القائمة
Run local `opencode run` audits only after explicit user-enabled milestone flows; use when user says enable local opencode audit, 启用本地审计, 每个模块后审计, or 每步后跑 audit.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | local-opencode-audit |
| description | Run local `opencode run` audits only after explicit user-enabled milestone flows; use when user says enable local opencode audit, 启用本地审计, 每个模块后审计, or 每步后跑 audit. |
Use this skill to run a separate local opencode run session as an audit pass.
Use ONLY when the user explicitly asks for this flow, for example:
Do NOT trigger for ordinary development, ordinary checks, or generic code-review requests unless the user specifically wants this local opencode run audit flow.
Run once after a real milestone is complete:
Skip when there is no meaningful diff, no changed config, no command output, or the previous audit already covered the exact same snapshot.
Never invoke this skill from inside an audit run.
LOCAL_OPENCODE_AUDIT=1, do not invoke.Do not call local-opencode-audit, opencode run, or any nested audit.--allow-nested is passed. Do not pass it in normal use.Choose one:
dev: code feature/fix/refactor/test/docs work.ops: deployment, config, network, service health, availability, or connectivity work.Extract user-requested model/agent from current context if present. User wording may be imprecise.
--model and use opencode default config.opencode models.plan.build.opencode agent list plus built-ins.Keep context minimal and useful. Do not paste whole session history.
Dev audit message must include:
git diff --name-only.Ops audit message must include:
Redact secrets before passing context: tokens, passwords, cookies, API keys, auth headers, private URLs if sensitive.
If the active session language is Chinese, write the audit message in Chinese except for exact code symbols, file paths, command names, CLI flags, logs, and protocol names.
Preferred helper with --message-file on Windows/PowerShell:
$auditMessage = @'
<audit message>
'@
$auditFile = New-TemporaryFile
Set-Content -LiteralPath $auditFile -Value $auditMessage -Encoding UTF8
node .opencode/skills/local-opencode-audit/scripts/invoke.mjs --kind dev --message-file $auditFile --model "<user model text>" --agent "<user agent text>" --file path/to/file.go --timeout 600000
Remove-Item -LiteralPath $auditFile
Piped stdin is also supported when the shell preserves multiline input correctly:
@'
<audit message>
'@ | node .opencode/skills/local-opencode-audit/scripts/invoke.mjs --kind dev --model "<user model text>" --agent "<user agent text>" --file path/to/file.go --timeout 600000
For ops:
@'
<audit message>
'@ | node .opencode/skills/local-opencode-audit/scripts/invoke.mjs --kind ops --timeout 600000
If the user did not specify model, omit --model. If the user did not specify agent, omit --agent; the helper will use plan for dev and build for ops.
Repeat --file for files that should be attached. Put line numbers in the message, not in --file. The helper always builds opencode run <message> --file <path> so --file cannot consume the audit message as a path.
Use dry run when checking resolution only:
@'
<audit message>
'@ | node .opencode/skills/local-opencode-audit/scripts/invoke.mjs --kind dev --model "gpt 5.5" --dry-run
Dry-run with --file must show the message immediately after run, before every --file:
@'
<audit message>
'@ | node .opencode/skills/local-opencode-audit/scripts/invoke.mjs --kind dev --file path/to/file.go --dry-run
Expected args shape:
["run", "<audit message>", "--agent", "plan", "--file", "path/to/file.go"]
The helper also has a lightweight self-test:
node .opencode/skills/local-opencode-audit/scripts/invoke.mjs --self-test
If an audit fails with File not found: <long audit message>, treat it as argument ordering damage: the message was parsed as a --file value. Use the helper or put <message> immediately after opencode run and before --file.
You are running a read-only local audit for a completed development milestone.
Do not edit files. Do not call local-opencode-audit, opencode run, or any nested audit.
Respond in Chinese unless the user explicitly requests another language. Keep severity labels, file paths, line numbers, command names, CLI flags, code symbols, and identifiers unchanged.
Focus on bugs, regressions, missing tests, spec mismatches, and risky edge cases.
Return findings first, ordered by severity.
Severity:
- P1: blocking correctness/security/data-loss issue
- P2: important bug/regression/coverage gap
- P3: minor risk or maintainability concern
Output format:
- <severity> <file>:<line> - <问题> - <修复建议>
If no findings, say: `无审计发现。` Then list residual test gaps in Chinese.
Context:
<requirements, changed files, line focus, diff summary, verification results>
You are running a read-only local audit for a completed operations milestone.
Do not edit files. Do not call local-opencode-audit, opencode run, or any nested audit.
Respond in Chinese unless the user explicitly requests another language. Keep severity labels, targets, config keys, command names, CLI flags, endpoint names, service names, and protocol names unchanged.
Check only lightweight availability, connectivity, config consistency, and rollback risk from the provided context.
Do not perform destructive actions.
Return findings first, ordered by severity.
Severity:
- P1: outage/security/destructive risk
- P2: likely availability/connectivity/config issue
- P3: weak signal or follow-up check
Output format:
- <severity> <target/config/command> - <问题> - <修复/检查建议>
If no findings, say: `无审计发现。` Then list residual blind spots in Chinese.
Context:
<operation background, redacted config, endpoints, commands, outputs, expected behavior>