القائمة
This skill should be used when the user asks to "security audit", "check security", "audit buddy", "check backup health", "verify backup", or "security check".
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
This skill should be used when the user asks to "clean cache", "cache clean", "clear build cache", "free disk space", "clean up", "remove build artifacts", "clean .build", "manage cache", or "show cache size".
This skill should be used when the user asks to "token review", "review tokens", "optimize tokens", "audit context size", "reduce token footprint", "session review", "end of session review", or "check token usage".
Pre-commit pipeline for Buddy Evolver — runs token optimization, full test-all.sh, security review, docs sync, and comment audit. INVOKE IMMEDIATELY when the user says any variant of "session review", "review session", "session end", "end session", "end the session", "ending session", "session over", "session done", "wrap up", "wrapping up", "finish up", "finishing up", "done for now", "close out", "ready to commit", or "before commit" — treat these as direct invocations, not topics for discussion. Do NOT ask whether the timing is right, do NOT argue that a commit already happened (run anyway and report what's still actionable), do NOT defer. If the user actively says "don't run" or "skip", honor that — otherwise invoke now.
This skill should be used when the user asks to "sync docs", "update docs", "sync documentation", "update readme", "update claude md", "docs out of date", "check documentation", or "fix docs".
Use after a PR is merged to GitHub main. Syncs local main, verifies the merged code builds, removes merged worktrees, and stages the current worktree for automatic self-cleanup on /exit. With --release, also bumps version, updates CHANGELOG, tags the commit, pushes to trigger marketplace publish, and verifies the local plugin reloads. Use when the user says "deploy", "session deploy", "pr merged", "post-merge sync", "deploy session", "clean up after merge", or "release new version".
Use when transitioning from Plan Mode to code execution after a plan has been approved. Prints model/effort recommendations per component and summarizes the approved plan. Use when the user says "execute session", "start building", "plan approved", "begin implementation", or "let's code".
| name | audit-security |
| description | This skill should be used when the user asks to "security audit", "check security", "audit buddy", "check backup health", "verify backup", or "security check". |
Run a security audit of the Buddy Evolver installation. Check backup health, file permissions, and metadata integrity.
SOUL_BACKUP="$HOME/.claude/backups/.claude.json.pre-customize"
META_FILE="$HOME/.claude/backups/buddy-patch-meta.json"
echo "=== Backup Files ==="
ls -la "$SOUL_BACKUP" 2>/dev/null || echo "Soul backup: NOT FOUND"
ls -la "$META_FILE" 2>/dev/null || echo "Metadata: NOT FOUND"
echo "=== Permissions ==="
stat -f "%Sp %N" "$HOME/.claude/backups/" 2>/dev/null || echo "Backup dir: NOT FOUND"
stat -f "%Sp %N" "$SOUL_BACKUP" 2>/dev/null || echo "Soul backup: NOT FOUND"
stat -f "%Sp %N" "$META_FILE" 2>/dev/null || echo "Metadata: NOT FOUND"
Check that backup dir is drwx------ (700) and files are -rw------- (600). Flag any world-readable files.
plutil -extract companion json -o - ~/.claude.json 2>/dev/null || echo "No companion data found"
if [ -f "$META_FILE" ]; then
python3 -c "
import json, sys
with open(sys.argv[1]) as f:
meta = json.load(f)
print(f' schema_version: {meta.get(\"schema_version\", \"MISSING\")}')
for key in ['species', 'rarity', 'shiny', 'emoji', 'name', 'personality', 'stats']:
if key in meta:
print(f' {key}: {meta[key]}')
" "$META_FILE"
fi
Display results as a security scorecard:
Security Audit Report
═════════════════════
Soul backup exists ✅ / ❌
Metadata file exists ✅ / ❌ / ⚠️ (not found)
Backup dir permissions (700) ✅ / ❌
Backup file permissions (600) ✅ / ❌
Companion data present ✅ / ❌
Metadata is valid JSON ✅ / ❌
Metadata schema_version == 2 ✅ / ❌
Overall: X/7 checks passed
If any checks failed, provide specific remediation advice: