Home / majiayu000 / spellbook · GitHub

codebase-audit SKILL.md skillA

codebase-audit from majiayu000/spellbook is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned

mdr add majiayu000/spellbook/codebase-audit@git:20261007.31bf196

Pins git:20261007.31bf196 in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 17 of 17 checks passed
Kind: SKILL.md skill
Repository: majiayu000/spellbook
Path: skills/codebase-audit/SKILL.md
Versions recorded: 6
Latest version: git:20261007.31bf196, committed Oct 7, 2026
First version recorded: Apr 1, 2026
Size: 11,373 bytes
Repository stars: 290
License: MIT

全面代码库审计 — 自适应并行深度分析（前后端契约、数据完整性、异常处理/安全、架构/技术债、配置/缓存），结构化 findings + 对抗验证 + 基线对比，输出按严重程度排序的统一报告和修复路线图。支持 quick 快速体检模式。Use when user asks to audit, analyze, or review an entire codebase for design issues, find hidden bugs, check architecture health, or asks '全面审查', '代码库审计', '分析设计问题', 'audit codebase', 'health check', '有哪些问题', '快速体检'. Also trigger when user asks to find silent degradation, data flow breakpoints, type mismatches between frontend and backend, or wants to understand technical debt…

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Codebase Audit — Adaptive Deep Analysis

Comprehensive codebase audit that adapts its agent configuration to the project's tech stack, forces structured findings, adversarially verifies Critical/High findings before they enter the report, diffs against the previous audit's ledger (resolved / still-open / new), and outputs a severity-sorted report plus a phased repair roadmap.

## Core Principles

1. **READ-ONLY** — Audit agents must never create, modify, or delete files in the target. Every agent prompt starts with the read-only preamble in `references/agent-prompts.md`.
2. **Inherit the session model** — Omit the `model` param on all agents so they inherit the session model (usually the strongest available). Only override *upward* if the session model is clearly weak for cross-file reasoning. Never hardcode a specific model name in this skill.
3. **Depth over breadth** — Fewer agents with broader merged scopes beat many shallow agents. Each agent traces issues across file boundaries.
4. **Adaptive** — Agent count and dimensions vary by stack and mode.
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add majiayu000/spellbook/codebase-audit@sha256:77bbe19ddedda2b4

The line at the top of this page pins the label git:20261007.31bf196, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_jaf4xmxy5bjxbq5o.svg)](https://markdownregistry.com/a/art_jaf4xmxy5bjxbq5o)

3 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 6 versions of this file, between Apr 1, 2026 and Oct 7, 2026, about one every 38 days.

version	committed	commit	size	audit
git:20261007.31bf196 latest	2026-10-07	31bf196	11,373 B	A	view · diff
git:20260703.eebadde	2026-07-03	eebadde	11,129 B	A	view · diff
git:20260612.95a036c	2026-06-12	95a036c	12,681 B	A	view · diff
git:20260612.2e0eee9	2026-06-12	2e0eee9	12,531 B	A	view · diff
git:20260612.edaddc8	2026-06-12	edaddc8	11,969 B	A	view · diff
git:20260401.b4dee1b	2026-04-01	b4dee1b	7,532 B	A	view

Audit of the latest version

A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (11373 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

majiayu000/spellbook · 290 stars · license MIT · pushed 2026-11-04 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_jaf4xmxy5bjxbq5o
GET https://markdownregistry.com/api/v1/resolve?ref=majiayu000/spellbook/codebase-audit
GET https://markdownregistry.com/api/v1/blob/77bbe19ddedda2b42e68c5266ba1960c14c9d53d4492c91e64f3c37c8c944bd2

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from majiayu000/spellbook

AGENTS.md AGENTS.md file

majiayu000/spellbook · AGENTS.md

git:20260630.1f0cf93 · audit A · 290 stars

idea-analogist SKILL.md skill

majiayu000/spellbook · plugins/idea-coach/skills/idea-analogist/SKILL.md · 想法群聊室 — 类比者角色。被 idea-team 主编排器调用，或用户单独说"类比一下"、"别的行业有没有"、"yes-and 扩展"、"X 让你想到什么"、"跨界启示"时触发。**专门做跨界类比 + yes-and…