major problems · 2 = Partial · 3 = Mostly optimized · 4 = Fast and lean


3. TUX Token Fidelity

The core TUX-specific dimension. Check every color, spacing, radius, shadow, and typography declaration against reference/tokens.md and reference/typography.md.

Colors:

  • Raw hex or rgba values not going through var(--tux-*) CSS variables
  • OKLCH, HSL, or custom color functions
  • Brand red (#FE2C55) used as section background or decorative fill
  • Neutral-first violation: UI/Shape/Primary or UI/Shape/Secondary appearing on more than one distinct element type per screen (TUX-native only; flag as P2)
  • Colored overlay (red or teal tint) applied over image or video content — Image Overlay tokens must be black-alpha or white-alpha only (universal)
  • Colored skeleton/placeholder on image or video loading states — must use UI/Shape/Neutral 4 (universal)
  • Invented dark mode values not from the official token table

Borders & Dividers:

  • Border overuse: border, border-top, or border-bottom used to separate content groups where a background color change (UI/Page/Flat 2, UI/Page/Grouped 1/2, UI/Shape/Neutral 4 fill) would achieve the same separation. Flag as P2 — borders add visual noise TUX avoids by design.
  • border-left or border-right > 1px as a colored accent stripe — flag as P0 (hard ban, universal)
  • Divider weight: prefer 0.5px hairline over 1px on retina screens
  • Hover via border-color: any :hover rule that changes border-color or adds a new border — flag as P2. Hover state must be expressed through background or opacity changes, not border changes. Ghost/outline buttons are the only exception, and even then only the background should change on hover, not the border-color.
  • Border compensating for insufficient surface contrast: if a border appears on a dark surface element (e.g., a code block or panel) whose background is nearly identical to the page background, flag as P2 — the root cause is a wrong background color, not a missing border. The fix is to use the correct UI/Page/Flat 2 (#1E1E1E) or UI/Page/Flat 3 (#2C2C2C) token, not to add an outline.

Brand Red Opacity Violations:

  • rgba(254,44,85,*) at ANY alpha value used as a content area fill, section background, blockquote tint, or card background — flag as P1 regardless of opacity. A tint of 0.06 is as much a BAN 7 violation as full opacity. Legitimate sub-full-opacity uses are interactive state fills only (pressed row, selected background).
  • Check for --red-dim, var(--tux-shape-primary-4), var(--tux-shape-primary-5) on non-interactive elements — flag as P1.

Neutral-first (expanded):

  • Primary/Secondary on non-interactive elements is a violation even if it appears only once — the "one element per screen" rule is a ceiling, not a floor. A decorative arrow, separator, bullet, or background tint in brand red or teal fails the neutral-first check regardless of count. Verify interactivity: does the element have onClick, href, role="button", or equivalent? If not, it must be neutral.

Spacing:

  • Any pixel value not in the TUX 4px grid: 4 / 8 / 12 / 16 / 20 / 24 / 32 (universal)
  • Values exceeding 32px (TUX-native only) — TT Style allows uncapped section spacing
  • Page horizontal padding deviating from 16px (TUX-native only) — TT Style uses responsive padding (80–120px desktop / 24px mobile)

Radius:

  • Values not from content radius table: 4 / 6 / 8 / 10 / 12 / 9999px
  • Values not from container radius table: 8 / 10 / 14 / 16 / 26px
  • Content and container radius mixed on the same element

Shadow:

  • Custom box-shadow values not matching the 6 TUX levels
  • Drop shadows used in dark mode for elevation (should be brightness overlays)

Typography:

  • Font family other than 'TikTok Sans', system-ui, -apple-system, sans-serif (universal)
  • Font sizes not in the 12-step scale: 32 / 24 / 20 / 17 / 16 / 15 / 14 / 13 / 12 / 11 / 10px (TUX-native only) — TT Style allows display scale (48 / 72 / 96px+) for hero text
  • Font weight above 700 (TUX-native only) — TT Style allows 800/900 via TikTokVF for hero display text
  • Non-zero letter-spacing on text below 72px (universal) — TT Style allows negative tracking at 72px+ display text only
  • Line-heights not matching the fixed per-style values from the type scale (TUX-native only)
  • More than 3 distinct size tiers visible on one screen (universal)

Score 0–4: 0 = No tokens (hard-coded everything) · 1 = Occasional tokens · 2 = Partial · 3 = Good, minor hard-coded values · 4 = Full compliance


4. TUX Component Compliance

Check that TUX components match their specified dimensions, states, and structure.

ComponentSpec✓/✗
Full-width CTA buttonheight 52px, pill radius (9999px)
Mid-page buttonheight 44px, pill radius
Inline buttonheight 32px, pill radius
Text input / search barheight 40px, radius 10px, rgba(0,0,0,0.05) bg
Toggle52×32px track, teal ON / neutral OFF
Navigation barheight 44px, horizontal padding 16px
Tab bar83px total (49px visible + 34px home indicator inset)
Status bar spacer44px top
Safe area bottom34px

Also check for bans (mark tier where applicable):

  1. Side-stripe borders (border-left/right > 1px as accent) (universal)
  2. Gradient text (background-clip: text + gradient) (universal)
  3. Invented radius values (outside the two official tables) (universal)
  4. Custom shadow values (outside the 6 TUX levels) (universal)
  5. Assumed @byted-tiktok/tux-web imports (without package.json verification) (universal)
  6. Glassmorphism (backdrop-filter: blur() decoratively) (TUX-native: hard ban. TT Style: flag as P2 if .tt-impeccable.md Glassmorphism field is absent or "No" — it requires explicit user confirmation, not assumed from the fidelity tier)
  7. Brand red as large-area background (universal)

Score 0–4: 0 = Multiple spec violations + banned patterns · 1 = Several wrong dimensions · 2 = Some violations · 3 = Minor deviations · 4 = Full compliance


5. TikTok Native Test

"If you sent a screenshot to a TikTok designer, would they say 'that's TikTok' or 'that's a clone'?"

Apply the criteria matching the declared fidelity tier:

Strict TUX-native — "Does this feel like it belongs inside the TikTok app?":

  • Is content the most visually dominant element — not chrome, not decoration?
  • Is there a single clear focal point (primary CTA or main content) identifiable in 1 second?
  • Are there more than 3 distinct visual weight tiers on screen?
  • Do same-level elements use consistent size and weight?
  • Are accent colors (brand red, teal) only on interactive elements of the appropriate type?
  • Does Primary (brand red) appear on more than one distinct interactive element type per screen? If so, the color restraint rule is broken — one of them should be neutral.
  • Do any image or video surfaces have colored overlays or colored placeholder backgrounds? They must not.
  • Does content at the viewport bottom clip slightly (signals scrollability without a label)?
  • On lists with section separators, is the first cell's top gap 8px larger than cell-to-cell gap?

TT Style — "Does this feel like tiktokbrandhub.com — or a generic dark web page?":

  • Is the dark canvas (#000000) used as the primary background?
  • Do Blaze (red) and Glint (teal) appear only in their correct semantic roles (CTA / secondary accent)?
  • Does the hero typography have presence — bold weight, clear scale hierarchy?
  • Is negative space used intentionally, not just left empty?
  • Does motion feel purposeful and brand-forward, not generic (no CSS default easings, no bounce)?
  • Is the pill button shape present on primary actions?
  • Would someone recognize this as TikTok brand — not a TikTok-adjacent third party?

Score 0–4: 0 = Clearly third-party · 1 = Significant divergence · 2 = Recognizable but rough · 3 = Close, minor tells · 4 = Indistinguishable from authentic TikTok (native app or Brand Hub depending on tier)


Generate Report

Audit Health Score

#DimensionScoreKey Finding
1Accessibility? /4[most critical issue or —]
2Performance? /4
3TUX Token Fidelity? /4
4TUX Component Compliance? /4
5TikTok Native Test? /4
Total??/20[rating]

Rating bands: 18–20 Excellent · 14–17 Good · 10–13 Acceptable · 6–9 Poor · 0–5 Critical


TUX Token Verdict

Start here. Pass/fail: does the implementation use TUX tokens throughout, or are there hard-coded values? List specific violations with file and line locations. Be specific — "rgba(254,44,85,1) hardcoded in Button.tsx line 34" not "some colors are hardcoded".


Executive Summary

  • Audit Health Score: ??/20 ([rating band])
  • Issues by severity: P0 __ · P1 __ · P2 __ · P3 __
  • Top 3–5 critical issues
  • Recommended next steps

Detailed Findings by Severity

Tag every issue with P0–P3:

  • P0 Blocking — prevents task completion or causes WCAG failure; fix before any release
  • P1 Major — significant user impact or TUX fidelity gap; fix before release
  • P2 Minor — visible deviation, workaround exists; fix in next pass
  • P3 Polish — subtle; fix if time permits

For each issue:

  • [P?] Issue name
  • Location: component / file / line number
  • Category: Accessibility · Performance · Token Fidelity · Component · TikTok Native
  • Impact: how it affects users or TUX compliance
  • Recommendation: exactly what to change and to what value
  • Suggested command: /tt-impeccable extract for token/component fixes; /tt-impeccable craft [feature] for structural rebuilds

Systemic Issues

Identify patterns that indicate a systemic gap:

  • "Hard-coded colors appear in 12+ components — needs a shared tokens CSS file"
  • "Touch targets consistently under 44px — interaction patterns need a sweep"

Positive Findings

Note what is correct and should be preserved. Good practices are as important to document as violations.


Recommended Actions

List in priority order (P0 first):

  1. [P?] /tt-impeccable extract — [specific tokens / components to align]
  2. [P?] /tt-impeccable craft [feature] — [what to rebuild and why]

After presenting the report:

tt-audit vs tt-critique: this skill checks code correctness — token values, component dimensions, accessibility, performance. /tt-critique evaluates design quality — visual hierarchy, UX patterns, IA, and copy. Run both for a complete picture.
You can ask me to run these one at a time, all at once, or in any order you prefer. Re-run /tt-audit after fixes to track score improvement.

Never

  • Report issues without explaining user impact
  • Give generic recommendations — cite specific files, lines, and values
  • Skip positive findings
  • Mark everything P0 — prioritization is the point
  • Report false positives without verifying in the actual code
  • Fix anything during audit — this is a read-only diagnostic pass

平台分布

Codex

36.34%
按下载量换算32

Claude

28.83%
按下载量换算25

Cursor

21.22%
按下载量换算19

Gemini CLI

10.12%
按下载量换算9

安全审计

暂无安全审计结果可展示。

权限和风险

只读

该 Skill 主要提供规则、说明或参考内容,本身偏只读;真正读写文件、联网或执行命令仍取决于宿主 Agent 的任务。

安装前确认

本站仅展示第三方公开信息,不托管安装包,不提供自动安装或运行环境。安装前应自行审查源码、依赖和命令行为。目前只有一个公开来源,建议同时核对源仓库。

继续浏览同类 Skills