技能质量审计_skills-audit

以下为本文档的中文说明

skills-audit 是一个用于审计和评估 LobeHub 生态系统中技能（Skills）质量的工具。LobeHub 是一个开源的 AI 助手平台，支持丰富的插件和技能扩展机制，开发者可以为其创建各种功能技能。该技能的核心功能是对已注册的技能进行全面的质量检查，包括代码质量、文档完整性、安全性和兼容性等方面。使用场景包括：在将新技能发布到 LobeHub 市场前进行质量审查、定期审计已有技能的运行状态和兼容性、评估技能是否符合社区标准和质量规范。核心特点包括：自动检测技能的基本元数据完整性，包括名称、描述、版本号、作者信息等必要字段的完整性；检查技能配置文件是否符合 LobeHub 的 Schema 规范；验证技能的 API 接口定义和参数设置是否正确，包括输入输出的类型匹配；评估技能的安全风险，检测可能存在的注入漏洞、敏感信息泄露或不安全的默认配置；生成结构化的审计报告，标注问题等级（严重、警告、建议），并提供修复建议。该技能帮助维护 LobeHub 技能市场的整体质量水平。此外，该技能还支持审计历史的追踪和趋势分析，帮助团队持续监控技能质量的改进情况，并提供与 LobeHub CI/CD 流水线的集成方案，实现自动化质量门禁。

Skills Audit

Periodic review of the project-local skill set under.agents/skills/. The goal is to catch drift before the catalog becomes confusing — too many skills, overlapping triggers, descriptions that no longer match the body, references to skills that were renamed/deleted.

Recommended cadence:weekly, or after any week where >1 skill was added/renamed.

Procedure

1 — Inventory

Build a fresh census of all SKILL.md files. Do NOT trust any prior cached list.

find.agents/skills-nameSKILL.md|wc-l# total countfind.agents/skills-nameSKILL.md-execwc-l{}\\;|sort-rn# by body length

Group by domain in a mental table (DB / state / UI / agent / testing / workflow / docs / etc.). Note new arrivals since last audit (git log --since="1 week ago" -- .agents/skills/).

2 — Pull frontmatter for all skills

# Extract name + description for each SKILL.mdforfin.agents/skills/*/SKILL.md;doecho"===$(basename$(dirname $f))==="awk'/^---$/{c++; next} c==1'"$f"|head-20done

Read the description block of every skill. The body can stay unread unless step 4 flags it.

3 — Detect overlap / redundancy

For each pair within the same domain, ask:

• Same description? → likely duplicate (one is probably a stale rename leftover, or a global-vs-local collision).
• Trigger keywords substantially overlap? → either merge, OR tighten one description so the model can choose unambiguously.
• One skill’s body says “see also: foo”? → confirmfoostill exists, AND confirm the cross-reference is still meaningful (the referenced skill may have absorbed the referrer’s concerns).
• Skill duplicates content fromAGENTS.md? → fold into AGENTS.md or slim the skill to just the delta.

Common false positives (do NOT merge):

• db-migrationsvsdrizzle— distinct workflows (migration files vs schema authoring).
• microcopyvsi18n— content vs mechanics.
• agent-runtime-hooksvsagent-tracingvsagent-signal— different surfaces of the agent system.
• testingvslocal-testingvscli-backend-testing— different test types.

4 — Description format consistency

Apply thestandard template:

{Topic + key conventions or scope}. Use when {scenarios — verbs + nouns}. Triggers on {`code-symbols`, 'natural phrases', '中文'}.

Skills withdisable-model-invocation: true(user-invoked only, slash commands) don’t needTriggers on— they’re never auto-routed.

Flag descriptions that:

• ❌ Have NOUse whenclause (model can’t decide when to load it).
• ❌ Have NOTriggers onclause (and aren’tdisable-model-invocation).
• ❌ Use weird formats (numbered lists(1)(2)(3),Triggers:colon instead ofTriggers on,MUST use when ...as opening word).
• ❌ Are dramatically terse for a 200+ line body, or dramatically verbose for a 60-line body.
• ❌ Reference deleted/renamed skills.

5 — Stale-skill check

For narrow domain skills (e.g.response-compliance, one-off CLI workflows):

# Confirm the referenced code surface still existsrg-l"response-compliance|openresponses"packages/ src/# adjust per skillgitlog--since="3 months ago"-- .agents/skills/<skill>/SKILL.md# is it being maintained?

If the underlying surface is gone and the skill hasn’t been edited in 3+ months → flag for archival.

6 — Cross-reference integrity

Any skill body mentioning another skill by name:

# Scan all skill bodies for skill-name referencesrg-o'`[a-z][a-z0-9-]+`'.agents/skills/*/SKILL.md|grep-v':\\s*$'|sort-u

For each name extracted, confirm.agents/skills/<name>/SKILL.mdexists. Broken references happen after renames — fix them in the same audit pass.

7 — Output report

Produce a markdown summary back to the user with the same structure as the original audit (this skill was created during one):

## 📊 Inventory {count, domain breakdown} ## 🎯 Recommendations ### 🔴 High confidence - { action} — {reason} ### 🟡 Medium confidence - {action} — {reason needs verification} ### 🟢 Low confidence / no-op - {item considered but skipping because ...} ## 📋 Suggested order {table of actions with risk + LOC estimate}

End by asking the user which actions to apply — do NOT auto-apply unless the user passed--applyand even then confirm destructive deletes individually.

Output rules

• Be specific. “Skill X overlaps with Y” is useless without naming the overlapping triggers.
• Cite line numbers when flagging description / body issues.
• Don’t recommend merges unless the call sites would actually load the merged skill in the same context.
• Don’t recommend deletes for skills that haven’t been touched recently — “unused” can mean “stable”, not “dead”.

What NOT to do

• ❌ Don’t rename skill directories without checking for cross-references AND user memory entries that name the old slug.
• ❌ Don’t normalize a description by removing trigger keywords just to fit the template — the keywords are the routing signal.
• ❌ Don’t fold a heavy 200+ line skill into another just because they share a domain — large skills get loaded selectively and merging makes everything load.
• ❌ Don’t propose.agents/skills/INDEX.mdor<domain>-<skill>prefix renames unless the user explicitly asks — costs > benefits for cosmetic reorgs.

Related history

• First audit:chore/skills-auditbranch (2026-05-25) — deletedsource-command-dedupe, renameddata-fetching→data-fetching-architecture, normalized 9 descriptions, created this skill.
  3e:[“","","","L41”,null,{“content”:“$42”,“frontMatter”:{“name”:“skills-audit”,“description”:“Audit .agents/skills SKILL.md files. Use for recurring checks of duplicate, overlapping, stale, inconsistent, or broken skills and merge/delete candidates.”,“disable-model-invocation”:true,“argument-hint”:“[–verbose | --apply]”}}]

3f:[“KaTeX parse error: Expected '}', got 'EOF' at end of input: …,"children":[["”,“div”,null,{“className”:“flex items-center justify-between border-b border-border bg-muted/30 px-4 py-2.5”,“children”:[[“KaTeX parse error: Expected '}', got 'EOF' at end of input: …","children":["”,“span”,null,{“className”:“truncate text-xs font-medium text-muted-foreground”,“children”:“同仓库更多 Skills”}]}],[“KaTeX parse error: Expected 'EOF', got '}' at position 88: …ldren":"同仓库"}]]}̲],["”,“div”,null,{“className”:“p-4 sm:p-5”,“children”:[[“","h2",null,"id":"related−skills−heading","className":"text−2xlfont−semiboldtracking−normaltext−foreground","children":"同仓库更多Skills"],["","h2",null,{"id":"related-skills-heading","className":"text-2xl font-semibold tracking-normal text-foreground","children":"同仓库更多 Skills"}],["","h2",null,"id":"related−skills−heading","className":"text−2xlfont−semiboldtracking−normaltext−foreground","children":"同仓库更多Skills"],["”,“div”,null,{“className”:“mt-4 grid gap-3 sm:grid-cols-2”,“children”:[“L43","L43","L43","L44”,“L45","L45","L45","L46”,“L47","L47","L47","L48”]}]]}]]}]

49:I[206516,[“/_next/static/chunks/051aanbhrv4br.js”,“/_next/static/chunks/0mizr60h7ayzt.js”,“/_next/static/chunks/0v9lm1dmbdoo-.js”,“/_next/static/chunks/0rxr1j1j3j-.r.js”,“/_next/static/chunks/02ftybezfvqjd.js”,“/_next/static/chunks/0.v9ksvnnj8ia.js”,“/_next/static/chunks/0bn6id9_{6nx3k.js",“/_next/static/chunks/13ybnhn37c.tc.js”,“/_next/static/chunks/0_fnrdtruz8uf.js”,“/_next/static/chunks/0r6l15utt1mwb.js”,“/_next/static/chunks/0dm9a5into854.js”,"/_next/static/chunks/0}7k6hqoibtcn.js”,“/next/static/chunks/0b4cao.4y…j.js”,“/_next/static/chunks/02i-n28z7kjd0.js”],“default”]