skill-audit

宿主：Codex CLI — 此技能最初为 Claude Code 设计，后适配至 Codex。 交叉引用的命令在 Codex 中使用已安装的技能名称，而不是 /octo:* 斜杠命令。 使用当前 Codex shell 和子 Agent 工具。除非当前会话已提供相应能力，否则不要声称可使用某个提供方、模型或宿主子 Agent。 宿主工具的对应项，请参阅 skills/blocks/codex-host-adapter.md。

系统化审计流程

从已安装的插件中加载 skills/blocks/engineering-method-selection.md， 并仅应用与此任务相关的方法。保留此入口点的执行约定和输出格式。将引用的技能作为说明阅读； 不要递归调用当前命令，也不要擅自添加提供方调用。

概述

全面、系统地审计代码库，查找问题、不一致之处和失效功能。

核心原则： 明确范围 → 创建检查清单 → 系统执行 → 报告发现 → 确定修复优先级。

对于架构简化，请加载 skills/blocks/architecture-simplification.md。固定修订版本，检查近期代码变更 和有代表性的调用方，然后应用删除测试。如果某个小型封装集中处理了安全、清理、优先级或故障不变条件，不要建议将其移除。给出 simplify 结论时，需要提供源码证据、具体调用方以及迁移和回滚步骤。

适用场景

用户希望进行以下操作时使用此技能：

• 审计整个应用中的问题
• 查找某种问题模式的所有实例
• 系统地检查功能是否失效
• 全面验证质量
• 找出代码库中的不一致之处

以下情况不要使用：

• 扫描安全漏洞（使用 skill-security-audit）
• 进行代码质量审查（使用 skill-code-review）
• 搜索单个文件（直接使用 Grep/Glob）
• 进行性能分析

流程

阶段 1：定义范围

步骤 1：了解审计目标

**Audit Objectives:**

What to audit: [app features, code patterns, specific issues]
Why auditing: [what prompted this, what problem are we solving]
Scope: [entire app, specific module, particular feature set]
Depth: [surface-level or deep inspection]

步骤 2：定义审计标准

必要时使用 AskUserQuestion：

**Audit Focus:**

Which aspects should I audit?
1. Functional - Do features work as expected?
2. Consistency - Are patterns applied uniformly?
3. Completeness - Are implementations finished?
4. Quality - Is code maintainable?
5. User-facing - Does UI/UX work correctly?
6. Integration - Do components work together?

步骤 3：制定审计计划

**Audit Plan**

**Areas to Cover:**
1. [Area 1: e.g., All form submissions]
2. [Area 2: e.g., All API endpoints]
3. [Area 3: e.g., All button states]
4. [Area 4: e.g., All error handling]

**Methodology:**
- [ ] Identify all instances
- [ ] Test each systematically
- [ ] Document findings
- [ ] Categorize by severity
- [ ] Propose fixes

**Estimated Coverage:** [X components, Y files, Z features]

阶段 2：发现

步骤 1：确定审计目标

使用 Glob 和 Grep 查找所有相关代码：

**Finding Audit Targets:**

Searching for: [pattern/feature]
Method: [glob pattern or grep query]

**Found:**
1. [File 1:line]
2. [File 2:line]
3. [File 3:line]
...
N. [File N:line]

Total instances: [N]

步骤 2：创建审计检查清单

**Audit Checklist:**

- [ ] Item 1: [component/feature to check]
  - Location: [file:line]
  - Expected: [what should happen]
  - Test: [how to verify]

- [ ] Item 2: [component/feature to check]
  - Location: [file:line]
  - Expected: [what should happen]
  - Test: [how to verify]

...

Total items to audit: [N]

使用任务计划工具跟踪审计进度。

阶段 3：系统执行

步骤 1：执行审计检查清单

针对每一项：

**Auditing Item [N]/[Total]: [Description]**

**Location:** [file:line]

**Check 1: [Test name]**
- Expected: [what should happen]
- Method: [how to test - code review, runtime check, etc.]
- Result: ✓ Pass / ❌ Fail
- Evidence: [what you observed]

**Check 2: [Test name]**
- Expected: [what should happen]
- Method: [how to test]
- Result: ✓ Pass / ❌ Fail
- Evidence: [what you observed]

**Overall Status:** ✓ Pass / ⚠️ Issues Found / ❌ Broken

**Issues:**
[If any issues, list them here]

步骤 2：跟踪进度

Audit Progress:
✓ [1/50] User login form
✓ [2/50] Password reset form
⚠️ [3/50] Registration form (issues found)
❌ [4/50] Contact form (broken)
⚙️ [5/50] Newsletter signup (in progress)
- [6/50] Survey form
...

阶段 4：分析与报告

步骤 1：对发现的问题分类

**Audit Findings Summary**

**Critical Issues (Broken Functionality):**
1. [Issue 1]
   - Location: [file:line]
   - Impact: [what's broken]
   - Severity: Critical

2. [Issue 2]
   - Location: [file:line]
   - Impact: [what's broken]
   - Severity: Critical

**Major Issues (Degraded Functionality):**
1. [Issue 1]
   - Location: [file:line]
   - Impact: [what's wrong]
   - Severity: Major

**Minor Issues (Inconsistencies/Polish):**
1. [Issue 1]
   - Location: [file:line]
   - Impact: [what's inconsistent]
   - Severity: Minor

**Passed Checks:**
- [N] items fully functional
- [List if relevant]

步骤 2：提供统计数据

**Audit Statistics**

Total Items Audited: [N]
✓ Passed: [N] ([X%])
⚠️ Issues Found: [N] ([X%])
❌ Broken: [N] ([X%])

**By Category:**
- Critical: [N]
- Major: [N]
- Minor: [N]

**Coverage:**
- Files reviewed: [N]
- Components tested: [N]
- Code paths verified: [N]

阶段 5：修复计划

步骤 1：确定问题优先级

**Recommended Fix Priority:**

**Phase 1: Critical Fixes (Do First)**
1. [Issue - file:line]
   - Why critical: [reason]
   - Estimated effort: [time]

2. [Issue - file:line]
   - Why critical: [reason]
   - Estimated effort: [time]

**Phase 2: Major Fixes (Do Next)**
1. [Issue - file:line]
   - Impact: [description]
   - Estimated effort: [time]

**Phase 3: Minor Fixes (Nice to Have)**
1. [Issue - file:line]
   - Impact: [description]
   - Estimated effort: [time]

**Total Estimated Effort:** [sum of all fixes]

步骤 2：提出执行修复

**Next Steps:**

I found [N] issues during the audit.

Would you like me to:
1. Fix all critical issues now (estimated [time])
2. Fix issues one category at a time (critical → major → minor)
3. Let you review findings first, then decide what to fix
4. Create detailed tickets/todos for each issue

What's your preference?

常见模式

模式 1：审计整个应用中的失效功能

User: "Create a process to audit and check the entire app for things that might be broken"

Implementation:

**Phase 1: Scope**
- Audit all user-facing features
- Check for runtime errors
- Verify expected behavior

**Phase 2: Discovery**
- List all features (from routes, components, docs)
- Create comprehensive checklist

**Phase 3: Execute**
- Test each feature systematically
- Document working vs broken

**Phase 4: Report**
- Critical: Features that crash
- Major: Features that work incorrectly
- Minor: Features with UX issues

**Phase 5: Fix**
- Prioritized remediation plan

模式 2：审计特定模式

User: "Find all instances of direct DOM manipulation and check if they should use React state"

Implementation:

**Phase 1: Scope**
- Audit: Direct DOM manipulation patterns
- Goal: Identify React anti-patterns

**Phase 2: Discovery**
- Grep for: document.querySelector, getElementById, etc.
- Found: [N] instances

**Phase 3: Execute**
- Check each instance:
  - Is there a good reason for direct DOM?
  - Should it use React state instead?
  - Is it causing bugs?

**Phase 4: Report**
- List instances that should migrate to React
- List instances that are fine as-is

**Phase 5: Fix**
- Refactor problematic instances

模式 3：一致性审计

User: "Audit the app for button style consistency"

Implementation:

**Phase 1: Scope**
- Audit: All button elements
- Goal: Ensure consistent styling

**Phase 2: Discovery**
- Find all buttons in codebase
- Identify button component(s)

**Phase 3: Execute**
- Check each button against style guide
- Document inconsistencies

**Phase 4: Report**
- Buttons using correct component: [N]
- Buttons with inconsistent styles: [N]
- Buttons using deprecated patterns: [N]

**Phase 5: Fix**
- Standardize all buttons to design system

与其他技能集成

与 skill-debug 集成

Audit found a broken feature?
→ Use skill-debug to investigate root cause
→ Use systematic debugging to fix

与 skill-visual-feedback 集成

Audit found UI inconsistencies?
→ Use skill-visual-feedback to fix visual issues
→ Ensure consistency across app

与 skill-iterative-loop 集成

Large audit with many items?
→ Use skill-iterative-loop to process in batches
→ Loop through sections of the app

与 skill-security-audit 集成

Audit includes security concerns?
→ Delegate security-specific checks to skill-security-audit
→ Use skill-audit for functional checks

最佳实践

1. 系统开展，不要随意检查

良好做法：

Auditing all form submissions:
1. Login form
2. Registration form
3. Password reset form
4. Contact form
5. Newsletter signup
...
(Methodical, complete)

不佳做法：

Checking some forms:
- Login form
- Maybe that contact thing
- Whatever else I find
(Random, incomplete)

2. 记录所有内容

对于每项审计，记录：

• 检查了什么
• 如何检查
• 结果（通过/失败）
• 证据（观察到的内容）

3. 使用分类

将发现的问题归入有意义的类别：

• 按严重程度（严重、主要、次要）
• 按类型（功能、UI、一致性、性能）
• 按组件（表单、导航、数据显示）

4. 确保发现的问题可执行

良好做法：

Issue: Registration form submit button doesn't work
Location: src/components/RegisterForm.tsx:45
Root cause: onClick handler missing
Fix: Add onClick={handleSubmit}
Effort: 5 minutes

不佳做法：

Issue: Some button broken somewhere
Fix: Fix it

危险信号——不要这样做

操作	错误原因
跳过创建检查清单	会遗漏事项、重复工作
不按系统方法随机测试	覆盖不完整
不记录发现	无法在之后确定优先级或修复
审查时没有明确标准	不知道什么算“通过”
审查时顺手修复	混淆审查与整改
忽略模式	会遗漏系统性问题

审查模板

模板 1：功能审查

**Feature:** [Name]
**Location:** [file:line]

**Tests:**
- [ ] Feature loads without errors
- [ ] Feature responds to user input
- [ ] Feature displays correct data
- [ ] Feature handles errors gracefully
- [ ] Feature works on mobile
- [ ] Feature is accessible

**Result:** ✓ Pass / ⚠️ Issues / ❌ Broken
**Issues:** [if any]

模板 2：代码模式审查

**Pattern:** [What to check]
**Instance:** [file:line]

**Checks:**
- [ ] Follows current best practices
- [ ] Consistent with codebase
- [ ] No deprecated APIs used
- [ ] Properly typed/documented
- [ ] No obvious bugs

**Result:** ✓ Good / ⚠️ Needs update / ❌ Problematic
**Notes:** [any observations]

模板 3：UI 一致性审查

**Component:** [Name]
**Location:** [file:line]

**Checks:**
- [ ] Uses design system components
- [ ] Follows spacing guidelines
- [ ] Uses correct colors
- [ ] Typography consistent
- [ ] Responsive design works
- [ ] States handled (hover, active, disabled)

**Result:** ✓ Consistent / ⚠️ Minor issues / ❌ Inconsistent
**Issues:** [if any]

快速参考

审查类型	发现方法	检查方法	输出
功能	列出功能	逐项测试	通过/失败报告
模式	使用 grep 搜索代码	逐项审查	合规/不合规
一致性	找出所有实例	与标准对比	一致/不一致
完整性	列出要求	逐项核实是否存在	完整/不完整

归根结底

Systematic audit → Complete checklist + Methodical execution + Prioritized findings
Otherwise → Missed issues + Duplicate work + No clear action plan

明确范围。创建检查清单。系统地执行。报告发现。确定修复优先级。