skill-comply

Visualize whether skills, rules, and agent definitions are actually followed — auto-generates scenarios at 3 prompt strictness levels, runs agents, …

执行命令严重 0 · 高危 15affaan-m/ECC

它会碰到什么

扫了多少18 个文本文件，63 KB

它会碰到什么执行命令

命中总数15 处

命中统计严重 0 · 高 15 · 中 0 · 低 0

这个仓库里自带 1 个测试样本文件（有些技能仓会放故意的恶意样本做演示），它们不计入上面的能力与命中。

逐条看命中（15 条严重或高危）

高 scripts/classifier.py:46exec-spawn
```
result = subprocess.run(
```

高 scripts/runner.py:23exec-spawn

# Shell builtins cannot be invoked via subprocess.run; cwd is already

高 scripts/runner.py:50exec-spawn
```
result = subprocess.run(
```

高 scripts/runner.py:108exec-spawn

subprocess.run(["git", "init"], cwd=sandbox_dir, capture_output=True)

高 scripts/runner.py:119exec-spawn

subprocess.run(parts, cwd=sandbox_dir, capture_output=True)

高 scripts/scenario_generator.py:43exec-spawn
```
result = subprocess.run(
```
高 scripts/spec_generator.py:43exec-spawn
```
result = subprocess.run(
```

高 tests/test_runner.py:27exec-spawn

Regression: subprocess.run(["cd", ...]) raises FileNotFoundError because

高 tests/test_runner.py:44exec-spawn

with patch("scripts.runner.subprocess.run", side_effect=fake_run):

高 tests/test_runner.py:62exec-spawn

with patch("scripts.runner.subprocess.run", side_effect=fake_run):

高 tests/test_runner.py:80exec-spawn

with patch("scripts.runner.subprocess.run", side_effect=fake_run):

高 tests/test_runner.py:96exec-spawn

with patch("scripts.runner.subprocess.run", side_effect=fake_run):

高 tests/test_runner.py:129exec-spawn

with patch("scripts.runner.subprocess.run", return_value=fake_result):

高 tests/test_runner.py:142exec-spawn

with patch("scripts.runner.subprocess.run", return_value=fake_result):

高 tests/test_runner.py:311exec-spawn

with patch("scripts.runner.subprocess.run", return_value=fake_result):

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

skill-comply: Automated Compliance Measurement

Measures whether coding agents actually follow skills, rules, or agent definitions by:

Auto-generating expected behavioral sequences (specs) from any .md file
Auto-generating scenarios with decreasing prompt strictness (supportive → neutral → competing)
Running claude -p and capturing tool call traces via stream-json
Classifying tool calls against spec steps using LLM (not regex)
Checking temporal ordering deterministically
Generating self-contained reports with spec, prompts, and timelines

Supported Targets

Skills (skills/*/SKILL.md): Workflow skills like search-first, TDD guides
Rules (rules/common/*.md): Mandatory rules like testing.md, security.md, git-workflow.md
Agent definitions (agents/*.md): Whether an agent gets invoked when expected (internal workflow verification not yet supported)

When to Activate

User runs /skill-comply <path>
User asks "is this rule actually being followed?"
After adding new rules/skills, to verify agent compliance
Periodically as part of quality maintenance

Usage

# Full run
uv run python -m scripts.run ~/.claude/rules/common/testing.md

# Dry run (no cost, spec + scenarios only)
uv run python -m scripts.run --dry-run ~/.claude/skills/search-first/SKILL.md

# Custom models
uv run python -m scripts.run --gen-model haiku --model sonnet <path>

Key Concept: Prompt Independence

Measures whether a skill/rule is followed even when the prompt doesn't explicitly support it.

Report Contents

Reports are self-contained and include:

Expected behavioral sequence (auto-generated spec)
Scenario prompts (what was asked at each strictness level)
Compliance scores per scenario
Tool call timelines with LLM classification labels

Advanced (optional)

For users familiar with hooks, reports also include hook promotion recommendations for steps with low compliance. This is informational — the main value is the compliance visibility itself.

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库affaan-m/ECC

星标★ 259,931

本站分层T1

该仓技能数903

原文件路径skills/skill-comply/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 903 个技能

同名技能的其他版本

有 3 个不同仓库或目录里都有叫 skill-comply 的技能。它们内容并不相同，别混用：

affaan-m/ECC — スキル、ルール、エージェント定義が実際に遵守されているかを可視化する——3種類のプロンプト厳格度レベルのシナリオを自動生成し、エージェントを実行し、動作シーケンスを分類し、完全なツ
affaan-m/ECC — 可视化技能、规则和代理定义是否被实际遵循——自动生成3种提示严格级别的场景，运行代理，分类行为序列，并报告完整工具调用时间线的合规率