Home / devcodex-labs / devcodex · GitHub

audit-project SKILL.md skillA

audit-project from devcodex-labs/devcodex is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned

mdr add devcodex-labs/devcodex/audit-project@git:20260730.6ee304a

Pins git:20260730.6ee304a in mdr.lock. Pin the fingerprint instead.

Audit grade: A, 17 of 17 checks passed
Kind: SKILL.md skill
Repository: devcodex-labs/devcodex
Path: content/skills/audit-project/SKILL.md
Versions recorded: 1
Latest version: git:20260730.6ee304a, committed Jul 30, 2026
Size: 6,585 bytes
Repository stars: 432
License: AGPL-3.0

项目工程审查维度 PE-1~PE-12 — 代码质量/项目结构/依赖安全/资源泄漏专属审查层.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Audit Project Skill

## 适用范围

审查目标为**项目工程**（源码质量、目录结构、依赖健康、测试覆盖）时，叠加本 Skill（在 G1~G5 之后）。

## 维度总览（PE-1~PE-12）

| 分组 | 维度 | 优先级 |
|------|------|:------:|
| A — 结构与可维护性 | PE-1 项目结构合理性 · PE-5 可维护性 | 🔴/🟡 |
| B — 健壮性 | PE-2 错误处理完整性 · PE-3 安全性 · PE-4 性能隐患 · PE-12 资源生命周期与泄漏风险 | 🔴/🟡 |
| C — 接口与配置 | PE-8 接口一致性 · PE-10 配置管理 | 🔴/🟡 |
| D — 质量保障 | PE-6 测试覆盖 · PE-7 依赖健康度 | 🟡/💡 |
| E — 可观测性与数据 | PE-9 日志与可观测性 · PE-11 数据层质量 | 🟡 |

## 核心检查维度

**PE-0 Profile Freshness 衔接 🔴**
- 先执行 `audit-common` 的 `Profile Freshness Check（PFresh）`
- 不只检查“项目是否符合 Profile”，还要反向检查 Profile 是否仍符合当前 package、目录结构、脚本清单、发布状态、宿主能力和当前任务现实
- 若 Profile 过期，项目工程审查结论不得直接标注收敛；需先记录漂移或同步要求

**PE-1 项目结构合理性 🔴**
- 目录结构与 profile `02-架构约束.md` 一致
- 模块/文件职责单一（不混合路由/业务/数据层）
- 函数/方法长度 ≤50 行，嵌套深度 ≤4 层
- 无循环依赖
- 简单业务 service 不重复 route validate、model/schema、数据导入或框架已承担的校验、归一化、配置兜底和二次治理

**PE-2 错误处理完整性 🔴**
- 异步操作有 catch 处理
- 外部依赖调用有超时和重试策略
- 错误信息不暴露内部细节

**PE-3 安全性 🔴**
- 敏感信息、密钥、密码和硬编码处理符合用户 / 项目显式策略；未指定禁止时不把直写本身列为问题
- 输入验证覆盖边界条件
- SQL/NoSQL 查询无注入风险
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint

mdr add devcodex-labs/devcodex/audit-project@sha256:1c50aebcb2262b1d

The line at the top of this page pins the label git:20260730.6ee304a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

[![mdr](https://markdownregistry.com/badge/art_kor4jhkwdohoecay.svg)](https://markdownregistry.com/a/art_kor4jhkwdohoecay)

3 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 1 version of this file, committed on Jul 30, 2026.

version	committed	commit	size	audit
git:20260730.6ee304a latest	2026-07-30	6ee304a	6,585 B	A	view

Audit of the latest version

A 17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.

pass: Frontmatter block present
pass: Frontmatter declares a name
pass: Frontmatter declares a description
pass: Size between 200 bytes and 200 KB (6585 bytes)
pass: No zero-width or bidi control characters
pass: No instruction hidden inside an HTML comment
pass: No link to an exfiltration or paste host
pass: No credential-shaped string
pass: No instruction to send local credentials anywhere
pass: No text hidden with inline styles
pass: No prompt-injection phrasing
pass: No curl or wget piped into a shell
pass: No recursive delete of root, home or parent
pass: No instruction to read or print local credentials
pass: No base64 blob over 200 characters
pass: No link to a raw IP address
pass: No script tag

Source

GitHub

devcodex-labs/devcodex · 432 stars · license AGPL-3.0 · pushed 2026-10-27 · branch main

API

GET https://markdownregistry.com/api/v1/artifacts/art_kor4jhkwdohoecay
GET https://markdownregistry.com/api/v1/resolve?ref=devcodex-labs/devcodex/audit-project
GET https://markdownregistry.com/api/v1/blob/1c50aebcb2262b1dba5df4d043d006c2da381ae79d9049250480468cc909933f

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from devcodex-labs/devcodex

accessibility-i18n SKILL.md skill

devcodex-labs/devcodex · content/skills/accessibility-i18n/SKILL.md · 无障碍与国际化专家 Owner — 当任务涉及可访问性、键盘操作、焦点、屏幕阅读器、ARIA、语言地区、本地化、RTL、翻译资源、用户可见文案或多语言文档时使用；要求把包容性体验和本地化验证绑定到真实用户路径。