菜单
Audits and tidies non-code directories (docs, tests, scripts, report). Use when docs feel cluttered, stale reports pile up, or before a release. Read-only audit by default — proposes moves/deletions for user approval, never auto-executes.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Audit and selectively re-run the deterministic analysis engine across all 26 corpus architectures. Default (no args) shows a staleness check — which reports are missing metadata, which arch types need engine fixes re-applied, and the current corpus score table. Pass --ai-only to re-run only AI/agentic architectures, --all to re-run everything, or a single arch name to re-run one. Use after engine changes (self_validation.py, ground_truth_generator.py, rapids_driven_controls.py) to confirm scores are consistent and no regressions landed.
Run TATB (TA Test Benchmark) on a single architecture and print the four-rubric scorecard — Threat-Relevant, TTP-Accurate, Risk-Defensible, Plan-Actionable. Uses the same scoring logic as the dashboard TATB tab. Pass an architecture name as argument, or omit for the most recent report. Read-only. ~3 seconds (includes MITRE API fetch).
Score all architectures in /report/ across the four TATB rubrics and print a visual corpus map — bar table, heatmap, and pipeline stage attribution. Shows which architectures are Excellent/Solid/Weak/Draft on each dimension and identifies which pipeline stages to fix for the largest corpus-wide gain. No UI needed. ~10-15 seconds (MITRE fetch batched once).
Run Expert Review (MoE critics + ScrumMaster) on any architecture that has an existing analysis. Three modes — sequential (3 core critics), full_moe (5 critics + SM, generates Plan-Actionable data), or single-critic (re-run one critic by name). Streams live critic results with scores, gaps, and final confidence. ~60–120s for full_moe, ~30–60s for sequential.
TATB feedback loop — observe corpus or single-arch TATB scores, diagnose weak signals, propose targeted pipeline stage fixes, gate on human approval, apply changes, re-run TATB to verify improvement, and log the before/after delta to docs/DECISIONS.md. The agent does NOT autonomously commit code; every code change requires explicit human approval.
Runs a fast ~15 second integration sanity check — verifies dependencies, rate limiter, MITRE data load (≥835 techniques), OpenRouter API key, API connection, and one real embedding call. Use at session start or after installing dependencies to confirm everything is working before coding.
| name | repo-organise |
| description | Audits and tidies non-code directories (docs, tests, scripts, report). Use when docs feel cluttered, stale reports pile up, or before a release. Read-only audit by default — proposes moves/deletions for user approval, never auto-executes. |
| allowed-tools | Bash(find:*) Bash(stat:*) Bash(ls:*) Bash(grep:*) Read |
Read-only audit of the four maintenance directories. Output a findings table; propose actions; wait for user approval before touching anything.
# Files outside archive/ not modified in last 30 days
find "$(git rev-parse --show-toplevel)/docs -maxdepth 1 -name "*.md" -mmin +43200
find "$(git rev-parse --show-toplevel)/docs -mindepth 2 -maxdepth 2 -name "*.md" \
-not -path "*/archive/*" -mmin +43200
# Verify docs/README.md index covers all subdirectories
ls "$(git rev-parse --show-toplevel)/docs/
grep -o '\[.*\]' $(git rev-parse --show-toplevel)/docs/README.md | head -40
Propose: move stale files to docs/archive/. Flag any subdirectory not listed in docs/README.md.
# Architecture names in tests
ls "$(git rev-parse --show-toplevel)/tests/data/architectures/ | sed 's/\.mmd$//'
# Report directories that exist
ls "$(git rev-parse --show-toplevel)/report/
Diff the two lists. Known gap: architectures 12–20 have no report. Flag any new gaps.
# Hard-coded absolute paths (fragile if repo moves)
grep -r "BACKUP/DEV-TEST" "$(git rev-parse --show-toplevel)/scripts/ --include="*.sh" --include="*.py" -l
# Scripts with no header comment (first non-blank line not a comment)
for f in $(find "$(git rev-parse --show-toplevel)/scripts -name "*.sh" -o -name "*.py"); do
head -3 "$f" | grep -qE "^#|^\"\"\"" || echo "No header: $f"
done
Propose: replace absolute paths with $(git rev-parse --show-toplevel) or $(dirname "$0")/...
# Report directories older than 14 days
find "$(git rev-parse --show-toplevel)/report -maxdepth 1 -mindepth 1 -type d \
-mtime +14 -exec ls -ld {} \;
Output a prune candidate list. Never delete — present to user for rm -rf approval.
Present findings as a table:
| Area | Finding | Proposed Action |
|---|---|---|
| docs | file.md last modified 45 days ago | Move to docs/archive/ |
| tests | arch 13_iot has no report | Note only — no action |
| scripts | scripts/generation/batch.sh hard-codes path | Update to relative path |
| report | random_low_TB_seed42/ is 22 days old | Candidate for deletion |
Then ask: "Proceed with any of these? Which ones?"