菜单
Audit an existing system across architecture quality, technical debt, security, operations, and cost; produce a prioritized report with evidence, risk scores, and remediation roadmap. Use for due diligence, pre-replatform assessment, post-incident reviews, or yearly health checks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | system-audit |
| description | Audit an existing system across architecture quality, technical debt, security, operations, and cost; produce a prioritized report with evidence, risk scores, and remediation roadmap. Use for due diligence, pre-replatform assessment, post-incident reviews, or yearly health checks. |
A system audit converts vague unease ("things feel slow / risky / expensive") into evidence-backed risks ranked by business impact. The output is a decision document, not a critique.
| Concern | Recommended |
|---|---|
| Quality model | ISO/IEC 25010:2023 quality attributes |
| Evaluation method | ATAM-lite (SEI) for architecture trade-offs |
| Delivery metrics | DORA (lead time, deploy freq, CFR, MTTR) |
| Reliability | SRE SLO/SLI review, error budget burn |
| Security | OWASP ASVS 5.0, OWASP Top 10 (latest), threat model review |
| Cost | FinOps Foundation framework, unit economics per request |
| Documentation | arc42 + C4 snapshots, ADR archaeology |
flowchart LR
K[Kickoff + scope] --> E[Evidence: code, runtime, bill, incidents]
E --> M[Model: C4 + arc42 snapshot]
M --> A[Assess: ATAM-lite + checklists]
A --> R[Risks scored: impact x likelihood]
R --> RD[Roadmap: quick wins -> structural]
RD --> P[Present + ADR backlog]
# Audit Report Template
## 1. Executive Summary (1 page)
Top 5 risks, top 3 quick wins, recommended investment band.
## 2. Scope & Method
Systems, time-box, evidence sources, limitations.
## 3. Findings by Lens
- Architecture (C4 + anti-patterns)
- Code & Debt (hotspots, churn vs complexity)
- Security (ASVS gaps, threat model deltas)
- Reliability (SLOs, error budgets, incident themes)
- Operations (DORA, on-call load, runbook coverage)
- Cost (unit economics, waste, commitment coverage)
## 4. Risk Register
| ID | Finding | Impact | Likelihood | Score | Owner | Recommendation |
## 5. Roadmap
Quick wins (0-30 days), tactical (30-90), structural (90-365).
## 6. Appendices
Diagrams, evidence links, interview notes.
| Pitfall | Why it hurts | Fix |
|---|---|---|
| No scope contract | Scope creep, late delivery | Written scope + decision owner up front |
| Opinion without evidence | Report is dismissed | Every finding cites code/metric/doc |
| Mixing severity and effort | Wrong items prioritized | Score impact x likelihood; effort separately |
| Ignoring socio-technical | Recommendations bounce off Conway | Include team topology and ownership findings |
| One mega-recommendation | Org cannot act on it | Split into quick wins + structural milestones |
| No revisit cadence | Report rots in a drive | Quarterly check-in on roadmap and metrics |
Build production integrations with Anthropic Claude (Claude 4.5 Sonnet, Claude Opus 4, Claude Haiku 4) via the Messages API — system prompts, multi-turn conversations, tool use (function calling), prompt caching, extended thinking, vision, batched requests, and streaming. Use when wiring Claude into backends, agentic workflows, or evaluating it against other foundation models. Requires ANTHROPIC_API_KEY.
Deploy Cloudflare Workers, Pages, and Workers-with-static-assets safely using Wrangler 4.x with versioned uploads, gradual deployments, preview/production environments, secret bindings, observability, and one-command rollback. Use when shipping edge workloads, API routes, or full-stack apps to Cloudflare. Requires CLOUDFLARE_API_TOKEN with scoped permissions or an authenticated Wrangler session.
Deploy static sites, framework apps (Next.js, Astro, Remix, SvelteKit, Nuxt), Edge Functions, and serverless Functions to Netlify with deploy previews, branch deploys, atomic production promotion, scoped env vars, and instant rollback. Use when releasing on Netlify via CLI, API, or Git-triggered builds. Requires NETLIFY_AUTH_TOKEN (PAT) and NETLIFY_SITE_ID.
Transcribe audio with OpenAI speech-to-text models (gpt-4o-transcribe, gpt-4o-mini-transcribe, whisper-1) using prompt-guided terminology, segment-level timestamps, optional diarization via post-processing, and reliable artifact delivery. Use when converting interviews, calls, podcasts, or meeting recordings into reviewable text. Requires OPENAI_API_KEY.
Deploy Web Services, Private Services, Background Workers, Cron Jobs, Static Sites, PostgreSQL, and Key-Value (Redis-compatible) on Render via Blueprints (`render.yaml`) or the Render API with preview environments, zero-downtime rolling deploys, health checks, env-group secret scoping, and one-click rollback. Use when releasing services, applying schema migrations, or syncing infra-as-code on Render. Requires RENDER_API_KEY (owner- or workspace-scoped).
Operate Sentry end-to-end — error monitoring, performance tracing, session replay, profiling, release health, source-map upload, ownership routing, alert tuning, issue triage, and CI integration via sentry-cli — across web, mobile, and backend stacks. Use when instrumenting an app, wiring releases into deploy pipelines, or running incident-grade triage. Requires SENTRY_AUTH_TOKEN (org-scoped, `project:releases project:write`), project DSN, and (for source maps) `org` + `project` slugs.