菜单
Primary owner for bug, regression, vulnerability, or performance diagnosis. Gather evidence, rank hypotheses, identify cause, and plan repair/verification. Use implicitly only when diagnosis is the requested outcome; implementation-only work belongs to Coding.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | xc881-bugfix-research |
| description | Primary owner for bug, regression, vulnerability, or performance diagnosis. Gather evidence, rank hypotheses, identify cause, and plan repair/verification. Use implicitly only when diagnosis is the requested outcome; implementation-only work belongs to Coding. |
| when_to_use | Use for diagnosis before repair. Diagnosis-only stops in Bugfix; hand to Coding only when the user or parent owner requested implementation. |
| display_name | xc881漏洞与Bug诊断 |
| version | 2.4.0 |
| category | debugging-security |
| tags | ["intent-routing","bugfix","vulnerability","security","root-cause","xc881"] |
| aliases | ["xc881-bugfix-research","xc881-bugfix","xc881漏洞与Bug诊断"] |
Intent-routed diagnosis owner. Direct calls select it; implicit use requires the primary outcome in the description. Incidental errors stay with the base/current owner. Run only the needed branch. No code/test/commit.
Goal:
symptom → evidence → cause → fix plan → verify plan → handoff
Reference files live under ./references/.
Reference Index:
./references/web-research-policy.md: docs/advisory/forum../references/bugfix-forensics-workflow.md: cause../references/vulnerability-triage-policy.md: security../references/reproducer-verification-plan.md: repro/verify../references/bugfix-output-contract.md: output.When opening reference files, always use the exact relative path shown above.
Do not assume reference files are located beside SKILL.md.
Steps:
read to $xc881-coding-skills, then resume diagnosis. Bugfix retains cause ownership.$xc881-coding-skills only when implementation intent is
explicit or delegated. Diagnosis-only stops after the plan; Handoff states
none or the evidence needed next. Existing implementation intent needs no
second user invocation.Output:
xc881 BugFix:
Context:
Evidence:
Cause:
Fix:
Verify:
Risk:
Handoff:
Security add:
Severity:
CVE/GHSA/OSV/CWE/OWASP:
Affected:
Exploitability:
Mitigation:
Rules: route only on diagnosis intent; no exploit steps; fact ≠ hypothesis; weak evidence ≠ certainty; delegated Coding reads never grant change permission; do not convert diagnosis-only into a patch. After context compaction, resume the same diagnosis owner and evidence/cause loop automatically.
Primary owner for project writes and complex/tracked code reads. Use for implementation, review, verification, git work, or evidence spanning paths/modules/runtime/architecture/security/performance/concurrency. Simple exact local reads need no skill; bounded delegates do only their contract.
Primary owner for cross-language/project porting. Classify magnitude and boundaries, preserve behavioral equivalence, and call only specialists needed by the current migration step. Ordinary refactors, data migrations, and incidental language mentions do not trigger it.
Primary owner for requirements, scope, acceptance criteria, PRDs, and issue/PR triage. Separate explicit/inferred needs, persist task queues when warranted, and delegate only blocking research or reads. Implementation detail alone is not requirement intent.
Primary owner for web-backed technical research: feasibility, option decisions, standards/advisories, and stale external facts. Use when external evidence is the outcome or a bounded delegate is blocked; ordinary explanations and incidental terms stay with the current owner.
Primary owner for Chinese source-code articles: source guides, function analysis, call-chain chapters, and rewrites. Generic writing or code-reading-only requests do not trigger it; reuse supplied evidence and delegate only blocking inspection or term research.