dsh-plugin-review SKILL.md skillA
dsh-plugin-review from taxueseek/plugin-fast-adapt is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add taxueseek/plugin-fast-adapt/dsh-plugin-review@git:20261106.37bd500Pins git:20261106.37bd500 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- taxueseek/plugin-fast-adapt
- Path
sub-skills/review/SKILL.md- Versions recorded
- 5
- Latest version
- git:20261106.37bd500, committed Nov 6, 2026
- First version recorded
- Nov 5, 2026
- Size
- 11,588 bytes
- Repository stars
- 12
- License
- MIT
DSH 插件代码审查与防御性架构审核车道。基于 Git 范围或工作区源码，检查 Cordis 生命周期泄漏、未逆向注销、单例状态漂移、已废弃模板变量（如 {{cwd}}）、Vendored Peer 依赖污染、准入账本覆盖，按 P0/P1/P2/P3 输出精炼结构化报告；提供子 Agent 隔离委派协议（Sub-agent Dispatch Pattern），在后台沙箱运行紧凑分析并回传精炼结果，防止主会话上下文污染。触发词：代码审查、代码审核、code review、插件体检、防御性审查、生命周期检查、单例泄漏、Peer污染、子Agent审查、紧凑报告。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 代码审查与防御性架构车道
在插件适配或交付前，对代码进行深度架构审计。重点排查 Cordis 生命周期泄漏、单例漂移、Vendored Peer 依赖污染以及废弃 API，按统一严重度（P0/P1/P2/P3）给出明确判定。
同时定义**子 Agent 隔离委派协议（Sub-Agent Dispatch Pattern）**：当面对复杂插件或批量巡检时，主 Agent 派发独立子 Agent 执行重型静态分析与冒烟，仅回传结构化紧凑报告（`<20` 行），避免海量日志填满主会话上下文。
以下命令都相对工具根目录执行，工具根即本文件真实路径往上两级、含 `scripts/` 的那一层。脚本用自身文件的绝对路径定位，不必先 cd。`<插件目录>` 指被查插件的仓库根。
## 第一步：会话内极速体检
```sh
node scripts/plugin-audit.mjs <插件目录> --compact
```
使用 `--compact` 参数时，脚本仅输出高密度结构化 JSON 摘要与关键结论，屏蔽全量文件遍历噪音：
```json
{
"plugin": "my-plugin@1.0.0",
"overallScore": 95,
"scores": { "performance": 100, "resilience": 90, "contextBudget": 100, "lifecycle": 90 },
"priorityCounts": { "P0": 0, "P1": 1, "P2": 0, "P3": 0 },
"blockers": [
{
"priority": "P1",
"dimension": "lifecycle",
"file": "lib/index.js",
"title": "事件监听或定时器未绑定清理逻辑",
"detail": "Cordis 插件重载时未清理的监听器与定时器会泄漏，建议注册进 ctx.effect 或提供 dispose。"
}
]
}
```
## 第二步：子 Agent 隔离委派协议（Sub-Agent Dispatch Pattern）
当审查整个插件仓库或运行全流程适配验证时，主 Agent 应按以下协议委派后台子 Agent：
1. **派发子 Agent**：通过 `subagent`（或需要继承本会话上下文时用 `subagent_fork`）唤醒子 Agent，指定只读工作区；需要长期跟进时给它一个 `name`，后续用名字寻址；
2. **执行紧凑流水线**：
```sh
node scripts/run.mjs <插件目录> --compact
…Read the whole file at its exact version.
How to install
mdr add taxueseek/plugin-fast-adapt/dsh-plugin-review@sha256:fbe97dce73b91542The line at the top of this page pins the label git:20261106.37bd500, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_5ol3ydztkbmscxix)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Nov 5, 2026 and Nov 6, 2026, more than one a day.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261106.37bd500 latest | 2026-11-06 | 37bd500 | 11,588 B | A | view · diff |
| git:20261105.93dc82c | 2026-11-05 | 93dc82c | 10,939 B | A | view · diff |
| git:20261105.d7d824c | 2026-11-05 | d7d824c | 10,633 B | A | view · diff |
| git:20261105.b445efd | 2026-11-05 | b445efd | 8,940 B | A | view · diff |
| git:20261105.b43a092 | 2026-11-05 | b43a092 | 8,277 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (11588 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
taxueseek/plugin-fast-adapt · 12 stars · license MIT · pushed 2026-11-06 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_5ol3ydztkbmscxix GET https://markdownregistry.com/api/v1/resolve?ref=taxueseek/plugin-fast-adapt/dsh-plugin-review GET https://markdownregistry.com/api/v1/blob/fbe97dce73b91542d72e4db7fdde9d9242b7aeec2620e96054f3950e8315768f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.