菜单
Automated health checks for framework artifacts modified during a pipeline. Validates hook syntax, security patterns (SE-01/SE-02), skill wiring, agent consistency, and routing correctness. Invoked as the final pipeline step when framework artifacts were created, modified, or deleted.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/oimiragieo/agent-studio --skill proactive-audit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
Agent frontmatter enhancements — disallowedTools, mcpServers scoping, fork_eligible field
Context management — pre-compact persistence, threshold alignment, microcompact/circuit breaker detection
Hook enhancements — updatedInput for bash safety prefixes, suppressOutput for verbose blocks, denial-based routing feedback
正在显示 SKILL.md
| name | proactive-audit |
| description | Automated health checks for framework artifacts modified during a pipeline. Validates hook syntax, security patterns (SE-01/SE-02), skill wiring, agent consistency, and routing correctness. Invoked as the final pipeline step when framework artifacts were created, modified, or deleted. |
| version | 1.2.0 |
| model | sonnet |
| category | validation |
| invoked_by | both |
| user_invocable | true |
| tools | ["Read","Bash","Glob","Grep"] |
| agents | ["qa","developer","architect"] |
| best_practices | ["Run all applicable checks from the check matrix","Use git diff as primary change detection method","Never skip SE-02 or SE-01 scans on hook/tool files","Report findings with severity and remediation steps"] |
| error_handling | strict |
| streaming | supported |
| verified | true |
| lastVerifiedAt | "2026-02-23T00:00:00.000Z" |
| source | builtin |
| trust_score | 100 |
| provenance_sha | 7cb12aa5e0ac92fe |
Automated health checks for framework artifacts that were modified during the current pipeline. This skill fills the gap between reactive verification (tests, lint) and proactive framework-level validation (wiring, syntax, security patterns).
Core principle: Framework artifact changes require the same rigor as code changes. If a skill was created, verify it is wired. If a hook was modified, verify it compiles. If an agent was changed, verify its tool/skill lists are consistent.
Invoke this skill as the final pipeline step whenever ANY of the following paths were created, modified, or deleted during the session:
.claude/hooks/**/*.cjs.claude/skills/**/SKILL.md.claude/agents/**/*.md.claude/workflows/**/*.md.claude/schemas/**/*.json.claude/templates/**/*.claude/CLAUDE.md.claude/lib/routing/routing-table.cjsInvocation:
Skill({ skill: 'proactive-audit' });
| Skill | Purpose | When |
|---|---|---|
task-management-protocol | Track audit progress | Always |
ripgrep | Fast targeted artifact search | During checks |
code-semantic-search | Pattern discovery across artifacts | When investigating |
context-compressor | Compress large audit results | When output is large |
verification-before-completion | Gate completion on zero CRITICAL | Before marking done |
memory-search | Check prior audit patterns | At start |
Use git diff to identify which framework artifacts changed in this session:
# Primary: git diff against recent commits
git diff --name-only HEAD~5 -- .claude/hooks/ .claude/skills/ .claude/agents/ .claude/workflows/ .claude/schemas/ .claude/templates/ .claude/CLAUDE.md .claude/lib/routing/
# Secondary: check unstaged changes
git diff --name-only -- .claude/hooks/ .claude/skills/ .claude/agents/ .claude/workflows/ .claude/schemas/ .claude/templates/
# Tertiary: check untracked files
git ls-files --others --exclude-standard .claude/hooks/ .claude/skills/ .claude/agents/ .claude/workflows/ .claude/schemas/ .claude/templates/
Combine all three lists into a deduplicated set of changed artifact paths.
For each changed artifact, apply the relevant checks from this matrix:
.claude/hooks/**/*.cjs)| Check ID | Check | Command | Severity |
|---|---|---|---|
| H-01 | Syntax validity | node --check <file> | CRITICAL |
| H-02 | SE-02: raw JSON.parse without safeParseJSON | grep -n "JSON.parse(" <file> then verify safeParseJSON import | HIGH |
| H-03 | SE-01: shell injection via shell: true | grep -n "shell:\\s*true" <file> | HIGH |
| H-04 | Hook registered in settings.json | grep "<hook-filename>" .claude/settings.json | MEDIUM |
| H-05 | Exit code correctness | Verify try/catch wrapping, exit 0 on non-critical errors | MEDIUM |
H-02 detail: If JSON.parse( is found, check if the file also imports safeParseJSON from .claude/lib/utils/safe-json.cjs. If not, flag as HIGH finding. Exclude test files (*.test.cjs).
.claude/skills/**/SKILL.md)| Check ID | Check | Command | Severity |
|---|---|---|---|
| S-01 | Skill appears in skill-catalog.md | grep "<skill-name>" .claude/docs/skill-catalog.md | HIGH |
| S-02 | At least one agent has skill in frontmatter | grep -r "<skill-name>" .claude/agents/ --include="*.md" | MEDIUM |
| S-03 | Skill appears in CLAUDE.md Section 8.5 | grep "<skill-name>" .claude/CLAUDE.md | MEDIUM |
| S-04 | SKILL.md has valid frontmatter | Verify name:, description:, version: fields exist | MEDIUM |
| S-05 | Validate skills (if available) | pnpm validate:skills 2>&1 | LOW |
.claude/agents/**/*.md)| Check ID | Check | Command | Severity |
|---|---|---|---|
| A-01 | Agent appears in agent-registry.json | grep "<agent-name>" .claude/context/agent-registry.json | HIGH |
| A-02 | Agent's skills: list references existing skills | For each skill in frontmatter, verify .claude/skills/<skill>/SKILL.md exists | MEDIUM |
| A-03 | Agent's tools: list contains only valid tools | Verify each tool name against known tool list | MEDIUM |
| A-04 | Agent appears in CLAUDE.md routing table | grep "<agent-name>" .claude/CLAUDE.md | MEDIUM |
.claude/workflows/**/*.md)| Check ID | Check | Command | Severity |
|---|---|---|---|
| W-01 | Workflow referenced in WORKFLOW_AGENT_MAP.md | grep "<workflow-name>" .claude/docs/@WORKFLOW_AGENT_MAP.md | MEDIUM |
| W-02 | Referenced agents exist | For each agent name in workflow, verify agent file exists | MEDIUM |
.claude/schemas/**/*.json)| Check ID | Check | Command | Severity |
|---|---|---|---|
| SC-01 | Valid JSON syntax | node -e "JSON.parse(require('fs').readFileSync('<file>', 'utf8'))" | CRITICAL |
| SC-02 | Schema appears in schema-catalog.md | grep "<schema-name>" .claude/context/artifacts/catalogs/schema-catalog.md | MEDIUM |
ls -1 | grep -cvE '^(\.|node_modules|src|tests|scripts|dist|build|docs|package\.json|package-lock\.json|pnpm-lock\.yaml|tsconfig|eslint|prettier|jest|vitest|README|LICENSE|CHANGELOG|CLAUDE\.md|\.env)'
FAIL if the count is greater than 0.
Known slop patterns (any of these in project root = FAIL):
*-debug*.txt, *-debug*.log, debug-*.jsondump-*.cjs, dump-*.js, dump-*.jsonrename_*.cjs, revert_*.cjs, update_*.cjstest-out.txt, lint-output.txt, eslint.json, errors.jsona3f2c1b0-*.json)new_session_analysis.md or any *.analysis.md not under .claude/context/.cjs/.js/.mjs not referenced in package.json scripts or tracked project source.md not named README.md, CLAUDE.md, LICENSE, or CHANGELOG.mdAction when FAIL:
.claude/context/tmp/ if content may be needed)session-gap-log.jsonl with type: "cleanup"reflection-spawn-request.json entry with trigger: "ai-slop-found" so the root cause is investigatedReference: .claude/rules/cleanup-always.md
After any feature work, verify:
CHANGELOG.md — does it have an entry dated within the last session?
git log --oneline -5 vs grep "## \[" CHANGELOG.md | head -3.env.example — does it document all env vars in the codebase?
grep -r "process.env\." .claude/skills/ .claude/hooks/ | grep -oP "process\.env\.\K\w+" | sort -u.env.example.env.exampleREADME.md — are agent/skill counts current?
jq '.agents | length' .claude/context/agent-registry.json.claude/lib/routing/routing-table.cjs, .claude/CLAUDE.md)| Check ID | Check | Command | Severity |
|---|---|---|---|
| R-01 | routing-table.cjs syntax | node --check .claude/lib/routing/routing-table.cjs | CRITICAL |
| R-02 | Validate skills (full) | pnpm validate:skills 2>&1 | MEDIUM |
Write a structured report to .claude/context/reports/ecosystem-audit/proactive-audit-{ISO-date}.md with this format:
<!-- Agent: qa | Task: #N | Session: YYYY-MM-DD -->
# Proactive Audit Report
**Date:** YYYY-MM-DD
**Artifacts Scanned:** N
**Findings:** N CRITICAL, N HIGH, N MEDIUM, N LOW
**Overall:** PASS | FAIL
## Changed Artifacts
- path/to/artifact1 (type: hook)
- path/to/artifact2 (type: skill)
## Findings
### CRITICAL
| ID | File | Check | Detail | Remediation |
| ---- | ------------- | ------ | ---------------------- | ---------------- |
| H-01 | hooks/foo.cjs | Syntax | SyntaxError at line 42 | Fix syntax error |
### HIGH
| ID | File | Check | Detail | Remediation |
| ---- | ------------- | ----- | ------------------------------------------- | --------------------------------------------------------- |
| H-02 | hooks/bar.cjs | SE-02 | JSON.parse at line 15 without safeParseJSON | Import safeParseJSON from .claude/lib/utils/safe-json.cjs |
### MEDIUM
(same table format)
### PASS
| ID | File | Check | Result |
| ---- | ------------- | ------ | ------ |
| H-01 | hooks/baz.cjs | Syntax | OK |
## Summary
- Total checks run: N
- Passed: N
- Failed: N
- Pass rate: N%
After generating the report:
FAIL with the report path and list of critical findingsWARN with the report path and list of high findingsPASS with the report path and note about medium findingsPASS with the report pathgit diff as the primary source of changed artifact paths.node --check before reporting findings — broken hooks silently block the entire tool pipeline.| Anti-Pattern | Why It Fails | Correct Approach |
|---|---|---|
| Skipping checks for "small" changes | Small wiring failures accumulate silently until a pipeline breaks | Run all checks regardless of perceived change size |
| Trusting task metadata for change detection | Metadata can be incomplete or stale; misses unstaged changes | Use git diff --name-only + git ls-files --others as primary source |
| Self-attesting PASS without running commands | Unverified PASS masks real failures; violates verification-before-completion | Execute every check command and capture output as evidence |
| Ignoring SE-02 (prototype pollution) in hooks | One polluted hook corrupts Object.prototype globally across all tool calls | Flag SE-02 as HIGH severity and block pipeline until fixed |
| Reporting findings without remediation steps | Developers know what broke but not how to fix it | Include specific remediation for every finding with file+line reference |
| Severity | Meaning | Action Required |
|---|---|---|
| CRITICAL | Framework will break | Fix immediately, block pipeline completion |
| HIGH | Security risk or invisible artifact | Fix before next session, warn user |
| MEDIUM | Missing integration, incomplete wiring | Fix in follow-up task |
| LOW | Best practice violation, cosmetic | Track for future improvement |
The router invokes this skill via Step 0.7 in the Router Output Contract (CLAUDE.md Section 0.1). The router:
verification-before-completion -- General evidence-based completion gateschecklist-generator -- IEEE 1028 quality checklistssharp-edges -- Known hazard patterns (SE-01 through SE-07).claude/context/plans/proactive-audit-design-2026-02-22.md -- Design document.claude/rules/security.md -- SE-01 and SE-02 patterns.claude/rules/artifact-integration.md -- Must-have integration requirements