القائمة
Assesses structural and velocity dark-code risk from architecture, AI tool usage, ownership, and deployment practices. Produces a direct risk assessment without inventing missing facts.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | dark-code-audit |
| description | Assesses structural and velocity dark-code risk from architecture, AI tool usage, ownership, and deployment practices. Produces a direct risk assessment without inventing missing facts. |
| contract_version | 1.0.0 |
| side_effect_profile | read_only |
| activation | {"mode":"overlay","consumes_manifest":true,"trigger_fields":["service_boundary_change","external_integration","persistent_storage","runtime_path_change","auth_change"],"produces":["dark_code_risk_assessment"]} |
Dark code is code or runtime behavior that no human understood at any point in its lifecycle. ADLC uses this audit when a request has systemic risk: multi-service behavior, non-engineer workflow creation, high AI-generated code volume, ownership gaps, or production data paths that cannot be explained.
This is not a bug hunt. It is a comprehension risk assessment.
When the user asks for a dark-code audit directly, gather context one group at a time. Wait for an answer before moving to the next group.
Ask:
"Describe your system architecture. You can paste a repo structure, a list of services/modules, or describe it in plain language. I need to understand: what are the major components, how do they communicate, and where does data flow between them?"
Ask:
"How does your team use AI coding tools? Specifically:
Ask:
"How is ownership structured?
Ask:
"Walk me through how code gets to production:
When this skill runs inside ADLC, do not stop the pipeline for a full interview unless a required fact is missing and the risk is elevated. Use these inputs first:
If team or AI-usage data is missing, mark it as insufficient data to assess. Do not invent it.
Look for emergent behavior nobody designed:
Look for authored code nobody understood:
Produce a Dark Code Risk Assessment:
Store the canonical assessment in ADLC process artifact storage with bin/adlc process-artifact-path --target-repo <target-repo> --task <task-id> --artifact-type audit --filename dark-code.json --json. Do not add the assessment to the target-repo diff unless it is intentionally converted into user-facing product documentation.
insufficient data to assess.Orchestration skill: chains the full ADLC Build Loop. PRD → Brief → Council → Scaffold → Codegen → LDD → TDD → Council → PR. Use when implementing a new feature end-to-end.
Generate a bounded, schema-valid goal prompt from one validated Build Brief task for zero-context external execution.
Applicability-aware Definition of Done checklist. Core checks apply to every task; overlay checks activate only when the applicability manifest says the surface exists. Binary verification — pass or fail. Triggers at Phase 4 completion and Phase 5 entry.
Score whether each task is specific enough for autonomous, one-shot, production-ready execution.
Reviews code changes for understanding, blast radius, state, secrets, assumptions, and explainability. Produces a blocking comprehension artifact when implications are unclear.
Resolve ambiguous triage outcomes in the middle confidence band.