Back to Details

review

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Review

审查

Use 
/review
as the canonical first-party review entrypoint. It covers code review, session diffs, scoped files, PRs, full audits, behavior-preserving simplification review, source/provenance review for external skills, specialist audit lenses, browser-grounded frontend/a11y/web-quality review, review history, delta reports, false-positive learnings, SARIF output, Conventional Comments output, and approval-gated fix passes.
honest-review
, 
simplify
, and 
external-skill-auditor
are not separate skills. Their behavior lives here as 
/review
, 
/review simplify
, and 
/review source
.
Default posture: read-only, evidence-first, and scoped. Do not perform feature work, broad rewrites, installs, or fixes until the user explicitly approves selected findings or invokes a mode that permits edits and passes its gates.
使用
/review
作为标准的第一方审查入口。它涵盖代码审查、会话差异、范围限定文件、PR、全面审计、行为保留型简化审查、外部技能的来源/溯源审查、专业审计视角、基于浏览器的前端/a11y/网页质量审查、审查历史、差异报告、误判学习记录、SARIF输出、Conventional Comments输出，以及需审批的修复流程。
honest-review
、
simplify
和
external-skill-auditor
并非独立技能。它们的功能整合在
/review
、
/review simplify
和
/review source
中。
默认规则：只读、证据优先、范围限定。在用户明确批准选定的审查结果或调用允许编辑的模式并通过审批前，不得执行功能开发、大范围重写、安装或修复操作。

Canonical Vocabulary

标准术语

Use these canonical terms exactly.
TermMeaning
reviewEvidence-first inspection of code, diffs, PRs, repositories, sources, or proposed simplifications
scopeThe exact files, directories, PR, git range, source, or snippet under review
triageFirst pass that classifies scope, risk, changed files, specialist lenses, and validation requirements
findingA discrete issue with citation, reasoning, severity, confidence, evidence, and recommended action
strengthA positive review observation that explains what should be preserved
confidenceScore from 0.0 to 1.0; report >= 0.7, mark 0.3-0.7 unconfirmed, discard < 0.3 unless P0/S0
severityPriority/scope classification such as P0-P3 and S0-S3
citation anchorA verified 
[file:start-end]
source location or source/provenance anchor
reasoning chainWhy the finding matters, written before the finding statement
evidenceTool, source, test, docs, grep, dependency, or research proof that supports or rejects a finding
lensSpecialist perspective such as security, supply chain, CI, SQL, data, frontend, a11y, web quality, MCP, agentic, or docs
skill assetA 
SKILL.md
, skill directory, skill eval, skill script, reference, package, catalog row, or generated skill doc reviewed through skill-creator structural patterns
simplification lensBehavior-preserving review of complexity, invariants, semantic-change risk, and clarity opportunities
source/provenance lensReview of external skill/source trust, executable surfaces, owner, license, credentials, network behavior, and dedupe
approval gateMandatory pause before editing files or applying fixes
learningStored false-positive dismissal used to reduce repeated noise in future reviews
modeExplicit or inferred review workflow such as session, scoped, PR, range, audit, simplify, source, history, delta, learnings, or fix
shard mapWave 0 ownership plan for large parallel reviews, with lane IDs, shard IDs, file/source ownership, coverage expectations, and merge status
请严格使用以下标准术语。
术语含义
review以证据优先为原则，对代码、差异、PR、仓库、来源或拟议简化方案进行检查
scope审查覆盖的具体文件、目录、PR、git版本范围、来源或代码片段
triage初步分类，确定审查范围、风险、变更文件、专业视角及验证要求
finding独立的问题记录，包含引用、推理、严重程度、置信度、证据及建议操作
strength审查中发现的积极亮点，说明应保留的内容
confidence0.0至1.0的评分；仅报告≥0.7的结果，标记0.3-0.7为未确认，除非是P0/S0级问题，否则丢弃<0.3的结果
severity优先级/范围分类，如P0-P3和S0-S3
citation anchor已验证的
[file:start-end]
源位置或来源/溯源锚点
reasoning chain说明该审查结果的重要性，需写在结果陈述之前
evidence支持或反驳审查结果的工具、源码、测试、文档、grep输出、依赖或研究依据
lens专业视角，如安全、供应链、CI、SQL、数据、前端、a11y、网页质量、MCP、Agent化或文档
skill asset通过skill-creator结构模式审查的
SKILL.md
、技能目录、技能评估、技能脚本、参考资料、包、目录条目或生成的技能文档
simplification lens针对复杂度、不变性、语义变更风险及清晰度优化机会的行为保留型审查
source/provenance lens针对外部技能/来源的可信度、可执行表面、所有者、许可证、凭证、网络行为及重复项的审查
approval gate编辑文件或应用修复前的强制暂停环节
learning存储的误判排除记录，用于减少未来审查中的重复噪音
mode明确或推断的审查工作流，如session、scoped、PR、range、audit、simplify、source、history、delta、learnings或fix
shard map大规模并行审查的Wave 0所有权规划，包含通道ID、分片ID、文件/来源所有权、覆盖预期及合并状态

Dispatch

调度规则

Classify 
$ARGUMENTS
before reading widely.
$ARGUMENTS
ModeAction
`--mode sessionscopedpr
repeated 
--mode
or comma-separated 
--mode scoped,source
multi-modeRun read-only modes as separate lanes and merge through Judge
empty + changed files in 
git diff --name-only HEAD
sessionReview changed files only
empty + no changed filesmenuShow review modes; never start a full audit implicitly
file or directory pathscopedReview that path
audit
full auditReview the repository through triage, specialist lanes, and judge reconciliation
PR number or PR URLPRReview PR diff and stated intent
git range such as 
HEAD~3..HEAD
rangeReview changes in that range
simplify analyze <target>
simplify analyzeRead-only simplification opportunity review
simplify apply <target>
simplify applyBehavior-preserving edit only after the simplification gate passes
simplify explain <target>
simplify explainExplain complexity and safer simpler shapes without editing
source triage <source>
source triageClassify external source reputation, install syntax, and dedupe risk
source inspect <path>
source inspectReview local source files, hooks, scripts, frontmatter, and commands
source commands <path>
source commandsExtract and classify executable surfaces
source provenance <source>
source provenanceCheck owner, URL, license, commit/hash, registry/source-list consistency, and access date
source decision <source-or-path>
source decisionRecommend install-now, inspect, keep-global, build-local, or avoid
source scan <path>
source scanRun static source audit helper and interpret JSON output
`--lens securitysupply-chainci
path under 
skills/<name>/
, 
SKILL.md
, 
evals/*.json
, or skill catalog/research docs		scoped + skill-assetsReview as a skill asset using skill-creator structural patterns, portability, eval, package, and generated-surface gates
--format sarif
output modifierEmit SARIF v2.1 findings in addition to or instead of text
--format conventional
output modifierEmit Conventional Comments-compatible PR review output
history [project]
historyRead stored review history
diff [project]
or 
delta [project]
deltaCompare current and previous stored reviews
`learnings addlistcheck
fix <finding-ids>
or 
apply approved findings
fix passApply only explicitly approved findings through 
references/auto-fix-protocol.md
unrecognized or ambiguousclarifyAsk one concise scope/mode question
先对
$ARGUMENTS
进行分类，再广泛读取内容。
$ARGUMENTS
模式操作
`--mode sessionscopedpr
重复
--mode
或逗号分隔的
--mode scoped,source
多模式以独立通道运行只读模式，通过Judge合并结果
空参数 + 
git diff --name-only HEAD
中存在变更文件		session仅审查变更文件
空参数 + 无变更文件menu显示审查模式；绝不隐式启动全面审计
文件或目录路径scoped审查该路径
audit
full audit通过分类、专业通道及Judge协调审查仓库
PR编号或PR URLPR审查PR差异及声明意图
git版本范围（如
HEAD~3..HEAD
）		range审查该范围内的变更
simplify analyze <target>
simplify analyze只读模式审查简化优化机会
simplify apply <target>
simplify apply仅在通过简化审批后执行行为保留型编辑
simplify explain <target>
simplify explain解释复杂度及更安全的简化方案，不执行编辑
source triage <source>
source triage分类外部来源的可信度、安装语法及重复风险
source inspect <path>
source inspect审查本地源文件、钩子、脚本、前置内容及命令
source commands <path>
source commands提取并分类可执行表面
source provenance <source>
source provenance检查所有者、URL、许可证、提交哈希、注册表/源列表一致性及访问日期
source decision <source-or-path>
source decision建议立即安装、进一步检查、全局保留、本地构建或避免使用
source scan <path>
source scan运行静态源审计助手并解析JSON输出
`--lens securitysupply-chainci
skills/<name>/
、
SKILL.md
、
evals/*.json
或技能目录/研究文档下的路径		scoped + skill-assets使用skill-creator结构模式、可移植性、评估、包及生成表面规则作为技能资产进行审查
--format sarif
输出修改器额外或仅输出SARIF v2.1格式的审查结果
--format conventional
输出修改器输出兼容Conventional Comments的PR审查结果
history [project]
history读取存储的审查历史
diff [project]
或
delta [project]
delta对比当前与之前存储的审查结果
`learnings addlistcheck
fix <finding-ids>
或
apply approved findings
fix pass仅通过
references/auto-fix-protocol.md
应用明确批准的审查结果
无法识别或模糊的参数clarify提出一个简洁的范围/模式问题

Auto-Detection

自动检测

  1. Parse explicit 
    --mode
    flags first. Split comma-separated values and preserve repeated flags.
  2. If explicit modes are present, run only those modes. Infer the target when safe, but never infer edit approval.
  3. If no explicit mode is present, infer from args: empty changed diff -> session, empty clean tree -> menu, path -> scoped, PR number/URL -> PR, git range -> range, 
    audit
    -> full audit, 
    simplify
    -> simplification, 
    source
    or external skill/source language -> source/provenance.
  4. When the selected scope is a skill asset, automatically attach the 
    skill-assets
    lens unless the user explicitly asks for a different lens only.
  5. Multiple read-only modes run as separate lanes and reconcile through Judge.
  6. fix
    and 
    simplify apply
    are edit-capable. Never run them from inference alone and never mix them into a read-only bundle without explicit approved finding IDs.
  7. --lens
    modifies the selected mode; it does not invent scope.
  8. --format
    modifies output only; it does not choose scope.
  9. Feature work, benchmarking, broad refactors, installs, or implementation requests without approved findings are out of scope.
  1. 优先解析明确的
    --mode
    标志。拆分逗号分隔的值并保留重复标志。
  2. 如果存在明确模式，仅运行这些模式。在安全情况下推断目标，但绝不推断编辑审批权限。
  3. 如果没有明确模式，从参数推断：空变更差异→session，空干净代码树→menu，路径→scoped，PR编号/URL→PR，git版本范围→range，
    audit
    →full audit，
    simplify
    →simplification，
    source
    或外部技能/来源语言→source/provenance。
  4. 当选定范围为技能资产时，自动附加
    skill-assets
    视角，除非用户明确要求仅使用其他视角。
  5. 多个只读模式以独立通道运行，并通过Judge协调结果。
  6. fix
    和
    simplify apply
    支持编辑。绝不仅通过推断运行它们，也绝不将它们混入只读任务包，除非有明确批准的审查结果ID。
  7. --lens
    仅修改选定模式；不定义审查范围。
  8. --format
    仅修改输出；不选择审查范围。
  9. 无批准审查结果的功能开发、基准测试、大范围重构、安装或实现请求均超出范围。

Scope Boundaries

范围边界

In scope: review findings, source/provenance decisions, simplification analysis, simplification explanations, narrowly gated simplification apply passes, stored review history, review deltas, false-positive learnings, and approved post-review fixes.
Out of scope: new features, product implementation, benchmark design, broad refactors, live external installs, destructive cleanup, exploit execution, unaudited source promotion, and unapproved fixes.
范围内：审查结果、来源/溯源决策、简化分析、简化说明、严格受限的简化应用流程、存储的审查历史、审查差异、误判学习记录及获批的审查后修复。
范围外：新功能、产品实现、基准设计、大范围重构、实时外部安装、破坏性清理、漏洞利用、未审计来源升级及未获批修复。

Classification Logic

分类逻辑

  1. Decide whether the request is review, simplification, source/provenance, state/history, output formatting, or implementation.
  2. Reject implementation unless it is an approved finding fix or a 
    simplify apply
    target that passes the eligibility gate.
  3. Reject source installs unless the user separately requests a live install after the source/provenance decision.
  4. For skill assets, require skill-creator structural evidence before accepting or rejecting a skill change: dispatch table, empty-args handler, reference index, critical rules, canonical vocabulary when needed, scope boundaries, progressive disclosure, script/eval/package proof, portability, and generated docs/catalog consistency.
  5. When two modes could apply, prefer the read-only mode first and ask one concise question only if the target or approval state is unclear.
  1. 判断请求属于审查、简化、来源/溯源、状态/历史、输出格式还是实现类。
  2. 拒绝实现类请求，除非是获批审查结果的修复或通过资格审批的
    simplify apply
    目标。
  3. 拒绝来源安装请求，除非用户在来源/溯源决策后单独请求实时安装。
  4. 对于技能资产，在接受或拒绝技能变更前，需提供skill-creator结构证据：调度表、空参数处理器、参考索引、关键规则、必要时使用标准术语、范围边界、渐进式披露、脚本/评估/包依据、可移植性及生成文档/目录一致性。
  5. 当两种模式均可应用时，优先选择只读模式，仅在目标或审批状态不明确时提出一个简洁问题。

Scaling Strategy

扩展策略

SizeStrategy
SmallOne file, snippet, or narrow source: run a single reviewer pass with the full finding contract
Medium2-5 related files: split by file ownership when safe and reconcile through judge protocol
LargePR, git range, or mixed module diff: triage first, then assign non-overlapping review lanes by risk
Full auditCreate a Wave 0 shard map, assign risk-tiered non-overlapping lanes, run specialist lenses, and reconcile through Judge
Source/provenance bundleSplit metadata, executable surfaces, credentials/network, license/provenance, and dedupe checks
规模策略
小型单个文件、片段或窄范围来源：以完整审查结果规范运行单次审查
中型2-5个相关文件：在安全情况下按文件所有权拆分，通过Judge协议协调结果
大型PR、git版本范围或混合模块差异：先分类，再按风险分配无重叠的审查通道
全面审计创建Wave 0分片映射，按风险层级分配无重叠通道，运行专业视角审查，通过Judge协调结果
来源/溯源包拆分元数据、可执行表面、凭证/网络、许可证/溯源及重复项检查

Progressive Disclosure

渐进式披露

Start with this file only. Load reference files after dispatch and only for the chosen mode or lens. Do not preload all references for small reviews.
仅从本文件开始。调度后仅为选定模式或视角加载参考文件。小型审查无需预加载所有参考资料。

Review Pipeline

审查流程

  1. Triage: identify scope, changed files, public contracts, project instructions, dependency graph, risk tier, and specialist lenses.
  2. Shard: for large or multi-mode work, produce a Wave 0 shard map before spawning reviewers.
  3. Analyze: inspect code/source using content-adaptive reviewers. Keep ownership non-overlapping when parallelizing.
  4. Verify: check every non-trivial finding against source lines, tests, grep evidence, docs, or external research.
  5. Judge: normalize, assign canonical 
    RV-*
    IDs, dedupe, resolve conflicts, apply confidence thresholds, rank by severity/confidence/blast radius, and preserve strengths.
  6. Report: present findings first, ordered by severity, with concise evidence and an approval gate.
  7. Fix pass: only after explicit approval of selected finding IDs, load 
    references/auto-fix-protocol.md
    , preview diffs, apply narrowly, and verify.
  1. 分类：确定范围、变更文件、公共契约、项目说明、依赖图、风险层级及专业视角。
  2. 分片：对于大型或多模式任务，在启动审查前生成Wave 0分片映射。
  3. 分析：使用内容自适应审查工具检查代码/来源。并行处理时保持所有权无重叠。
  4. 验证：针对每个非 trivial 审查结果，对照源代码行、测试、grep证据、文档或外部研究进行验证。
  5. 协调：标准化结果、分配规范的
    RV-*
    ID、去重、解决冲突、应用置信度阈值、按严重程度/置信度/影响范围排序，并保留亮点。
  6. 报告：优先展示结果，按严重程度排序，附带简洁证据及审批环节。
  7. 修复流程：仅在明确批准选定审查结果ID后，加载
    references/auto-fix-protocol.md
    ，预览差异，窄范围应用并验证。

Large Review Shards

大型审查分片

For large or multi-mode reviews, every subagent must receive a lane ID, shard ID, exact scope, coverage expectations, non-goals, and artifact contract before dispatch.
对于大型或多模式审查，每个子代理在调度前必须收到通道ID、分片ID、精确范围、覆盖预期、非目标及产物规范。

Judge Handoff

协调移交

Worker findings use local IDs only. The Judge assigns canonical 
RV-*
IDs after all lane artifacts are normalized, deduped, confidence-filtered, and ranked.
审查结果仅使用本地ID。Judge在所有通道产物标准化、去重、置信度过滤及排序后分配规范的
RV-*
ID。

Finding Contract

审查结果规范

Every finding uses this order:
  1. Citation: verified 
    [file:start-end]
    , PR hunk, source URL, command output anchor, or provenance anchor.
  2. Reasoning: why this matters and what breaks if it is left alone.
  3. Finding: one concise statement of the issue.
  4. Severity and confidence: P0-P3/S0-S3 plus 0.0-1.0 confidence.
  5. Evidence: source/tool/research/test proof; include degraded-mode limits when tools are unavailable.
  6. Recommendation: smallest safe next step.
Use 
references/finding-contract.md
for full schema and scoring.
每个审查结果需按以下顺序呈现：
  1. 引用：已验证的
    [file:start-end]
    、PR代码块、来源URL、命令输出锚点或溯源锚点。
  2. 推理：说明该问题的重要性及不修复的后果。
  3. 结果：简洁的问题陈述。
  4. 严重程度与置信度：P0-P3/S0-S3分级加上0.0-1.0的置信度评分。
  5. 证据：来源/工具/研究/测试依据；当工具不可用时，说明降级模式限制。
  6. 建议：最小化风险的下一步操作。
完整 schema 及评分规则请参考
references/finding-contract.md
。

Lens Contracts

视角规范

Load references only when the selected mode needs them.
NeedRead
finding schema and scoring
references/finding-contract.md
triage/scaling
references/triage-protocol.md
review checklists
references/checklists.md
reviewer team prompts
references/team-templates.md
creative review lenses
references/review-lenses.md
research validation
references/research-validation.md
judge reconciliation
references/judge-protocol.md
self-verification
references/self-verification.md
output variants
references/output-formats.md
SARIF output
references/sarif-output.md
Conventional Comments output
references/conventional-comments.md
CI annotations and automation
references/ci-integration.md
dependency graph and blast radius
references/dependency-context.md
supply-chain security
references/supply-chain-security.md
specialist lens map
references/specialist-lenses.md
skill asset and skill-creator paradigms
references/skill-asset-review.md
simplification lens
references/simplification-lens.md
simplification taxonomy
references/simplification-taxonomy.md
source/provenance lens
references/source-provenance-lens.md
approval-gated fixes
references/auto-fix-protocol.md
review state, history, delta, learnings
references/review-state.md
仅在选定模式需要时加载参考文件。
需求参考文件
审查结果schema及评分
references/finding-contract.md
分类/扩展
references/triage-protocol.md
审查检查清单
references/checklists.md
审查团队提示
references/team-templates.md
创意审查视角
references/review-lenses.md
研究验证
references/research-validation.md
协调规则
references/judge-protocol.md
自我验证
references/self-verification.md
输出变体
references/output-formats.md
SARIF输出
references/sarif-output.md
Conventional Comments输出
references/conventional-comments.md
CI注释与自动化
references/ci-integration.md
依赖图与影响范围
references/dependency-context.md
供应链安全
references/supply-chain-security.md
专业视角映射
references/specialist-lenses.md
技能资产与skill-creator范式
references/skill-asset-review.md
简化视角
references/simplification-lens.md
简化分类法
references/simplification-taxonomy.md
来源/溯源视角
references/source-provenance-lens.md
需审批的修复
references/auto-fix-protocol.md
审查状态、历史、差异、学习记录
references/review-state.md

Simplification Lens

简化视角

/review simplify
is behavior-preserving. It may identify or apply clarity improvements only when the target, unchanged invariants, validation basis, and scope boundaries are explicit.
  • analyze
    : read-only report.
  • explain
    : teaching/explanation only.
  • apply
    : edit only a concrete file/symbol/snippet or tightly bounded diff after the eligibility gate passes.
Reject semantic changes, bug fixes, API changes, validation changes, security-policy changes, performance-only work, or broad refactors under simplification mode.
/review simplify
是行为保留型的。仅当目标、不变量、验证依据及范围边界明确时，才可识别或应用清晰度优化。
  • analyze
    ：只读报告。
  • explain
    ：仅用于教学/解释。
  • apply
    ：仅在通过资格审批后，对具体文件/符号/片段或严格受限的差异执行编辑。
拒绝在简化模式下进行语义变更、bug修复、API变更、验证规则变更、安全策略变更、仅优化性能的工作或大范围重构。

Source/Provenance Lens

来源/溯源视角

/review source
is the trust gate for external skills and sources. Use source-list and read-only inspection before any install or promotion decision. Inspect hooks, scripts, command substitutions, allowed tools, package scripts, network calls, credential behavior, filesystem writes, provenance, license, owner, commit/hash, and dedupe against repo-owned skills.
Never run candidate scripts during audit except static/syntax checks in a staged local path. Do not install or sync external skills unless the user explicitly requests that live action.
/review source
是外部技能和来源的信任关卡。在做出任何安装或升级决策前，需使用源列表并进行只读检查。检查钩子、脚本、命令替换、允许的工具、包脚本、网络调用、凭证行为、文件系统写入、溯源、许可证、所有者、提交哈希，并与仓库自有技能进行重复项排查。
审计期间绝不运行候选脚本，除非在暂存本地路径中进行静态/语法检查。除非用户明确请求实时操作，否则不得安装或同步外部技能。

Browser-Grounded Review

基于浏览器的审查

For frontend, a11y, web-quality, docs UI, and other browser-dependent review, prefer Chrome DevTools MCP through the repo-managed 
chrome-devtools
MCPHub attached-browser configuration. Use browser snapshots, console/network evidence, and screenshots from Chrome DevTools MCP when available. If Chrome DevTools MCP is unavailable, state degraded mode before falling back to existing smoke tests or Playwright-oriented project checks.
对于前端、a11y、网页质量、文档UI及其他依赖浏览器的审查，优先通过仓库管理的
chrome-devtools
MCPHub附加浏览器配置使用Chrome DevTools MCP。当可用时，使用Chrome DevTools MCP的浏览器快照、控制台/网络证据及截图。如果Chrome DevTools MCP不可用，在降级到现有冒烟测试或Playwright导向的项目检查前，需说明降级模式。

Skill-Asset Review

技能资产审查

When the scope is a skill asset, load 
references/skill-asset-review.md
and apply skill-creator paradigms as review evidence. Use deterministic 
skill-creator
scripts when available, but do not treat a high audit score as the whole review. Check whether the skill's structure, dispatch behavior, evals, references, scripts, package portability, public docs, and generated catalog surfaces match the intended behavior.
Skill-asset review is read-only unless the user invokes a valid fix pass or a separately approved implementation request. Do not run live installs, live behavioral evals, or sync apply while reviewing skill assets.
当审查范围为技能资产时，加载
references/skill-asset-review.md
并应用skill-creator范式作为审查证据。当可用时使用确定性的
skill-creator
脚本，但不得将高审计分数视为完整审查结果。检查技能的结构、调度行为、评估、参考资料、脚本、包可移植性、公开文档及生成的目录表面是否与预期行为一致。
技能资产审查为只读模式，除非用户调用有效的修复流程或单独获批的实现请求。审查技能资产时，不得运行实时安装、实时行为评估或同步应用操作。

Harness Portability

工具兼容性

This 
SKILL.md
is portable and prompt-first. It deliberately omits a root model override and skill-scoped hooks.
HarnessBehavior
Claude CodeUses portable skill metadata and argument hints. Skill hooks require separate 
validate_hooks.py
and package proof before being added.
CodexSkill discovery and any hook behavior are projected through repo/plugin config such as 
config/hook-registry.json
, not assumed from this file.
OpenCodeSkill discovery comes from repo 
opencode.json
and skill paths; models/plugins/overlays stay in OpenCode config.
Grok Build CLIUses Claude-compatible skill mirroring and 
.grok/skills
discovery where available.
Generic Skills CLI targetsCore prompt must install cleanly through 
npx skills add
and repo sync dry-runs.
本
SKILL.md
具备可移植性且以提示优先。它故意省略了根模型覆盖和技能范围钩子。
工具行为
Claude Code使用可移植技能元数据及参数提示。技能钩子需单独的
validate_hooks.py
及包依据才可添加。
Codex技能发现及任何钩子行为通过仓库/插件配置（如
config/hook-registry.json
）实现，而非从本文件推断。
OpenCode技能发现来自仓库
opencode.json
及技能路径；模型/插件/覆盖配置保留在OpenCode设置中。
Grok Build CLI在可用情况下使用兼容Claude的技能镜像及
.grok/skills
发现机制。
通用Skills CLI目标核心提示需通过
npx skills add
及仓库同步试运行完成干净安装。

State Management

状态管理

Review history, deltas, and false-positive learnings persist in the active harness home directory, not in the repository.
  • Base path: 
    ~/.{gemini|copilot|codex|claude}/reviews/
    (harness-dependent; Claude Code defaults to 
    .claude
    ).
  • State file naming: 
    {YYYY-MM-DD}-{project-slug}-{mode}[-{run_id}].json
    under the reviews directory.
  • Learnings: 
    {reviews}/learnings/{project-slug}.json
    for false-positive dismissals.
  • Slug rule: lowercase project names with non-alphanumeric runs replaced by hyphens; empty slugs become 
    unnamed
    .
  • Collision: same-day reruns use distinct 
    run_id
    suffixes; saves do not silently overwrite prior review state files.
  • Operations: use 
    scripts/review-store.py
    for save/load/list/diff and 
    scripts/learnings-store.py
    for add/check/list/clear.
  • Read-only modes: 
    history
    , 
    delta
    , and 
    learnings list
    never edit reviewed source files.
  • Cleanup: user-owned; no automatic pruning. Do not commit review JSON into the repo.
  • Details: load 
    references/review-state.md
    for envelope fields, diff semantics, and harness path table.
审查历史、差异及误判学习记录持久化存储在当前工具的主目录中，而非仓库内。
  • 基础路径：
    ~/.{gemini|copilot|codex|claude}/reviews/
    （取决于工具；Claude Code默认使用
    .claude
    ）。
  • 状态文件命名：审查目录下的
    {YYYY-MM-DD}-{project-slug}-{mode}[-{run_id}].json
    。
  • 学习记录：
    {reviews}/learnings/{project-slug}.json
    用于存储误判排除记录。
  • Slug规则：项目名称小写，非字母数字字符替换为连字符；空slug命名为
    unnamed
    。
  • 冲突处理：同日重复运行使用不同的
    run_id
    后缀；保存操作不会静默覆盖之前的审查状态文件。
  • 操作工具：使用
    scripts/review-store.py
    进行保存/加载/列出/对比，使用
    scripts/learnings-store.py
    进行添加/检查/列出/清除。
  • 只读模式：
    history
    、
    delta
    及
    learnings list
    绝不编辑被审查的源文件。
  • 清理：由用户自行处理；无自动清理机制。不得将审查JSON提交到仓库。
  • 详细规则：加载
    references/review-state.md
    查看信封字段、差异语义及工具路径表。

Script Index

脚本索引

ScriptPurpose
scripts/check.py
Run review skill validation, eval validation, package dry-run, and audit
scripts/project-scanner.py
Triage project/file risk and review triggers
scripts/finding-formatter.py
Normalize findings and output variants
scripts/review-store.py
Store/load/list/diff review state
scripts/learnings-store.py
Manage false-positive learnings
scripts/sarif-uploader.py
Help emit/upload SARIF where supported
scripts/source-audit.py
Static audit of local external skill/source directories
脚本用途
scripts/check.py
运行审查技能验证、评估验证、包试运行及审计
scripts/project-scanner.py
分类项目/文件风险及审查触发条件
scripts/finding-formatter.py
标准化审查结果及输出变体
scripts/review-store.py
存储/加载/列出/对比审查状态
scripts/learnings-store.py
管理误判学习记录
scripts/sarif-uploader.py
辅助生成/上传SARIF格式结果（如支持）
scripts/source-audit.py
对本地外部技能/来源目录进行静态审计

Critical Rules

关键规则

  1. Never start a full audit from empty args unless the user says 
    audit
    .
  2. Never edit files during read-only review, source/provenance review, history, delta, or simplify analyze/explain.
  3. Never apply fixes without explicit approval of selected findings.
  4. Never vendor third-party skill files into 
    skills/
    during source/provenance review.
  5. Always verify citation anchors before reporting findings.
  6. Always state degraded-mode limits when validation tools are unavailable.
  7. Always separate evidence from inference.
  8. Always preserve unrelated dirty work.
  9. Do not present 
    honest-review
    , 
    simplify
    , or 
    external-skill-auditor
    as installable or invocable skills. Rewrite active references to 
    /review
    , 
    /review simplify
    , or 
    /review source
    ; leave only clearly historical or research evidence mentions.
  10. For skill assets, apply skill-creator paradigms before reporting a no-finding result: run or cite audit/package/eval evidence when available, inspect references and eval coverage, and classify generated docs/catalog drift separately from source defects.
  1. 除非用户明确输入
    audit
    ，否则绝不因空参数启动全面审计。
  2. 在只读审查、来源/溯源审查、历史、差异或simplify analyze/explain模式下，绝不编辑文件。
  3. 无明确批准的选定审查结果时，绝不应用修复。
  4. 在来源/溯源审查期间，绝不将第三方技能文件纳入
    skills/
    目录。
  5. 报告审查结果前，始终验证引用锚点。
  6. 当验证工具不可用时，始终说明降级模式限制。
  7. 始终区分证据与推断内容。
  8. 始终保留无关的未完成工作。
  9. 不得将
    honest-review
    、
    simplify
    或
    external-skill-auditor
    展示为可安装或可调用的技能。将现有引用重写为
    /review
    、
    /review simplify
    或
    /review source
    ；仅保留明确的历史或研究证据提及。
  10. 对于技能资产，在报告无问题结果前需应用skill-creator范式：运行或引用审计/包/评估证据（如可用），检查参考资料及评估覆盖范围，并将生成文档/目录漂移与源缺陷分开分类。

Validation Contract

验证规范

Before considering changes complete, run the focused checks relevant to this skill:
bash
uv run python scripts/check.py
Completion criteria:
  1. scripts/check.py
    exits 0.
  2. Bundled 
    validate_skill
    and 
    validate_evals
    pass when evals are present.
  3. Bundled 
    package.py --dry-run
    reports portable.
  4. Repo-only 
    audit.py
    grade remains at or above the prior baseline when run from the monorepo (optional for portable installs; degraded mode is acceptable elsewhere).
  5. Regenerate docs/catalog surfaces when 
    SKILL.md
    , references, or evals change.
  6. Any remaining legacy-name references are classified as wrappers, migration notes, generated evidence, or historical research.
在确认变更完成前，运行与本技能相关的重点检查：
bash
uv run python scripts/check.py
完成标准：
  1. scripts/check.py
    执行返回0。
  2. 当存在评估时，附带的
    validate_skill
    及
    validate_evals
    检查通过。
  3. 附带的
    package.py --dry-run
    报告具备可移植性。
  4. 从单体仓库运行时，仓库专属的
    audit.py
    评分保持在或高于之前的基准线（可移植安装可选；其他环境下降级模式可接受）。
  5. 当
    SKILL.md
    、参考资料或评估变更时，重新生成文档/目录表面。
  6. 所有剩余的旧名称引用需分类为包装器、迁移说明、生成证据或历史研究。