[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C5ATJ556ZXDF481HBV78MR":3,"skill-same:01M6C5ATJ556ZXDF481HBV78MR":60},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":33,"linkOnly":34,"markdownContent":35,"markdownBody":36,"frontMatter":37,"refName":38,"commitSha":39,"skillDirectory":40,"forksCount":41,"repositoryHtmlUrl":42,"repositoryHomepageUrl":6,"ownerHtmlUrl":43,"ownerBlogUrl":6,"ownerDescription":44,"updatedAt":45,"install":46,"resources":59},"01M6C5ATJ556ZXDF481HBV78MR","qa-audit",null,"Audit a project or system across code, architecture, security, dependencies, tests, operations, and repository integrity.","Lyther\u002Fagent-surface","Lyther","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F29906124?v=4","01M6C587M9T34T0SAGJSRK043Y","Enderaoe","01M6C587R0TXH3MFR8SRFPV61G",65,"MIT","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fqa-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32],"qa","audit","qa audit","security","architecture","code","repository","integrity","system","operations","dependencies","across","project","tests","2026-11-10 10:12:30",false,"---\nname: qa-audit\ndescription: \"Audit a project or system across code, architecture, security, dependencies, tests, operations, and repository integrity.\"\n---\n\n## Objective\n\nPerform an evidence-backed audit at the depth the project's maturity, exposed risks, and requested claim justify; security is one audit domain, not a separate mandatory ceremony. `qa-audit` is broad and read-only: use `qa-review` for a focused review of a current diff and `qa-trace` for deep root-cause, dataflow, race, or exploitability tracing. Route accepted remediation through the appropriate development or operations workflow.\n\n## Input\n\n`qa-audit [target] [--domain architecture|code|security|dependencies|tests|operations|repository|all] [--depth quick|standard|deep] [--maturity prototype|mvp|core|usable|production|business|auto]`\n\nDefaults: `--domain all --depth standard --maturity auto`.\n\n## Scope Gate\n\nBefore running tools, resolve the target tree, artifact, service, or deployment; the maturity and claim being assessed; the user-visible and externally reachable surfaces; applicable repository policy, threat boundaries, and acceptance evidence; and exclusions and unavailable real dependencies.\n\nApply production, enterprise, compliance, or supply-chain requirements to a prototype or MVP only when its actual data, exposure, or contract requires them. Never lower the bar for auth, secrets, destructive effects, money, or sensitive data merely because the project is early.\n\n## Domains\n\n- Architecture: does the design serve the current outcome or preserve a disproven premise? Are ownership, state, dataflow, and failure boundaries clear? Are abstractions, services, compatibility layers, and configuration axes earned? Is there one source of truth, or duplicated authority and synchronization?\n- Code: trace primary behavior and failure paths through real entry points; find correctness defects, swallowed errors, unsafe state transitions, races, leaks, and user-visible regressions; flag duplicate implementations, dead paths, speculative frameworks, and hand-built substitutes for proven local or standard capabilities.\n- Security: build a threat model from real assets, actors, trust boundaries, and reachable inputs; review authentication, authorization, secrets, injection, data exposure, unsafe defaults, destructive actions, and dependency risk where applicable; reproduce findings safely when possible; rate severity by reachability, prerequisites, impact, and confidence. Require SBOMs, provenance, SAST suites, KEV\u002FEPSS correlation, signing, and compliance controls only when the release, deployment, customer, or regulatory contract calls for them.\n- Dependencies: identify unused, duplicated, vulnerable, abandoned, unpinned, or unjustifiably heavy dependencies; verify current advisories and maintenance from authoritative sources before making time-sensitive claims; compare a proposed dependency with the existing stack and a small local implementation, including license, install scripts, native code, transitive footprint, compatibility, and lockfile impact.\n- Tests: check that tests discriminate real faults and use independent oracles; reject unjustified substitutes, tautological assertions, skip\u002Fxfail drift, mock-only boundary proof, and tests that pass on the pre-fix tree; separate diagnostic test results from real integration, E2E, acceptance, and readiness evidence.\n- Operations: review configuration, observability, deployment, migration, rollback, recovery, idempotency, resource limits, and failure visibility at the maturity actually claimed; treat an unavailable real environment as `BLOCKED`, not passed.\n- Repository: find dead files, temporary artifacts, stale scripts, generated debris, broken references, misleading docs, obsolete configs, duplicate assets, and ownership ambiguity; distinguish tracked product artifacts from ignored local state and generated outputs.\n\n## Method\n\n1. Inventory the target at low resolution.\n2. Select only applicable domains and tools.\n3. Trace the highest-impact surfaces first.\n4. Confirm each finding against source, runtime evidence, or an authoritative external source.\n5. Remove duplicates and non-findings; do not inflate severity.\n6. Report proof gaps separately from defects.\n\nRead-only probes may run in parallel under one synthesis owner. Do not mutate the target, install remediations, weaken gates, or create a findings file unless the user requests it.\n\n## Verdict\n\n- `FAIL`: at least one confirmed Critical or High issue in the audited claim, or evidence shows the claim is false.\n- `PASS`: no open Critical or High issue in the completed scope and the required real evidence exists.\n- `BLOCKED`: required target access, dependency, environment, or evidence is unavailable.\n- `ADVISORY`: no pass\u002Ffail claim was requested; report severity-ranked findings and gaps.\n\n## Output\n\n```markdown\n## Audit Scope\n- Target:\n- Maturity and claim:\n- Domains:\n- Evidence run:\n- Not run \u002F blocked:\n\n## Findings\n### [Critical|High|Medium|Low] Title\n- Evidence:\n- Impact:\n- Recommendation:\n\n## Proof Gaps\n- ...\n\n## Verdict\nPASS | FAIL | BLOCKED | ADVISORY\n```\n","## Objective\n\nPerform an evidence-backed audit at the depth the project's maturity, exposed risks, and requested claim justify; security is one audit domain, not a separate mandatory ceremony. `qa-audit` is broad and read-only: use `qa-review` for a focused review of a current diff and `qa-trace` for deep root-cause, dataflow, race, or exploitability tracing. Route accepted remediation through the appropriate development or operations workflow.\n\n## Input\n\n`qa-audit [target] [--domain architecture|code|security|dependencies|tests|operations|repository|all] [--depth quick|standard|deep] [--maturity prototype|mvp|core|usable|production|business|auto]`\n\nDefaults: `--domain all --depth standard --maturity auto`.\n\n## Scope Gate\n\nBefore running tools, resolve the target tree, artifact, service, or deployment; the maturity and claim being assessed; the user-visible and externally reachable surfaces; applicable repository policy, threat boundaries, and acceptance evidence; and exclusions and unavailable real dependencies.\n\nApply production, enterprise, compliance, or supply-chain requirements to a prototype or MVP only when its actual data, exposure, or contract requires them. Never lower the bar for auth, secrets, destructive effects, money, or sensitive data merely because the project is early.\n\n## Domains\n\n- Architecture: does the design serve the current outcome or preserve a disproven premise? Are ownership, state, dataflow, and failure boundaries clear? Are abstractions, services, compatibility layers, and configuration axes earned? Is there one source of truth, or duplicated authority and synchronization?\n- Code: trace primary behavior and failure paths through real entry points; find correctness defects, swallowed errors, unsafe state transitions, races, leaks, and user-visible regressions; flag duplicate implementations, dead paths, speculative frameworks, and hand-built substitutes for proven local or standard capabilities.\n- Security: build a threat model from real assets, actors, trust boundaries, and reachable inputs; review authentication, authorization, secrets, injection, data exposure, unsafe defaults, destructive actions, and dependency risk where applicable; reproduce findings safely when possible; rate severity by reachability, prerequisites, impact, and confidence. Require SBOMs, provenance, SAST suites, KEV\u002FEPSS correlation, signing, and compliance controls only when the release, deployment, customer, or regulatory contract calls for them.\n- Dependencies: identify unused, duplicated, vulnerable, abandoned, unpinned, or unjustifiably heavy dependencies; verify current advisories and maintenance from authoritative sources before making time-sensitive claims; compare a proposed dependency with the existing stack and a small local implementation, including license, install scripts, native code, transitive footprint, compatibility, and lockfile impact.\n- Tests: check that tests discriminate real faults and use independent oracles; reject unjustified substitutes, tautological assertions, skip\u002Fxfail drift, mock-only boundary proof, and tests that pass on the pre-fix tree; separate diagnostic test results from real integration, E2E, acceptance, and readiness evidence.\n- Operations: review configuration, observability, deployment, migration, rollback, recovery, idempotency, resource limits, and failure visibility at the maturity actually claimed; treat an unavailable real environment as `BLOCKED`, not passed.\n- Repository: find dead files, temporary artifacts, stale scripts, generated debris, broken references, misleading docs, obsolete configs, duplicate assets, and ownership ambiguity; distinguish tracked product artifacts from ignored local state and generated outputs.\n\n## Method\n\n1. Inventory the target at low resolution.\n2. Select only applicable domains and tools.\n3. Trace the highest-impact surfaces first.\n4. Confirm each finding against source, runtime evidence, or an authoritative external source.\n5. Remove duplicates and non-findings; do not inflate severity.\n6. Report proof gaps separately from defects.\n\nRead-only probes may run in parallel under one synthesis owner. Do not mutate the target, install remediations, weaken gates, or create a findings file unless the user requests it.\n\n## Verdict\n\n- `FAIL`: at least one confirmed Critical or High issue in the audited claim, or evidence shows the claim is false.\n- `PASS`: no open Critical or High issue in the completed scope and the required real evidence exists.\n- `BLOCKED`: required target access, dependency, environment, or evidence is unavailable.\n- `ADVISORY`: no pass\u002Ffail claim was requested; report severity-ranked findings and gaps.\n\n## Output\n\n```markdown\n## Audit Scope\n- Target:\n- Maturity and claim:\n- Domains:\n- Evidence run:\n- Not run \u002F blocked:\n\n## Findings\n### [Critical|High|Medium|Low] Title\n- Evidence:\n- Impact:\n- Recommendation:\n\n## Proof Gaps\n- ...\n\n## Verdict\nPASS | FAIL | BLOCKED | ADVISORY\n```\n",{"name":5,"description":7},"main","bb71e1631303bd27cb8ac18dc04830c97db8ac4d","skills\u002Fqa-audit",0,"https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface","https:\u002F\u002Fgithub.com\u002FLyther","Why so serious?","2026-11-12 01:02:43",{"source":8,"skillName":5,"commands":47,"prompt":57,"zipAvailable":58},[48,51,54],{"tool":49,"command":50},"npx","npx skills add Lyther\u002Fagent-surface --skill qa-audit",{"tool":52,"command":53},"bunx","bunx skills add Lyther\u002Fagent-surface --skill qa-audit",{"tool":55,"command":56},"pnpm","pnpm dlx skills add Lyther\u002Fagent-surface --skill qa-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fqa-audit\u002FSKILL.md",true,[],[61,87,101,115,134,145],{"skillNo":62,"name":63,"nameZh":6,"description":64,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":65,"categories":66,"keywords":72,"publishedAt":33},"01M6C5CQAHK34J7RNHEJE1G366","workflow-runtime","Prove skill or workflow discovery, full-autonomy tool execution, and task-shaped materialization before assigning a CLI, extension, provider, or model to a workflow role.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-runtime\u002FSKILL.md",[67],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[73,74,75,76,77,78,79,80,81,82,83,84,85,86],"workflow","workflow runtime","runtime","execution","cli","discovery","tool","model","autonomy","provider","task","full","extension","role",{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":33},"01M6C5CNCTDS39453E66MQYTTQ","workflow-reviewer","Review batched implementation output against the BOSS spec and evidence.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-reviewer\u002FSKILL.md",[],[94,95,73,96,97,98,99,100],"workflow reviewer","reviewer","spec","review","evidence","implementation","output",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":33},"01M6C5CKVKQF6NE9263HGRB2K3","workflow-rescue","Resolve repeated workflow failures with a single decisive action.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-rescue\u002FSKILL.md",[107],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},[73,109,110,111,112,113,114],"workflow rescue","rescue","single","decisive action","with","action",{"skillNo":116,"name":117,"nameZh":6,"description":118,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":33},"01M6C5CHCW474Y5F49WME2G12H","workflow-orchestrator","Run risk-adaptive development, review, multi-agent, and release workflows with runtime preflight, bounded retries, liveness checks, isolated writers, and evidence-backed handoffs.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-orchestrator\u002FSKILL.md",[121],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},[123,124,73,113,125,97,126,127,128,129,130,131,98,75,132,133],"orchestrator","workflow orchestrator","development","workflows","run","release","risk","preflight","multi-agent","multi","retries",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":33},"01M6C5CFCYEW1J4ETBNDD4EQPK","workflow-judger","Arbitrate repeated task failures and decide merge, rework, or escalation.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-judger\u002FSKILL.md",[],[141,73,142,143,144,83],"workflow judger","merge","escalation","decide",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":33},"01M6C5CDADZX0YM26H2QWWDJMF","workflow-doctor","Validate active workflow state before any role acts on it.","https:\u002F\u002Fgithub.com\u002FLyther\u002Fagent-surface\u002Fblob\u002Fmain\u002Fskills\u002Fworkflow-doctor\u002FSKILL.md",[151],{"categoryNo":68,"categoryName":69,"taxonomyType":70,"taxonomyTypeDesc":71},[73,153,154,155,156,157,158,86],"workflow doctor","doctor","validate","state","active","it"]