跳到主要内容
知仓学习社ZHICANG

tearitapart

Critical pre-implementation review. Find what AI breaks. Verdict: PROCEED, REVISE, or RETHINK. Triggers: review plan, tear apart, critique, analyze.

读凭据严重 3 · 高危 0hashgraph-online/awesome-codex-plugins

它会碰到什么

扫了多少3 个文本文件,27 KB
它会碰到什么读凭据
命中总数3 处
命中统计严重 3 · 高 0 · 中 0 · 低 0
逐条看命中(3 条严重或高危)
  • 严重 reference/security-research.md:184cred-paths
    - [ ] .env files in .gitignore
  • 严重 reference/security-research.md:415meta-injection
    processed by an AI (e.g., "Ignore previous instructions and..."). Sanitize on ingestion,
  • 严重 reference/security.md:75cred-paths
    16. **Deny-first permissions**: configure deny rules for sensitive directories (`migrations/`, `secrets/`, `.env*`) BEFORE allow/ask rules in `.claude/settings.

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

<skill id="tearitapart">

<purpose>

Pre-implementation review. Check Big 5, security, testing, architecture.

Goal: find real problems, not generic concerns.

</purpose>

<skill_load>

Load: skills/quality/SKILL.md, skills/build/reference/testing.md, skills/tearitapart/reference/security.md

Reference: skills/quality/reference/quality-research.md

</skill_load>

<on_start>

agentdb read-start

</on_start>

<phase id="1_gather">

  • Read plan/spec
  • List files to be touched
  • Check git status
  • Check AgentDB for prior contracts
  • Read _meta/research/ for anti-patterns

output:

scope: N files

tier: 1|2|3

prior_work: contracts, research found

</phase>

<phase id="2_big5">

Run Big 5 checks from skills/quality/SKILL.md:

  1. input_validation: Zod schema? Parameterized queries?
  2. edge_cases: null, empty, unicode, timeout?
  3. error_handling: no empty catch? Logged with context?
  4. duplication: same logic repeated?
  5. complexity: functions < 30 lines?

Use quick_checks from quality skill for detection.

</phase>

<phase id="3_security">

Load: skills/tearitapart/reference/security.md

critical:

  • [ ] No hardcoded secrets
  • [ ] Auth tokens in httpOnly cookies
  • [ ] Rate limiting
  • [ ] HTTPS enforced

injection:

  • [ ] SQL: parameterized only
  • [ ] XSS: DOMPurify
  • [ ] CSRF: tokens on state changes

</phase>

<phase id="4_testing">

Load: skills/build/reference/testing.md

verify:

  • Tests exist BEFORE implementation?
  • Edge cases covered?
  • Assertions specific (not toBeTruthy)?
  • Mocks at boundaries only?

red_flags:

  • "Will add tests later"
  • 100% coverage, weak assertions
  • No error path testing

</phase>

<phase id="5_architecture">

Load: skills/architecture/SKILL.md

verify:

  • Follows existing patterns?
  • Interface stability?
  • Modular boundaries?
  • Dependency direction correct?

</phase>

<verdict>

<PROCEED>

No Big 5 violations. Security passes. Tests defined.

Output: "PROCEED with caveats: [list]"

</PROCEED>

<REVISE>

1-2 Big 5 violations (fixable). Missing security items.

Output: "REVISE: [changes with file:line]"

</REVISE>

<RETHINK>

3+ Big 5 violations. Fundamental security gaps. No tests.

Output: "RETHINK: [why flawed] → [alternative]"

</RETHINK>

<ask_user>

Use AskUserQuestion when: verdict is REVISE or RETHINK

Ask: "Verdict: {REVISE|RETHINK}. Want details on specific findings, or proceed with fixes?"

Options: show details, proceed with fixes, override and proceed anyway

</ask_user>

</verdict>

<output_format>

Save to _meta/reviews/{feature}-teardown.md:

# Tear Down: {feature}
reviewed: {timestamp}
tier: {1|2|3}
scope: {N files}

## Big 5
input_validation: pass|fail
edge_cases: pass|fail
error_handling: pass|fail
duplication: pass|fail
complexity: pass|fail

## Verdict: PROCEED | REVISE | RETHINK
{reasoning}

## Action Items
1. {fix with file:line}

</output_format>

<on_complete>

agentdb write-end '{"command":"tearitapart","verdict":"X","big5_violations":N}'

</on_complete>

</skill>

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。