菜单
Assign a calibrated severity level (Critical/High/Medium/Low) to a finding, risk, bug, or audit result by real impact rather than drama. Provides the rubric for each level and the discipline against severity inflation, which devalues genuinely critical findings.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Run a structured, multi-aspect code and quality audit of a module, directory, or diff. Splits the audit into independent dimensions (security, architecture, performance, business logic, testing) run as parallel subagents, then deduplicates, verifies high-severity findings, and produces one prioritized report with a precise location per finding. Calibrates severity via the `severity-calibration` skill.
Stack-adaptive Node.js / TypeScript backend patterns — recon-driven dispatch across NestJS / Express / Fastify with cross-cutting concerns (TypeORM / Prisma / Drizzle ORMs, class-validator / Zod validation, multitenancy via AsyncLocalStorage + PostgreSQL RLS, pino + OpenTelemetry observability, jest + supertest + testcontainers-node testing, NestJS DI scopes discipline, TypeScript strict mode). Loaded by `nestjs-backend-engineer` agent only; closed to main-context auto-invocation.
Next.js App Router server-layer patterns — recon-driven dispatch across Route Handlers, Server Actions, RSC data fetching, caching / revalidation, middleware, server-side auth (Auth.js / NextAuth v5, the Data Access Layer pattern), and ORM access in serverless (Prisma singleton / connection pooling, Drizzle HTTP drivers). Cross-cutting: server-as-canonical, authorize-in-the-DAL-not-middleware-alone, `NEXT_PUBLIC_` secret-leak ban, `server-only` boundary, Zod at every boundary, TypeScript strict. Covers what is DISTINCT to Next's server model — defers generic Node/ORM depth to the standalone backend skill. Loaded by `nextjs-backend-engineer` agent only; closed to main-context auto-invocation.
Verify a coding change introduced no placeholder or suppression markers without explicit user permission. Covers TODO/FIXME/HACK/XXX, commented-out code, skipped or focused tests (.skip/.only/xit/fit), and silenced type/lint checks (@ts-ignore, @ts-nocheck, eslint-disable,
Prevent duplicate instances of long-running development processes (dev servers, application processes, Docker Compose stacks). Run a preflight check before launching to detect an already-running instance by port or process name; if already running, do not start a second one. Handle restarts by stopping the current instance gracefully (SIGTERM, escalate to SIGKILL only on timeout) before launching once.
Stack-adaptive Python backend patterns — recon-driven dispatch across FastAPI / Django / Flask with cross-cutting concerns (SQLAlchemy 2.0 + Pydantic 2 / Marshmallow / DRF, multitenancy via PostgreSQL RLS, structlog + OpenTelemetry observability, pytest + testcontainers testing, typed exceptions, eager loading discipline). Loaded by `python-backend-engineer` agent only; closed to main-context auto-invocation.
| name | severity-calibration |
| user-invocable | false |
| description | Assign a calibrated severity level (Critical/High/Medium/Low) to a finding, risk, bug, or audit result by real impact rather than drama. Provides the rubric for each level and the discipline against severity inflation, which devalues genuinely critical findings. |
| when_to_use | Trigger when rating or reporting the severity or urgency of a finding. Common triggers — producing a review or audit report, risk or security assessment, bug triage, or any output that labels how serious something is. |
A rubric and discipline for assigning severity honestly. Reinforces the global rule "calibrate severity honestly" by turning it into a concrete, shared scale.
Severity tells the reader where to spend attention first. Inflating it — labeling everything Critical or High — trains the reader to discount the label, so a genuinely critical issue gets the same shrug as the noise. Calibrated severity keeps the signal trustworthy.
Assign by real impact, not by how dramatic the finding feels:
