菜单
Walk the B1-B15 AI-to-AI blind-spot catalog systematically. Use during the audit pipeline AFTER hard-stops and Tambon hunt and BEFORE the 13 domain audits. Output: PRESENT / NOT PRESENT for each B-class with evidence. Findings flow into the appropriate domains.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when the user wants to add a new library, package, or dependency. Enforces the discipline that prevents framework version drift — the "AI assumes you're on version 15, generates code for 16.5" failure mode documented in the LLM failure-mode research.
Use when the user wants to add a new API endpoint, route, or handler. Enforces the "search before adding" discipline that prevents duplicate endpoints — the most common vibe-coding failure mode. Activate any time the request mentions adding a route, endpoint, handler, controller, or HTTP method.
Audit the security domain — auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.
Audit the architecture and code quality domain — module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.
Audit the database and data layer — schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.
Audit the infra and DevOps domain — CI/CD, deployment, IaC, secrets management, environments, logging, observability. Run as part of /audit Phase E.
| name | audit-blind-spots |
| description | Walk the B1-B15 AI-to-AI blind-spot catalog systematically. Use during the audit pipeline AFTER hard-stops and Tambon hunt and BEFORE the 13 domain audits. Output: PRESENT / NOT PRESENT for each B-class with evidence. Findings flow into the appropriate domains. |
This skill walks the 15 AI-to-AI blind spots from
@.claude/context/audit-blind-spots.md and produces a structured
report. The findings are then routed by the orchestrator into the
appropriate domain sections.
Blind spots cross domain boundaries. B1 (auth not wired) is a security finding AND a code-quality finding AND a reliability finding. Running the blind-spot walk once and routing findings into domains is more efficient than asking each domain to re-discover its share.
view @.claude/context/audit-rules.md
view @.claude/context/audit-blind-spots.md
For each B-class, follow the detection commands from audit-blind-spots.md. The walk is mostly grep + read, but B1, B7, B8 require substantial code-tracing.
═══════════════════════════════════════════════════════════════════════
B<N> — <n>
═══════════════════════════════════════════════════════════════════════
Detection commands run:
<list>
If output is clean:
Status: NOT PRESENT
Notes: <e.g., "no auth middleware found, but app uses Supabase Auth
integrated into FastAPI dependencies — different
pattern, B1 doesn't apply">
If output has matches:
Status: PRESENT (<N> instances)
Findings:
F-B<N>.1
Evidence: <path:line>
Pattern: <which sub-pattern>
Severity: Critical | High | Medium | Low
Routing: Domain <N> (which domain this finding belongs to)
What's wrong: <one paragraph>
Why it matters: <one sentence>
[F-B<N>.2 etc. if more]
The orchestrator uses this to put findings in the right domain section:
| Blind spot | Primary domain | Secondary domain |
|---|---|---|
| B1 (Auth not wired) | Domain 1 (Security) | — |
| B2 (Error returns success) | Domain 7 (Reliability) | Domain 1 |
| B3 (FE-only pagination) | Domain 5 (Performance) | Domain 3 |
| B4 (Soft-delete unfiltered) | Domain 3 (Database) | Domain 1 |
| B5 (Env var existence-only) | Domain 4 (DevOps) | Domain 7 |
| B6 (Single-user assumptions) | Domain 5 (Performance) | Domain 7 |
| B7 (Validation asymmetry) | Domain 1 (Security) | Domain 6 |
| B8 (IDOR) | Domain 1 (Security) | — |
| B9 (Dead utilities) | Domain 13 (Code Integrity) | Domain 9 |
| B10 (Optimistic UI no rollback) | Domain 6 (UX/A11y) | Domain 7 |
| B11 (Webhook idempotency) | Domain 7 (Reliability) | Domain 1 |
| B12 (Stack mixing) | Domain 13 (Code Integrity) | Domain 2 |
| B13 (Test mirrors code) | Domain 13 (Code Integrity) | Domain 9 |
| B14 (Comment-code drift) | Domain 13 (Code Integrity) | Domain 9 |
| B15 (Coverage theater) | Domain 9 (Maintainability) | Domain 13 |
═══════════════════════════════════════════════════════════════════════
AI-TO-AI BLIND SPOTS WALK
═══════════════════════════════════════════════════════════════════════
Walked 15 blind-spot classes. Findings routed to domains as follows.
B1 — Auth present but not wired: [PRESENT/NOT PRESENT]
B2 — Error handlers returning success: [PRESENT/NOT PRESENT]
B3 — Frontend-only pagination: [PRESENT/NOT PRESENT]
B4 — Soft-delete unfiltered: [PRESENT/NOT PRESENT]
B5 — Env var existence-only checks: [PRESENT/NOT PRESENT]
B6 — Single-user assumptions: [PRESENT/NOT PRESENT]
B7 — Validation asymmetry: [PRESENT/NOT PRESENT]
B8 — Authorization gap (IDOR): [PRESENT/NOT PRESENT]
B9 — Dead imports / unreachable utils: [PRESENT/NOT PRESENT]
B10 — Optimistic UI without rollback: [PRESENT/NOT PRESENT]
B11 — Webhook idempotency missing: [PRESENT/NOT PRESENT]
B12 — Stack mixing: [PRESENT/NOT PRESENT]
B13 — Test mirrors code: [PRESENT/NOT PRESENT]
B14 — Comment-code drift: [PRESENT/NOT PRESENT]
B15 — Coverage theater: [PRESENT/NOT PRESENT]
[Then the detailed findings per PRESENT class, routed to domains]
────────────────────────────────────────────────────────────────────────
SUMMARY
────────────────────────────────────────────────────────────────────────
Present: <N> of 15
Most pervasive (highest count): <which blind spot, in how many places>
Critical findings from walk: <count>
High findings from walk: <count>
[SECTION COMPLETE: audit-blind-spots]