菜单
Check hook claims, bypass tokens, emitters, and hard-rules wiring for static drift. Use when reviewing safety hook metadata. Not for semantic security proof or runtime correctness.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Diagnose an agentsmd installation (安装故障诊断): prerequisites, hook registration/executability, config flags, and spec drift. Use after install/update or when hooks fail. Not for telemetry analysis; read-only.
Show agentsmd install state (安装状态清单), registered hooks, preserved tenants, config flags, and telemetry rows. Use for a quick inventory. Not for health diagnosis or rule analysis.
Extract CSS :root and Tailwind v4 @theme tokens into DESIGN.md plus an AGENTS.md pointer. Use for frontend design-system facts. Not for coding conventions, non-frontend repos, or Tailwind v3 config themes.
Distill coding conventions from source into AGENTS.md (提炼代码约定). Use for naming/import/error-handling analysis after agentsmd-init. Not for stack detection or design tokens.
Aggregate agentsmd rule-hit telemetry by section (遥测命中统计). Use for enforcement activity and raw hit counts. Not for promotion/demotion decisions or transcript violation rates; read-only.
Generate or refresh project AGENTS.md stack facts, commands, and structure (生成项目指令). Use before convention analysis. Not for inferring coding conventions or design tokens.
| name | agentsmd-safety-coverage-audit |
| description | Check hook claims, bypass tokens, emitters, and hard-rules wiring for static drift. Use when reviewing safety hook metadata. Not for semantic security proof or runtime correctness. |
Resolve the script root first. Set SKILL_MD to the selected SKILL.md absolute path from the live skills list; never infer it from the process cwd.
SKILL_MD="<selected SKILL.md absolute path from the live skills list>"
CANDIDATE_ROOT="$(cd "$(dirname "$SKILL_MD")/../.." && pwd)"
if [ -f "$CANDIDATE_ROOT/scripts/safety-coverage-audit.js" ]; then AGENTSMD_ROOT="$CANDIDATE_ROOT"; else AGENTSMD_ROOT="${CODEX_HOME:-$HOME/.codex}/agentsmd"; fi
Header comments and deny/advisory strings are documentation, not proof. This audit cross-references the hook layer against its own claims and the manifest, four ways:
node "$AGENTSMD_ROOT/scripts/safety-coverage-audit.js" # human report
node "$AGENTSMD_ROOT/scripts/safety-coverage-audit.js" --json
node "$AGENTSMD_ROOT/scripts/safety-coverage-audit.js" --hook=pre-bash-safety-check.sh
→ claim (header block or deny/advisory string) is split on →/; and each clause keyword-grepped against the hook's code body (header stripped). A clause with zero hits = a partial-impl candidate: the header promises a link the code never implements (the failure this audit exists to catch).enforcement: hook|both rule whose rule_hits_section is live must be emitted by some hook. A live section with no emitter is an unimplemented gap; a hook-enforced rule whose section is NOT live reads as hook-planned (its hook isn't built yet — expected, not a gap).[allow-*] escape hatch must appear on a code line (a real guard), not just in a comment.§-section literal a hook emits that no manifest rule declares (telemetry the governance layer can't see).TOTAL GAPS: 0 + exit 0 = clean; exit 3 = at least one gap (the summary lists each). Wired into npm test as a coherence gate, so a hook that documents more than it implements fails CI. From the repo instead of an install: node scripts/safety-coverage-audit.js.