跳到主要内容
知仓学习社ZHICANG

vc-audit-plans

Audit active project plan files for staleness, completion, and routing truth. Use when cleaning up plans, reconciling active work, or archiving comp…

执行命令读文件严重 0 · 高危 6withkynam/vibecode-pro-max-kit

它会碰到什么

扫了多少9 个文本文件,38 KB
它会碰到什么执行命令读文件
命中总数15 处
命中统计严重 0 · 高 6 · 中 9 · 低 0

这个仓库里自带 9 个测试样本文件(有些技能仓会放故意的恶意样本做演示),它们不计入上面的能力与命中。

逐条看命中(6 条严重或高危)
  • scripts/validate-eval-coverage.mjs:19exec-spawn
    import { execSync } from "node:child_process";
  • scripts/validate-eval-coverage.mjs:19exec-spawn
    import { execSync } from "node:child_process";
  • scripts/validate-eval-coverage.mjs:22exec-spawn
    const root = execSync("git rev-parse --show-toplevel").toString().trim();
  • scripts/validate-plan-inventory.mjs:4exec-spawn
    import { execSync } from "node:child_process";
  • scripts/validate-plan-inventory.mjs:4exec-spawn
    import { execSync } from "node:child_process";
  • scripts/validate-plan-inventory.mjs:8exec-spawn
    root = execSync('git rev-parse --show-toplevel', { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Audit Plans

> Output style: Follow process/development-protocols/communication-standards.md — answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Use this skill to review active plan artifacts and reconcile them with the current codebase.

This is a maintenance and recovery skill, not an automatic post-task hook.

Optional input: a feature, folder, plan filename, or maintenance scope to prioritize.

Prefer it when:

  • UPDATE PROCESS was skipped and active-plan cleanup drift accumulated
  • the user wants a periodic active-plan cleanup pass
  • multiple active plans need reconciliation after a burst of work

Workflow

  1. Read references/audit-plans.md for the full audit process.
  2. Run the inventory validator:
   node .claude/skills/vc-audit-plans/scripts/validate-plan-inventory.mjs
  1. Inventory plans in process/general-plans/active/ and process/features/*/active/. Plans now live inside {slug}_{date}/ task subfolders — scan one level deep. Do NOT count _REPORT_, _REF_, or _SPEC_ files inside task folders as plans; only _PLAN_ files count.

For feature-scoped audits, first run find process/features/{feature}/ -type f | sort for full

artifact visibility. For full audits, run find process/features/ -type f | sort to see all

feature artifacts across all subdirs (active, completed, backlog, references, reports).

3.5. Scan task folder contents (co-located REPORT/REF/SPEC files) alongside each plan. Per task-folder artefact colocation, the correct home for every artefact (plan, spec, reports, references) is INSIDE its {slug}_{date}/ task folder; flag any task artefact found in the deprecated sibling reports//references/ dirs or any ad-hoc location as mis-located, and recommend moving it into the owning task folder. Match by feature slug, date proximity (7 days), or content reference to the plan filename.

  1. Cross-check each plan against the actual codebase with file existence checks and targeted rg searches.
  2. Classify each plan as Completed, Partially Done, Obsolete, Stale, Active, or Reference.
  3. Move only clearly completed or obsolete plans to the appropriate completed/ folder. Use git mv active/{slug}_{date}/ completed/{slug}_{date}/ — move the WHOLE task folder; no completed_ prefix added.
  4. Ask before deleting anything.
  5. Re-run the inventory validator after moving or editing plan files.

Output

Return a concise summary table with classification, action taken, and any user decisions needed. Include stale artifact findings (reports/references tied to completed or obsolete plans) with recommended actions.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。