Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jiushiwon/wg-skills --skill uniapp-code-audit-skillgit clone --depth 1 https://github.com/jiushiwon/wg-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jiushiwon/wg-skills/uniapp-code-audit-skill)<a href="https://agentmods.dev/skills/jiushiwon/wg-skills/uniapp-code-audit-skill"><img src="https://agentmods.dev/badge/skills/jiushiwon/wg-skills/uniapp-code-audit-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jiushiwon/wg-skills/uniapp-code-audit-skill"><img src="https://agentmods.dev/badge/skills/jiushiwon/wg-skills/uniapp-code-audit-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03232 |
| Opus 5 | $0.00033 | $0.01616 |
| Sonnet 5 | $0.00013 | $0.00646 |
| Haiku 4.5 | $0.00007 | $0.00323 |
Grade A, and why
uniapp-code-audit-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 228 lines — stays where its author put it; the contents beside it link to each section on GitHub.
UniApp Code Audit Skill
定位
本 skill 用于审计 uniapp 项目（Vue3 + TypeScript + Pinia 技术栈优先），识别代码中不符合规范、存在风险或可能影响上线的问题，仅输出 uniapp-audit-report.md 报告，不修改、不修复、不重构项目代码。
Vue2 项目适配：Vue2 + Options API 项目也可直接审计。其中
script setup、Pinia、defineProps类型等 Vue3 专属检查项将标注为“不适用”，其余检查项照常执行；如需先升级到 Vue3，可配合uniapp-vue2-upgrade-skill（本地保留 skill，按需取用）。
When to Use
触发此 skill 时使用：
- "uniapp 审计"
- "小程序代码审计"
- "uniapp 安全审计"
- "uniapp 性能审计"
- "检查 uniapp 规范符合性"
- "uniapp UI/主题审计"
- "uniapp 代码质量审计"
- "uniapp 架构审计"
- "uniapp API 契约审计"
- "uniapp 小程序合规审计"
- "uniapp App 端审计"
- "安卓/苹果端兼容性审计"
- "帮我看看这个 uniapp 项目有什么问题"
- "审计这个项目有没有冗余代码或没用的页面组件"
Workflow
Phase 1: 审计范围确认
→ 全量审计 or 指定模块/页面
→ 目标平台：微信小程序 / H5 / App（小程序专属检查项仅在目标平台包含小程序时执行；App 端专项检查项仅在目标平台包含 App 时执行）
→ 重点维度：安全 / 性能 / 代码质量 / 架构 / UI/主题 / 跨平台 / 小程序专项 / App 端专项 / 冗余与死代码 / API 契约
→ 增量审计（可选）：仅扫描 git 未提交改动，输出差异问题
→ 抽样审计（可选）：大项目可指定模块/文件范围，避免全量噪音
Phase 2: 多维度扫描
→ 按下列 10 个维度逐项扫描
→ 记录问题位置、风险等级、判定依据、参考标准
Phase 3: 问题汇总
→ 按 P0/P1/P2/P3 风险等级归类
→ 统计各维度问题数量
→ 评估维度健康度（可选）
Phase 4: 输出报告
→ 生成 uniapp-audit-report.md
→ 不包含任何修复代码或修复指令
Phase 1 引导问题
根据上下文选择性询问（不必全问）：
- "审计范围：全量项目，还是指定模块/页面？"
- "目标平台：微信小程序 / H5 / App？小程序专属检查（包体积、合法域名、审核合规、分包）仅在目标包含小程序时执行；App 端专项检查（Android/iOS 差异、原生能力、热更新、App 包体积）仅在目标包含 App 时执行。"
- "重点维度：安全 / 性能 / 代码质量 / 架构 / UI/主题 / 跨平台 / 小程序专项 / App 端专项 / 冗余与死代码 / API 契约？"
- "是否需要增量审计（只查未提交改动）或抽样审计（大项目指定范围）？"
审计维度与参考清单
| 维度 | 参考文件 | 主要规范来源 |
|---|---|---|
| 安全合规 | references/security-checklist.md |
uniapp-components-skill 红线规则、通用安全规范 |
| 性能 | references/performance-checklist.md |
uniapp-standard-skill 性能规范、uniapp-app-generate-skill |
| 代码质量 | references/code-quality-checklist.md |
uniapp-standard-skill 红线规则、TS/Vue3 通用规范 |
| 架构与规范 | references/architecture-checklist.md |
uniapp-app-generate-skill/references/project-structure.md、uniapp-standard-skill R01-R20 |
| UI/主题一致性 | references/ui-consistency-checklist.md |
uniapp-app-generate-skill/references/theme-system.md、component-standards.md |
| 跨平台兼容 | references/cross-platform-checklist.md |
uniapp-app-generate-skill/references/cross-platform-compatibility.md |
| 小程序专项 | references/mini-program-checklist.md |
微信小程序官方限制、uniapp-standard-skill 性能规范 |
| App 端专项 | references/app-platform-checklist.md |
uni-app 官方文档、Android/iOS 平台规范、manifest.json app-plus 配置 |
| 冗余与死代码 | references/dead-code-checklist.md |
通用工程规范、uniapp-app-generate-skill 静态资源规范 |
| API 契约 | references/api-contract-checklist.md |
frontend-request-skill、uniapp-standard-skill 接口规范 |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- README.md 8.4 KB
- references/api-contract-checklist.md 8.3 KB
- references/app-platform-checklist.md 7.2 KB
- references/architecture-checklist.md 9.7 KB
- references/code-quality-checklist.md 10 KB
- references/cross-platform-checklist.md 11 KB
- references/dead-code-checklist.md 5.7 KB
- references/mini-program-checklist.md 7.5 KB
- references/performance-checklist.md 6.8 KB
- references/security-checklist.md 7.4 KB
- references/self-audit-checklist.md 6.3 KB
- references/ui-consistency-checklist.md 6.8 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 228 lines · 66 tokens per session scan A 9746e77efa0b
uniapp-code-audit-skill is a skill published in the GitHub repository jiushiwon/wg-skills (97 stars, last pushed 2d ago), licensed Apache-2.0. It adds 66 tokens to every session and 3,232 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
autoreview
Pre-commit/ship code review: Codex default; optional Claude or Pi.
rework-rate
Measure and interpret PR rework rate — the emerging 5th DORA metric.
omh-code-review
This is a Hermes-native code-review workflow skill.
revdiff-plan
Review the last Codex assistant message (plan, analysis, or proposal) with inline annotations in a TUI overlay. Extracts the most recent response from Codex rollout files and opens it in revdiff for review and annotation. Activates on "revdiff-plan", "review plan with revdiff", "annotate plan", "review last response"…
code-reviewer
Code review specialist focused on patterns, bugs, security, and performance.
agent-teams-simplify-and-harden
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or…