一键导入
skills-doctor
Diagnose and fix: agent/skills setup, toolchain, app smoke, deep debug — apply fixes in-session when evidenced, else hand off to investigate.
用 Codex 或 Claude 帮你安装 复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它检查 Skill 页面并帮你完成安装。
菜单
Diagnose and fix: agent/skills setup, toolchain, app smoke, deep debug — apply fixes in-session when evidenced, else hand off to investigate.
用 Codex 或 Claude 帮你安装 复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | skills-doctor |
| description | Diagnose and fix: agent/skills setup, toolchain, app smoke, deep debug — apply fixes in-session when evidenced, else hand off to investigate. |
/investigate when root cause is not yet proven.Related: /investigate for confirmed application logic defects after this skill's evidence pass; /health-check for non-incident quality baselines; /regression-check after a fix.
Do not use this skill for scheduled quality scoring — use /health-check; do not use for pre-merge diff review — use /pr-review.
.env.example gaps, scripts, dependency install, skill reinstall, port/process conflicts, typo-level code errors pointed to by stack trace./investigate only when root cause is still ambiguous after three evidenced fix attempts, or the fix requires non-trivial logic/design change.cmd, claude, cursor, codex on PATH and config dirs under home (see project docs/HOST_REFERENCE.md when available).cmd skills list, cmd status).SKILL.md layout — not a lone .md file (e.g. ~/.commandcode/skills/<name>/SKILL.md).disabledSkills or equivalent.CLAUDE.md, AGENTS.md, or host context file exists where expected."hooks" in settings JSON; matcher is a string (e.g. "Edit|Write"), not an array; tool names capitalized (Bash, Edit)..mcp.json; absolute paths for local script commands.bun --version, node --version, python3 --version as applicable.node_modules / venv..env.example keys to .env names only — never print secret values.lsof -i :PORT or equivalent when dev port is known.package.json, Makefile, pyproject.toml, or CI workflow.DEBUG=*, LOG_LEVEL=debug).git status --short, git log -5 --oneline, branch..env.example; last ~50 lines of log or test output..env.example gap, bun install, port/process kill, JSON repair, skill reinstall — apply directly./investigate with Focus Contract + Evidence Bundle + dead hypotheses./regression-check if application code changed..env values, tokens, or credentials.[UNVERIFIED] when CLI missing, no network, or timeout.Return a markdown report with these exact sections:
| Check | Status | Evidence | Fix | Verify |
|---|---|---|---|---|
| Skills installed | FAIL | cmd skills list shows 13, expect 36 | Applied: cmd skills add cropsgg/skills --global --force | OK — 36 listed |
| Typecheck | FAIL | src/api.ts:12 — User not exported from ./types | Applied: add export in types.ts | OK — typecheck passes |
Added export type User to src/types.ts; re-ran bun run typecheck — exit 0.
Run /regression-check before commit.
Code review and cleanup across reuse, quality, and efficiency dimensions. Launches three parallel review agents against the current diff, then aggregates findings and applies fixes.
Red-team the agent's own output against OWASP Top 10 for LLM Applications and Agentic AI. Self-inject, test boundaries, check exfiltration paths. If you can't attack your own output, someone else will.
Mandatory verification of every factual claim before emission. API contracts, dependency versions, file existence, behavior promises — claims about code are hypotheses until verified against the actual source. Based on Dhuliawala et al. (Meta FAIR, ACL 2024).
Disciplined 6-step diagnosis loop with strict evidence gates between stages. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Cannot advance without the required artifact per step.
Split the workflow into Evaluator and Optimizer personas. Evaluator scores output 1–10 on correctness, completeness, safety, and simplicity. Optimizer rewrites to address critiques. Loop until score ≥9 or 3 iterations. Self-improvement without measurement is guessing.
Detect fail-open security patterns: debug mode in production, permissive CORS, disabled CSRF, default admin credentials, verbose error messages, unauthenticated health endpoints. Configuration is code — review it with the same rigor.