vc-audit-vc

执行命令改身份文件读文件写文件严重 0 · 高危 27withkynam/vibecode-pro-max-kit

它会碰到什么

扫了多少10 个文本文件，62 KB

它会碰到什么执行命令改身份文件读文件写文件

命中总数55 处

命中统计严重 0 · 高 27 · 中 28 · 低 0

这个仓库里自带 2 个测试样本文件（有些技能仓会放故意的恶意样本做演示），它们不计入上面的能力与命中。

逐条看命中（27 条严重或高危）

高 scripts/export-benchmark-kit.mjs:4exec-spawn
```
import { execSync } from "node:child_process";
```
高 scripts/export-benchmark-kit.mjs:4exec-spawn
```
import { execSync } from "node:child_process";
```

高 scripts/export-benchmark-kit.mjs:16exec-spawn

const repoRoot = execSync("git rev-parse --show-toplevel").toString().trim();

高 scripts/export-benchmark-kit.mjs:190exec-spawn

return execSync(command, { cwd: repoRoot }).toString().trim();

高 scripts/export-benchmark-kit.mjs:201identity-write
```
const genericClaude = `# CLAUDE.md
```

高 scripts/export-benchmark-kit.mjs:205identity-write

Read AGENTS.md first for tool-specific notes, then read process/context/all-context.md and process/development-protocols/all-development-protocols.md before sub

高 scripts/export-benchmark-kit.mjs:212identity-write

const genericAgents = `# AGENTS.md - Benchmark Harness Adapter

高 scripts/export-benchmark-kit.mjs:214identity-write

CLAUDE.md is the source of truth for workflow behavior in this benchmark task.

高 scripts/export-benchmark-kit.mjs:445identity-write

writeFile("CLAUDE.md", genericClaude, generatedFiles);

高 scripts/export-benchmark-kit.mjs:446identity-write

writeFile("AGENTS.md", genericAgents, generatedFiles);

高 scripts/export-benchmark-kit.mjs:502identity-write

"CLAUDE.md and AGENTS.md are generated benchmark-safe files, not verbatim copies from the source repo.",

高 scripts/export-benchmark-kit.mjs:502identity-write

"CLAUDE.md and AGENTS.md are generated benchmark-safe files, not verbatim copies from the source repo.",

高 scripts/validate-agent-frontmatter.mjs:4exec-spawn
```
import { execSync } from "node:child_process";
```
高 scripts/validate-agent-frontmatter.mjs:4exec-spawn
```
import { execSync } from "node:child_process";
```
高 scripts/validate-agent-frontmatter.mjs:8exec-spawn
```
root = execSync("git rev-parse --show-toplevel", {
```
高 scripts/validate-agent-parity.mjs:4exec-spawn
```
import { execSync } from "node:child_process";
```
高 scripts/validate-agent-parity.mjs:4exec-spawn
```
import { execSync } from "node:child_process";
```

高 scripts/validate-agent-parity.mjs:8exec-spawn

root = execSync('git rev-parse --show-toplevel', { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();

高 scripts/validate-kit-portability.mjs:25exec-spawn
```
import { execSync } from "node:child_process";
```
高 scripts/validate-kit-portability.mjs:25exec-spawn
```
import { execSync } from "node:child_process";
```

高 scripts/validate-kit-portability.mjs:33exec-spawn

root = execSync("git rev-parse --show-toplevel", { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();

高 scripts/validate-kit-portability.mjs:78identity-write
```
"CLAUDE.md",
```
高 scripts/validate-kit-portability.mjs:79identity-write
```
"AGENTS.md",
```

高 scripts/validate-seeds.mjs:62identity-write

{ pattern: /\.claude\/CLAUDE\.md/g, label: ".claude/CLAUDE.md (moved to root)" },

高 scripts/validate-skills.mjs:4exec-spawn

import { execSync } from "node:child_process";

高 scripts/validate-skills.mjs:4exec-spawn

import { execSync } from "node:child_process";

高 scripts/validate-skills.mjs:9exec-spawn

root = execSync('git rev-parse --show-toplevel', { stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();

这一栏是扫描器报的事实，不是结论。命中多不等于有毒（安全工具、规则库、示例脚本本来就会包含危险写法），命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系，需要你自己看。

技能内容

Audit VC (Version Control Harness Health)

> Output style: Follow process/development-protocols/communication-standards.md — answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Use this skill to verify that the agent harness layer is internally consistent

and correctly wired across Claude, Codex, README.md, and protocol files.

For context routing, grouping, and discoverability audits, use the audit-context skill instead.

Workflow

Run the Claude/Codex agent parity validator:

   node .claude/skills/vc-audit-vc/scripts/validate-agent-parity.mjs

Run the shared skill discovery validator:

   node .claude/skills/vc-audit-vc/scripts/validate-skills.mjs

Run the README.md sync validator:

   node .claude/skills/vc-audit-vc/scripts/validate-guide-sync.mjs

Run the protocol wiring validator:

   node .claude/skills/vc-audit-vc/scripts/validate-protocol-wiring.mjs

Run the seed/scaffold consistency validator:

   node .claude/skills/vc-audit-vc/scripts/validate-seeds.mjs

Run the kit portability validator:

   node .claude/skills/vc-audit-vc/scripts/validate-kit-portability.mjs

Run the skill invocation wiring validator:

   node .claude/skills/vc-audit-vc/scripts/validate-skill-invocation-wiring.mjs

Run the agent frontmatter validator:

   node .claude/skills/vc-audit-vc/scripts/validate-agent-frontmatter.mjs

If any script reports failures, inspect the referenced files and patch the smallest

relevant surface.

Re-run the failed validators until they pass.

Rules

Treat .claude/agents/ as canonical for agent definitions; .codex/agents/ mirrors them.
Treat .claude/skills/ as canonical for skills; .agents/skills/ is the Codex discovery symlink.
When updating agents, mirror Claude markdown and Codex TOML surfaces together.
Treat process/_seeds/ as an optional legacy scaffold surface in the live repo. Its absence is a warning-only audit result unless the user is explicitly auditing export-kit scaffolding.
Treat validator warnings as audit findings unless the user asks for a strict cleanup.
For context routing and discoverability audits, delegate to audit-context.

想直接用这个技能？

本站把开放许可（MIT / Apache 等）的技能按仓库打包整理到网盘，点一下转存到你自己的网盘，不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接，不打包。

去原始仓库

它属于哪个仓库

仓库withkynam/vibecode-pro-max-kit

星标★ 1,129

本站分层T1

该仓技能数33

原文件路径.claude/skills/vc-audit-vc/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 33 个技能