技能质量审计_skills-audit

以下为本文档的中文说明skills-audit 是一个用于审计和评估 LobeHub 生态系统中技能Skills质量的工具。LobeHub 是一个开源的 AI 助手平台支持丰富的插件和技能扩展机制开发者可以为其创建各种功能技能。该技能的核心功能是对已注册的技能进行全面的质量检查包括代码质量、文档完整性、安全性和兼容性等方面。使用场景包括在将新技能发布到 LobeHub 市场前进行质量审查、定期审计已有技能的运行状态和兼容性、评估技能是否符合社区标准和质量规范。核心特点包括自动检测技能的基本元数据完整性包括名称、描述、版本号、作者信息等必要字段的完整性检查技能配置文件是否符合 LobeHub 的 Schema 规范验证技能的 API 接口定义和参数设置是否正确包括输入输出的类型匹配评估技能的安全风险检测可能存在的注入漏洞、敏感信息泄露或不安全的默认配置生成结构化的审计报告标注问题等级严重、警告、建议并提供修复建议。该技能帮助维护 LobeHub 技能市场的整体质量水平。此外该技能还支持审计历史的追踪和趋势分析帮助团队持续监控技能质量的改进情况并提供与 LobeHub CI/CD 流水线的集成方案实现自动化质量门禁。Skills AuditPeriodic review of the project-local skill set under.agents/skills/. The goal is to catch drift before the catalog becomes confusing — too many skills, overlapping triggers, descriptions that no longer match the body, references to skills that were renamed/deleted.Recommended cadence:weekly, or after any week where 1 skill was added/renamed.Procedure1 — InventoryBuild a fresh census of all SKILL.md files. Do NOT trust any prior cached list.find.agents/skills-nameSKILL.md|wc-l# total countfind.agents/skills-nameSKILL.md-execwc-l{}\\;|sort-rn# by body lengthGroup by domain in a mental table (DB / state / UI / agent / testing / workflow / docs / etc.). Note new arrivals since last audit (git log --since1 week ago -- .agents/skills/).2 — Pull frontmatter for all skills# Extract name description for each SKILL.mdforfin.agents/skills/*/SKILL.md;doecho$(basename$(dirname $f))awk/^---$/{c; next} c1$f|head-20doneRead the description block of every skill. The body can stay unread unless step 4 flags it.3 — Detect overlap / redundancyFor each pair within the same domain, ask:Same description? → likely duplicate (one is probably a stale rename leftover, or a global-vs-local collision).Trigger keywords substantially overlap? → either merge, OR tighten one description so the model can choose unambiguously.One skill’s body says “see also: foo”? → confirmfoostill exists, AND confirm the cross-reference is still meaningful (the referenced skill may have absorbed the referrer’s concerns).Skill duplicates content fromAGENTS.md? → fold into AGENTS.md or slim the skill to just the delta.Common false positives (do NOT merge):db-migrationsvsdrizzle— distinct workflows (migration files vs schema authoring).microcopyvsi18n— content vs mechanics.agent-runtime-hooksvsagent-tracingvsagent-signal— different surfaces of the agent system.testingvslocal-testingvscli-backend-testing— different test types.4 — Description format consistencyApply thestandard template:{Topic key conventions or scope}. Use when {scenarios — verbs nouns}. Triggers on {code-symbols, natural phrases, 中文}.Skills withdisable-model-invocation: true(user-invoked only, slash commands) don’t needTriggers on— they’re never auto-routed.Flag descriptions that:❌ Have NOUse whenclause (model can’t decide when to load it).❌ Have NOTriggers onclause (and aren’tdisable-model-invocation).❌ Use weird formats (numbered lists(1)(2)(3),Triggers:colon instead ofTriggers on,MUST use when ...as opening word).❌ Are dramatically terse for a 200 line body, or dramatically verbose for a 60-line body.❌ Reference deleted/renamed skills.5 — Stale-skill checkFor narrow domain skills (e.g.response-compliance, one-off CLI workflows):# Confirm the referenced code surface still existsrg-lresponse-compliance|openresponsespackages/ src/# adjust per skillgitlog--since3 months ago-- .agents/skills/skill/SKILL.md# is it being maintained?If the underlying surface is gone and the skill hasn’t been edited in 3 months → flag for archival.6 — Cross-reference integrityAny skill body mentioning another skill by name:# Scan all skill bodies for skill-name referencesrg-o[a-z][a-z0-9-].agents/skills/*/SKILL.md|grep-v:\\s*$|sort-uFor each name extracted, confirm.agents/skills/name/SKILL.mdexists. Broken references happen after renames — fix them in the same audit pass.7 — Output reportProduce a markdown summary back to the user with the same structure as the original audit (this skill was created during one):## Inventory {count, domain breakdown} ## Recommendations ### High confidence - { action} — {reason} ### Medium confidence - {action} — {reason needs verification} ### Low confidence / no-op - {item considered but skipping because ...} ## Suggested order {table of actions with risk LOC estimate}End by asking the user which actions to apply — do NOT auto-apply unless the user passed--applyand even then confirm destructive deletes individually.Output rulesBe specific. “Skill X overlaps with Y” is useless without naming the overlapping triggers.Cite line numbers when flagging description / body issues.Don’t recommend merges unless the call sites would actually load the merged skill in the same context.Don’t recommend deletes for skills that haven’t been touched recently — “unused” can mean “stable”, not “dead”.What NOT to do❌ Don’t rename skill directories without checking for cross-references AND user memory entries that name the old slug.❌ Don’t normalize a description by removing trigger keywords just to fit the template — the keywords are the routing signal.❌ Don’t fold a heavy 200 line skill into another just because they share a domain — large skills get loaded selectively and merging makes everything load.❌ Don’t propose.agents/skills/INDEX.mdordomain-skillprefix renames unless the user explicitly asks — costs benefits for cosmetic reorgs.Related historyFirst audit:chore/skills-auditbranch (2026-05-25) — deletedsource-command-dedupe, renameddata-fetching→data-fetching-architecture, normalized 9 descriptions, created this skill.3e:[“,,,L41”,null,{“content”:“$42”,“frontMatter”:{“name”:“skills-audit”,“description”:“Audit .agents/skills SKILL.md files. Use for recurring checks of duplicate, overlapping, stale, inconsistent, or broken skills and merge/delete candidates.”,“disable-model-invocation”:true,“argument-hint”:“[–verbose | --apply]”}}]3f:[“KaTeX parse error: Expected }, got EOF at end of input: …,children:[[”,“div”,null,{“className”:“flex items-center justify-between border-b border-border bg-muted/30 px-4 py-2.5”,“children”:[[“KaTeX parse error: Expected }, got EOF at end of input: …,children:[”,“span”,null,{“className”:“truncate text-xs font-medium text-muted-foreground”,“children”:“同仓库更多 Skills”}]}],[“KaTeX parse error: Expected EOF, got } at position 88: …ldren:同仓库}]]}̲],[”,“div”,null,{“className”:“p-4 sm:p-5”,“children”:[[“,h2,null,id:related−skills−heading,className:text−2xlfont−semiboldtracking−normaltext−foreground,children:同仓库更多Skills],[,h2,null,{id:related-skills-heading,className:text-2xl font-semibold tracking-normal text-foreground,children:同仓库更多 Skills}],[,h2,null,id:related−skills−heading,className:text−2xlfont−semiboldtracking−normaltext−foreground,children:同仓库更多Skills],[”,“div”,null,{“className”:“mt-4 grid gap-3 sm:grid-cols-2”,“children”:[“L43,L43,L43,L44”,“L45,L45,L45,L46”,“L47,L47,L47,L48”]}]]}]]}]49:I[206516,[“/_next/static/chunks/051aanbhrv4br.js”,“/_next/static/chunks/0mizr60h7ayzt.js”,“/_next/static/chunks/0v9lm1dmbdoo-.js”,“/_next/static/chunks/0rxr1j1j3j-.r.js”,“/_next/static/chunks/02ftybezfvqjd.js”,“/_next/static/chunks/0.v9ksvnnj8ia.js”,“/_next/static/chunks/0bn6id96nx3k.js,“/_next/static/chunks/13ybnhn37c.tc.js”,“/_next/static/chunks/0_fnrdtruz8uf.js”,“/_next/static/chunks/0r6l15utt1mwb.js”,“/_next/static/chunks/0dm9a5into854.js”,/_next/static/chunks/07k6hqoibtcn.js”,“/next/static/chunks/0b4cao.4y…j.js”,“/_next/static/chunks/02i-n28z7kjd0.js”],“default”]