菜单
Weekly multi-agent audit for serious bugs (data integrity, silent caps, staleness, timestamp math, trust boundaries). Fans out Sonnet scanners + Opus deep auditors, adversarially verifies every finding, files GitHub issues for confirmed critical/high bugs. Trigger: /bug-audit
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/VasiHemanth/tokentelemetry --skill bug-audit命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | bug-audit |
| description | Weekly multi-agent audit for serious bugs (data integrity, silent caps, staleness, timestamp math, trust boundaries). Fans out Sonnet scanners + Opus deep auditors, adversarially verifies every finding, files GitHub issues for confirmed critical/high bugs. Trigger: /bug-audit |
Multi-agent audit of the TokenTelemetry backend/frontend for the bug class that motivated it (PR #131: a silent 100-session cap plus stub rows crushing real persisted data). Optimized for bugs that corrupt data, lose data, or silently report wrong numbers — not style or hypotheticals.
bug-audit (gh issue list --label bug-audit --state all --limit 1),
whose body records the commit it audited up to.git diff <last-audited-commit>..HEAD plus any file those
diffs touch. If no marker exists (first run), scope = backend/*.py and
frontend/src/lib + frontend/src/app.backend/main.py scan loops, backend/history_store.py,
backend/scan_cache.py (if present), anything matching
backend/*cache*/backend/*store*.Wave 1 — breadth, audit-scanner (Sonnet), one per dimension:
[:N])Give each scanner the scope file list and its dimension. Prompt them to return the FINDING-block format their agent definition specifies.
Wave 2 — depth, audit-deep (Opus), in the same parallel batch as wave 1:
one per risky subsystem actually present in scope, typically 2-4 of:
/analytics, ecosystem rollups)Wave 3 — verification, audit-verifier (Opus), one per candidate:
Dedupe wave 1+2 candidates by (file, defect) first. Send each survivor to a
verifier with the full finding block. Only VERDICT: CONFIRMED findings
survive; keep the verifier's own severity, not the scanner's.
docs/audits/<YYYY-MM-DD>-bug-audit.md: audited
range (<from>..<to> commits), confirmed findings (severity, file:line,
scenario, verifier's reason), refuted-candidate count, dimensions that
came back clean.gh issue create --label bug,bug-audit — title is the one-sentence
defect, body is the finding block + verifier reason + audited commit.
Medium findings go only in the report.bug-audit marker labeled bug-audit whose body's last line is
audited-through: <HEAD sha> (edit it if it exists, create otherwise).audit/<YYYY-MM-DD> and open a draft PR
(report only — never commit fixes from this skill; fixes are separate,
human-initiated work).Run manually with /bug-audit, or schedule headless:
# launchd/cron, weekly:
cd /path/to/tokentelemetry && claude -p "/bug-audit" --permission-mode acceptEdits
Budget note: one run spawns roughly 6 Sonnet scanners + 2-4 Opus deep auditors + one Opus verifier per candidate. If candidates exceed ~15, verify only critical/high candidates and list the rest as unverified in the report.