メニュー
Use before merging or committing code. Performs six-axis code quality gating — security, complexity, style, test coverage, documentation, and dependency health. Blocks low-quality code from entering the main branch.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
| name | code-quality-guardian |
| description | Use before merging or committing code. Performs six-axis code quality gating — security, complexity, style, test coverage, documentation, and dependency health. Blocks low-quality code from entering the main branch. |
| triggers | ["review","审查","code review","代码审查","quality","质量","lint","merge","合并","PR","pull request","before commit","提交前"] |
| version | 1.0.0 |
| author | Ow1onp |
代码质量不是可选项——它是软件可维护性的基石。本技能在代码进入主分支之前，执行六轴质量门禁，系统性拦截低质量代码。每个轴都有明确的通过/失败标准，不给 "以后优化" 留借口。
与 Hermes Agent 深度集成：利用 patch 工具自动修复低悬果实，利用 delegate_task 并行审查多个文件，利用 /curator 追踪项目质量趋势。
┌──────────────────────────────────────────────────┐
│ 代码质量六轴门禁 (Six-Axis Gate) │
├──────────┬──────────┬──────────┬─────────────────┤
│ 🔒 安全 │ 📐 复杂度 │ 🎨 风格 │ ✅ 测试覆盖 │
│ Security │Complexity│ Style │Test Coverage │
├──────────┼──────────┼──────────┼─────────────────┤
│ 📝 文档 │ 📦 依赖 │ │ │
│ Docs │ Deps │ │ │
└──────────┴──────────┴──────────┴─────────────────┘
🔒 安全 (Security)
# Hermes 工具集成
search_files(pattern="(api_key|password|secret|token)\s*=\s*['"]", target="content")
# 利用 Hermes 的 search_files 进行安全模式扫描
📐 复杂度 (Complexity)
🎨 风格 (Style)
console.log / print 调试残留✅ 测试覆盖 (Test Coverage)
📝 文档 (Documentation)
📦 依赖 (Dependencies)
# 加载技能
/skill code-quality-guardian
# 自动审查流程
# 1. 搜索安全漏洞
search_files(pattern="password\s*=", target="content", path="src/")
# 2. 运行 linter
terminal(command="ruff check src/", timeout=30)
# 3. 运行测试并检查覆盖率
terminal(command="pytest --cov=src/ --cov-report=term-missing", timeout=120)
# 4. 依赖审计
terminal(command="pip-audit", timeout=60)
# 5. 用 patch 工具自动修复低悬果实
patch(path="src/bad.py", old_string="print(f'debug: {x}')", new_string="")
SOUL.md 中的代码风格偏好# TODO: fix later 或 FIXME 残留| 借口 | 反驳 |
|---|---|
| "就改了一行，不需要审查" | 一行代码可以引入安全漏洞（如 SQL 注入）。每行代码都一视同仁。 |
| "这个 lint 规则太严格了，先跳过" | 今天的"跳过"是明天的技术债。每条 lint 规则背后都是一个真实的 Bug 案例。 |
| "测试覆盖率不够，但手动测过了" | 手动测试不可重复、不可自动化、不可审计。自动测试是唯一的真相来源。 |
| "依赖警告不重要，能跑就行" | Heartbleed 和 Log4Shell 都来自"不重要"的依赖。安全漏洞不会提前通知你。 |
| "AI 写的代码质量已经很高了" | AI 最擅长产生看起来正确但有隐蔽 Bug 的代码。AI 写的代码需要更严格的审查，而非更宽松。 |
Use when the user needs DevOps or SRE help including CI/CD pipelines, Docker optimization, Kubernetes manifests, infrastructure safety, or production log analysis.
Use when the user needs expert Python engineering help including code review, performance profiling, pytest generation, package scaffolding, or static type guidance.
Use when the user presents a vague, ambiguous, or underspecified task. Conducts structured multi-turn dialogue to extract true requirements with ~95% clarity before any code is written.
Use when the user needs DevOps or SRE help including CI/CD pipelines, Docker optimization, Kubernetes manifests, infrastructure safety, or production log analysis.
Use when the user needs expert Python engineering help including code review, performance profiling, pytest generation, package scaffolding, or static type guidance.
Use when debugging complex issues involving multiple modalities (frontend + backend, API + UI, terminal + browser). Coordinates Hermes Agent's built-in debugger, browser, terminal, and vision tools for systematic root-cause analysis.