メニュー
Check hook claims, bypass tokens, emitters, and hard-rules wiring for static drift. Use when reviewing safety hook metadata. Not for semantic security proof or runtime correctness.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Diagnose an agentsmd installation (安装故障诊断): prerequisites, hook registration/executability, config flags, and spec drift. Use after install/update or when hooks fail. Not for telemetry analysis; read-only.
Show agentsmd install state (安装状态清单), registered hooks, preserved tenants, config flags, and telemetry rows. Use for a quick inventory. Not for health diagnosis or rule analysis.
Extract CSS :root and Tailwind v4 @theme tokens into DESIGN.md plus an AGENTS.md pointer. Use for frontend design-system facts. Not for coding conventions, non-frontend repos, or Tailwind v3 config themes.
Distill coding conventions from source into AGENTS.md (提炼代码约定). Use for naming/import/error-handling analysis after agentsmd-init. Not for stack detection or design tokens.
Aggregate agentsmd rule-hit telemetry by section (遥测命中统计). Use for enforcement activity and raw hit counts. Not for promotion/demotion decisions or transcript violation rates; read-only.
Generate or refresh project AGENTS.md stack facts, commands, and structure (生成项目指令). Use before convention analysis. Not for inferring coding conventions or design tokens.
| name | agentsmd-safety-coverage-audit |
| description | Check hook claims, bypass tokens, emitters, and hard-rules wiring for static drift. Use when reviewing safety hook metadata. Not for semantic security proof or runtime correctness. |
Resolve the script root first. Set SKILL_MD to the selected SKILL.md absolute path from the live skills list; never infer it from the process cwd.
SKILL_MD="<selected SKILL.md absolute path from the live skills list>"
CANDIDATE_ROOT="$(cd "$(dirname "$SKILL_MD")/../.." && pwd)"
if [ -f "$CANDIDATE_ROOT/scripts/safety-coverage-audit.js" ]; then AGENTSMD_ROOT="$CANDIDATE_ROOT"; else AGENTSMD_ROOT="${CODEX_HOME:-$HOME/.codex}/agentsmd"; fi
Header comments and deny/advisory strings are documentation, not proof. This audit cross-references the hook layer against its own claims and the manifest, four ways:
node "$AGENTSMD_ROOT/scripts/safety-coverage-audit.js" # human report
node "$AGENTSMD_ROOT/scripts/safety-coverage-audit.js" --json
node "$AGENTSMD_ROOT/scripts/safety-coverage-audit.js" --hook=pre-bash-safety-check.sh
→ claim (header block or deny/advisory string) is split on →/; and each clause keyword-grepped against the hook's code body (header stripped). A clause with zero hits = a partial-impl candidate: the header promises a link the code never implements (the failure this audit exists to catch).enforcement: hook|both rule whose rule_hits_section is live must be emitted by some hook. A live section with no emitter is an unimplemented gap; a hook-enforced rule whose section is NOT live reads as hook-planned (its hook isn't built yet — expected, not a gap).[allow-*] escape hatch must appear on a code line (a real guard), not just in a comment.§-section literal a hook emits that no manifest rule declares (telemetry the governance layer can't see).TOTAL GAPS: 0 + exit 0 = clean; exit 3 = at least one gap (the summary lists each). Wired into npm test as a coherence gate, so a hook that documents more than it implements fails CI. From the repo instead of an install: node scripts/safety-coverage-audit.js.