Audit Project

Organization

devcodex-labs

audit-project

项目工程审查维度 PE-1~PE-12 — 代码质量/项目结构/依赖安全/资源泄漏专属审查层

Overview

Publisher	devcodex-labs
Repository	`devcodex`
Skill name	`audit-project`
Stars	433
Forks	44
Bundled files	1
License	AGPL-3.0
Links	Skill source Repository Homepage

Markdown instructions
A SKILL.md file the model loads on demand, so it only costs tokens when a request actually matches.
Works with any LLM
AI skills are plain Markdown, not provider-specific code, so this works with GPT, Claude, Gemini, Grok, or a local model.
1 bundled files
Scripts, templates, and references the model can read while it works. Files are read-only and never executed.
Open source
Published by devcodex-labs on GitHub. Read the source before you install it.

Installation

Install the Audit Project AI skill in TypingMind to use it with any LLM, or drop it into another agent that reads SKILL.md.

Install in TypingMind

TypingMind installs a skill straight from its GitHub folder — it reads SKILL.md, bundles the resource files, and stores the result locally.

Open the app and go to Plugins → Skills.
Choose "Install from GitHub".
Paste the skill folder URL below and confirm.
https://github.com/devcodex-labs/devcodex/tree/main/content/skills/audit-project
Enable the skill in any chat where you want it available.

Plugins → Skills → Add skill → From GitHub URL, then paste the folder URL and press Continue.

Install in another agent

Any agent that reads the Agent Skills format can use this skill — copy the folder into that agent's skills directory.

Claude Code — .claude/skills

git clone --depth 1 https://github.com/devcodex-labs/devcodex.git /tmp/devcodex
mkdir -p .claude/skills
cp -r /tmp/devcodex/content/skills/audit-project .claude/skills/audit-project

Restart Claude Code after copying so it picks up the new skill.

Use it in TypingMind

Enable Audit Project in any TypingMind chat and the model takes it from there. Its name and description sit in the system prompt, and the moment a request matches, the model loads the full instructions itself — you never invoke it by hand, and it costs no tokens until it is actually used.

The model loads Audit Project on its own as soon as a request matches it.

Works with any AI model

AI skills are plain Markdown instructions rather than provider-specific code, so Audit Project is not tied to the model it was written for. Install it once in TypingMind and use it with GPT-5, Claude, Gemini, Grok, DeepSeek, Mistral, Llama, or a local model you run yourself — all on your own API keys.

Loaded only when it is needed
The system prompt carries just the name and description. The instructions are fetched on the first matching request, so an idle skill costs nothing.
Switch models mid-chat
Because the skill is instructions rather than code, changing model does not break it — the next model reads the same SKILL.md.

Skill instructions

This is the SKILL.md content the model loads. Read it before installing — a skill is instructions your model will follow.

Audit Project Skill

适用范围

审查目标为项目工程（源码质量、目录结构、依赖健康、测试覆盖）时，叠加本 Skill（在 G1~G5 之后）。

维度总览（PE-1~PE-12）

分组	维度	优先级
A — 结构与可维护性	PE-1 项目结构合理性 · PE-5 可维护性	🔴/🟡
B — 健壮性	PE-2 错误处理完整性 · PE-3 安全性 · PE-4 性能隐患 · PE-12 资源生命周期与泄漏风险	🔴/🟡
C — 接口与配置	PE-8 接口一致性 · PE-10 配置管理	🔴/🟡
D — 质量保障	PE-6 测试覆盖 · PE-7 依赖健康度	🟡/💡
E — 可观测性与数据	PE-9 日志与可观测性 · PE-11 数据层质量	🟡

核心检查维度

PE-0 Profile Freshness 衔接 🔴

先执行 audit-common 的 Profile Freshness Check（PFresh）
不只检查“项目是否符合 Profile”，还要反向检查 Profile 是否仍符合当前 package、目录结构、脚本清单、发布状态、宿主能力和当前任务现实
若 Profile 过期，项目工程审查结论不得直接标注收敛；需先记录漂移或同步要求

PE-1 项目结构合理性 🔴

目录结构与 profile 02-架构约束.md 一致
模块/文件职责单一（不混合路由/业务/数据层）
函数/方法长度 ≤50 行，嵌套深度 ≤4 层
无循环依赖
简单业务 service 不重复 route validate、model/schema、数据导入或框架已承担的校验、归一化、配置兜底和二次治理

PE-2 错误处理完整性 🔴

异步操作有 catch 处理
外部依赖调用有超时和重试策略
错误信息不暴露内部细节

PE-3 安全性 🔴

敏感信息、密钥、密码和硬编码处理符合用户 / 项目显式策略；未指定禁止时不把直写本身列为问题
输入验证覆盖边界条件
SQL/NoSQL 查询无注入风险
用户自有/明确授权的本地安全审查执行 security-threat-modeling 的 AuthorizedLocalSecurityAuditPresentationGate：核对 authorizationContext、defensiveObjective、用户可见最小证据、隔离探针、SafetyInterruptionCard 与恢复路线；禁止把“优化表达”写成绕过宿主安全控制

PE-4 性能隐患 🟡

算法复杂度、查询次数、同步阻塞、重复序列化或大对象复制不会在目标数据规模下造成明显退化
缓存、队列、批处理和并发限制有边界，避免把性能优化变成无界内存占用
若性能风险来自资源生命周期或清理缺失，必须同时按 PE-12 判定

PE-6 测试覆盖与验证门禁 🟡

从 ../spec-governance/gate-registry.json 选择与变更事实匹配的 gateGroup，核对 Owner Skill 的必需证据和 test-router 生成的路线；本维度不复制 coverage、runtime/plugin、fingerprint、风险簇或派生消费者的完整门禁正文
审查必须区分“测试断言通过”“覆盖率/跨边界路线通过”“跳过但有权威替代证据”；不满足时按实际状态降级

PE-7 依赖健康度 🟡

Node.js 项目默认 engines.node、CI matrix、Profile 与 README 不低于 >=18；低于 v18 有业务理由、风险和验证证据
依赖升级 / 兼容修复已区分 业务源码平滑性 与 依赖层落地条件
根因位于内部共享库、中间件、SDK 或 adapter 抽象层时，已评估“修共享库 + 消费项目升级”是否优于单项目补丁

PE-8 接口一致性 🔴

provider / connector / SDK 接入具备 provider metadata、内部 payload、上游 request 映射、标准化 result、错误 detail 字段级合同
JavaScript / Node.js 中命中必要注释的导出函数、核心业务函数、类、复杂对象契约、参数/返回/异常说明使用标准 JSDoc

PE-12 资源生命周期与泄漏风险 🔴

必查内存泄露 / 资源泄漏风险：长生命周期集合、缓存、队列、订阅表、全局单例或闭包引用不得无界增长
连接、事务、文件句柄、流、游标、socket、worker、定时器、interval、事件监听器和外部 SDK client 必须有明确释放、取消订阅或关闭路径
前端 / UI 代码必须在组件卸载、路由切换、effect 重新执行或异步任务取消时清理监听器、定时器、订阅、AbortController 和外部引用
异常分支、早返回、重试失败、超时、取消和测试 teardown 场景必须同样释放资源；不能只检查 happy path
若项目语言或框架提供专用工具（heap snapshot、profiler、leak detector、lint rule、test teardown hook 等），审查报告应说明是否执行或标注 N/A + skipReason
高风险资源泄漏修复、公开库/adapter/SDK、连接池、监听器、定时器、worker、cache 或公开方法生命周期风险命中时，应检查 MethodLevelLeakPressureProbe 是否有重复调用/生命周期压测证据；低风险纯函数可写 N/A + skipReason

条件 Owner 审查索引

涉及前端/UI、发布、数据、安全、文档、外部消费者、性能、资源生命周期或治理控制面时，读取 ../spec-governance/gate-registry.json，按 gateGroup 触发对应 Owner Skill
本 Skill 只核对项目工程事实、Owner 是否正确触发、证据是否存在、TestRoute 是否充分以及报告结果是否与证据一致；专属字段和执行语义归 Owner
未命中的分组写 N/A + skipReason；命中却缺少 Owner 证据时不得用通用审查表述代替

N/A 规则

纯前端项目无 DB：PE-11 标 N/A
纯库项目无日志需求：PE-9 标 N/A
无长生命周期资源、订阅、连接、定时器、缓存或 UI 生命周期的纯静态内容变更：PE-12 可标 N/A + skipReason
无用户可见 UI、交互流或视觉呈现的后端 / CLI / 文档变更：FrontendExperienceQualityGate 可标 N/A + skipReason
未触发跨项目已吸纳守门时，CrossProjectLearnedGuards 可标 N/A + skipReason
未涉及代码/文档/示例/fixture/quick start/技术方案/报告产物，且用户未指出“不专业 / 像初级 / 示例误导”时，ExpertOutputQualityGate 可标 N/A + skipReason
未触发审查发现 intake 时，ReviewFindingIntakeGate 可标 N/A + skipReason
未触发资源生命周期或公开方法泄漏风险时，MethodLevelLeakPressureProbe 可标 N/A + skipReason

Bundled files

The model reads these on demand while the skill is loaded. They are exposed as readable files and are never executed.

intent.json1 KB

Frequently asked questions

What does the Audit Project AI skill do?

项目工程审查维度 PE-1~PE-12 — 代码质量/项目结构/依赖安全/资源泄漏专属审查层

Why use Audit Project on TypingMind?

Because you install it once and use it with any model. Audit Project is plain Markdown rather than provider-specific code, so the same skill runs on GPT-5, Claude, Gemini, Grok, or a local model — and you can switch model mid-chat without it breaking. TypingMind runs on your own API keys, so you pay providers directly instead of a per-seat subscription, and your skills and chats stay in your own storage.

How do I install Audit Project in TypingMind?

Open Plugins → Skills → Install from GitHub in TypingMind and paste https://github.com/devcodex-labs/devcodex/tree/main/content/skills/audit-project. TypingMind reads its SKILL.md and bundles its files and installs it as a skill you can enable per chat.

Which AI models can use Audit Project?

Any model you connect in TypingMind. AI skills are plain Markdown instructions rather than provider-specific code, so GPT, Claude, Gemini, Grok, and local models can all load this skill when a request matches it.

How many AI models can I use with Audit Project?

As many as you like. As long as a model supports skills, you can use Audit Project with it — GPT, Claude, Gemini, Grok, DeepSeek, Mistral, Llama and more — all on TypingMind with your own API keys.

Is the Audit Project AI skill free?

Yes. It is published on GitHub by devcodex-labs under the AGPL-3.0 license. You only pay your own AI provider for the tokens you use.

What are AI skills?

An AI skill is a reusable instruction bundle that teaches an AI model how to do one specific task. It follows the open Agent Skills format: a SKILL.md file with a name and description, plus any scripts, templates or reference files the model may need. The model reads the instructions only when your request matches the skill, so an installed skill costs nothing until it is used.

How are AI skills different from plugins or MCP servers?

A plugin or MCP server gives a model new tools to call — code that runs somewhere and returns a result. An AI skill gives the model knowledge and process instead: how to approach a task, which steps to follow, what good output looks like. Skills are plain Markdown, so they need no server, no API key and no runtime, and they work with any model.

View all

Solid

openclaw

OrganizationPopular

Write, port, review, or test Solid 2 UI in OpenClaw (Control UI, plugin views, Canvas hosts), including state ownership, Lit interop during the migration, native overlays, testing, performance, and…

Auto Qa

Run OpenClaw-wide autonomous QA and live/stress campaigns across independent subsystem lanes, with verified fixes and a resumable evidence report.

Autoreview

Structured code review when explicitly requested, preferring OpenAI/Codex before Claude.

Claw Score

Audit or refresh OpenClaw maturity scorecard docs from root taxonomy, maturity scores, and QA evidence artifacts without using maintainer discrawl data or committed inventory reports.

Overview

Installation

Install in TypingMind

Install in another agent

Use it in TypingMind

Works with any AI model

Skill instructions

Audit Project Skill

适用范围

维度总览（PE-1~PE-12）

核心检查维度

N/A 规则

Bundled files

Frequently asked questions

Related AI Skills

Set up your own AI workspace now