tearitapart
Critical pre-implementation review. Find what AI breaks. Verdict: PROCEED, REVISE, or RETHINK. Triggers: review plan, tear apart, critique, analyze.
它会碰到什么
逐条看命中(3 条严重或高危)
- 严重
reference/security-research.md:184cred-paths- [ ] .env files in .gitignore
- 严重
reference/security-research.md:415meta-injectionprocessed by an AI (e.g., "Ignore previous instructions and..."). Sanitize on ingestion,
- 严重
reference/security.md:75cred-paths16. **Deny-first permissions**: configure deny rules for sensitive directories (`migrations/`, `secrets/`, `.env*`) BEFORE allow/ask rules in `.claude/settings.
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
<skill id="tearitapart">
<purpose>
Pre-implementation review. Check Big 5, security, testing, architecture.
Goal: find real problems, not generic concerns.
</purpose>
<skill_load>
Load: skills/quality/SKILL.md, skills/build/reference/testing.md, skills/tearitapart/reference/security.md
Reference: skills/quality/reference/quality-research.md
</skill_load>
<on_start>
agentdb read-start
</on_start>
<phase id="1_gather">
- Read plan/spec
- List files to be touched
- Check git status
- Check AgentDB for prior contracts
- Read _meta/research/ for anti-patterns
output:
scope: N files
tier: 1|2|3
prior_work: contracts, research found
</phase>
<phase id="2_big5">
Run Big 5 checks from skills/quality/SKILL.md:
- input_validation: Zod schema? Parameterized queries?
- edge_cases: null, empty, unicode, timeout?
- error_handling: no empty catch? Logged with context?
- duplication: same logic repeated?
- complexity: functions < 30 lines?
Use quick_checks from quality skill for detection.
</phase>
<phase id="3_security">
Load: skills/tearitapart/reference/security.md
critical:
- [ ] No hardcoded secrets
- [ ] Auth tokens in httpOnly cookies
- [ ] Rate limiting
- [ ] HTTPS enforced
injection:
- [ ] SQL: parameterized only
- [ ] XSS: DOMPurify
- [ ] CSRF: tokens on state changes
</phase>
<phase id="4_testing">
Load: skills/build/reference/testing.md
verify:
- Tests exist BEFORE implementation?
- Edge cases covered?
- Assertions specific (not toBeTruthy)?
- Mocks at boundaries only?
red_flags:
- "Will add tests later"
- 100% coverage, weak assertions
- No error path testing
</phase>
<phase id="5_architecture">
Load: skills/architecture/SKILL.md
verify:
- Follows existing patterns?
- Interface stability?
- Modular boundaries?
- Dependency direction correct?
</phase>
<verdict>
<PROCEED>
No Big 5 violations. Security passes. Tests defined.
Output: "PROCEED with caveats: [list]"
</PROCEED>
<REVISE>
1-2 Big 5 violations (fixable). Missing security items.
Output: "REVISE: [changes with file:line]"
</REVISE>
<RETHINK>
3+ Big 5 violations. Fundamental security gaps. No tests.
Output: "RETHINK: [why flawed] → [alternative]"
</RETHINK>
<ask_user>
Use AskUserQuestion when: verdict is REVISE or RETHINK
Ask: "Verdict: {REVISE|RETHINK}. Want details on specific findings, or proceed with fixes?"
Options: show details, proceed with fixes, override and proceed anyway
</ask_user>
</verdict>
<output_format>
Save to _meta/reviews/{feature}-teardown.md:
# Tear Down: {feature}
reviewed: {timestamp}
tier: {1|2|3}
scope: {N files}
## Big 5
input_validation: pass|fail
edge_cases: pass|fail
error_handling: pass|fail
duplication: pass|fail
complexity: pass|fail
## Verdict: PROCEED | REVISE | RETHINK
{reasoning}
## Action Items
1. {fix with file:line}
</output_format>
<on_complete>
agentdb write-end '{"command":"tearitapart","verdict":"X","big5_violations":N}'
</on_complete>
</skill>
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。
它属于哪个仓库
plugins/ariaxhan/kernel-claude/skills/tearitapart/SKILL.md