菜单
Conventional Commits: reads the staged diff and proposes `type(scope): summary`, with body/footer when needed. One logical change = one commit. commit-agent-csk applies it. Trigger phrases: "commit message", "make a commit", "conventional commit", "write a commit", "git commit"
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Measure output quality, don't vibe it: score a generative task with a two-layer grader — deterministic code metrics + per-dimension LLM-as-judge — over a fixed task set, as signed deltas vs a pinned baseline. Grades cost alongside correctness (pass-slow). Trigger phrases: "eval", "grader", "measure output quality", "LLM-as-judge", "score the output"
Stack-agnostic frontend discipline (web · mobile · desktop): component structure, state, data fetching, loading/empty/error states, i18n, accessibility, performance. frontend-expert-csk applies it on every stack. Trigger phrases: "frontend", "screen", "component", "page", "UI", "state management", "interface"
Refine-to-Done loop: repeat until tests green + review clean + nothing deferred; bounded. Not the harness /loop. Trigger phrases: "iterate", "loop until done", "keep going until"
Stack-agnostic security audit: map the attack surface, trace untrusted input to dangerous calls, surface dependency and configuration flaws. Severity-ranked report with fixes. Trigger phrases: "security scan", "run a security scan", "OWASP check", "scan for vulnerabilities", "find security vulnerabilities", "security audit"
Scope a security audit BEFORE scanning, to cut false positives: map assets, entry points, trust boundaries and 5-8 domain-specific attack classes into a parseable THREAT_MODEL.md. A threat survives a patch; a vulnerability is only evidence for one. Feeds security-scan. Trigger phrases: "threat model", "attack surface", "scope the audit", "trust boundary"
SonarQube quality gate (language-agnostic, local-first): 0 Bugs/Vulns/Hotspots/Code Smells, 0 build warnings. If no analyzer exists, install the language's local server-less Sonar analyzer and run it — never a remote server. Trigger phrases: "sonarqube", "quality gate", "code smell", "sonar scan"
| name | commit-message |
| description | Conventional Commits: reads the staged diff and proposes `type(scope): summary`, with body/footer when needed. One logical change = one commit. commit-agent-csk applies it. Trigger phrases: "commit message", "make a commit", "conventional commit", "write a commit", "git commit" |
Format: type(scope): summary + (optional blank line + body) + (optional footer).
feat — new feature · fix — bug fixdocs — docs only · refactor — restructure with no behavior changeperf — performance · test — add/fix testsbuild — build/dependency · ci — CI configurationchore — maintenance/automated · revert — revert a previous commitstyle — formatting (no logic)feat. Fixing an existing wrong behavior? → fix.refactor (if behavior changed it's feat/fix, not refactor).test/docs/style (don't touch code logic).The affected area/module: auth, api, backend, db, frontend, session, agent, etc.
One word, consistent with the project's module name.
feat(auth): one-time code TTL + brute-force limit
❌ fix: bug · ❌ update · ❌ changesAfter a blank line: the WHY (motivation) + notable consequences/tradeoffs. Wrap at ~72 characters. Leave context for the future reader who opens git-blame — the diff already shows the "what"; you write the "why".
BREAKING CHANGE: <description> — a backward-incompatible breaking change (triggers SemVer MAJOR, release skill).Refs: #<issue> / Closes #<issue>.If a diff contains several logical changes, split it; don't cram it into one commit:
git add -p # pick hunk by hunk; stage related changes separately
git add <specific/file>
Each commit focused on a single topic; "feat + fix + refactor" doesn't belong in one commit.
Worked good-vs-bad commit examples: references/examples.md.
/simplify + tests green + (if SonarQube is used) sonarqube-check 0/0/0/0 pass.git add scope with explicit options.git commit silently; propose the message, wait for approval..claude name, do not appear in the message.--no-verify only on an explicit request; the hook is not skipped (§4.5).