Borrowing it
Nothing to install: this file belongs to shenjingnan/xiaozhi-client. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/shenjingnan/xiaozhi-client/main/.agents/skills/ci-validator/SKILL.mdgit clone --depth 1 https://github.com/shenjingnan/xiaozhi-clientWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shenjingnan/xiaozhi-client/ci-validator)<a href="https://agentmods.dev/skills/shenjingnan/xiaozhi-client/ci-validator"><img src="https://agentmods.dev/badge/skills/shenjingnan/xiaozhi-client/ci-validator.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 174 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 177 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00009 | $0.03448 |
| Opus 5 | $0.00005 | $0.01724 |
| Sonnet 5 | $0.00002 | $0.00690 |
| Haiku 4.5 | $0.00001 | $0.00345 |
Grade A, and why
ci-validator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 488 lines — stays where its author put it; the contents beside it link to each section on GitHub.
我是 CI 检查验证和质量保障技能,专门确保 xiaozhi-client 项目的代码质量符合标准,同时遵循务实开发理念。
技能使用原则
- 保证质量,但避免过度工程化:维持代码质量,但不追求理论上的完美
- 实用功能优先,理论完美次之:解决实际问题比预防各种可能更重要
- 简单解决方案优于复杂方案:优先选择直接有效的解决方案
- 务实开发指导:检查代码是否符合"如无必要勿增实体"的原则
技能能力
1. 完整代码质量检查流程
核心能力:自动执行项目要求的所有代码质量检查,确保代码符合 CI 标准。
检查流程
# 1. 执行完整检查(xiaozhi-client 项目)
pnpm check:all
# 2. 运行测试套件
pnpm test
# 3. (可选)生成覆盖率报告
pnpm test:coverage
检查内容详解
-
pnpm check:all包含:pnpm lint- Biome 代码规范和格式检查pnpm typecheck- TypeScript 严格类型检查pnpm spellcheck- 拼写检查pnpm check:cpd- 重复代码检查
-
pnpm test包含:- Vitest 单元测试执行
- 集成测试验证
- 功能测试覆盖
2. 智能问题诊断与修复建议
当检查失败时,自动分析失败原因并提供针对性修复建议。
类型检查失败诊断
// 常见问题1:any 类型使用
// ❌ 错误示例
function processData(data: any): any {
return data.value;
}
// ✅ 修复建议
function processData<T extends Record<string, unknown>>(data: T): T[keyof T] {
return data.value as T[keyof T];
}
// 常见问题2:类型定义缺失
// ❌ 错误示例
const config = {
apiEndpoint: "https://api.home-assistant.local",
timeout: 5000,
};
// ✅ 修复建议
interface Config {
apiEndpoint: string;
timeout: number;
}
const config: Config = {
apiEndpoint: "https://api.home-assistant.local",
timeout: 5000,
};
代码规范失败诊断
# 常见问题及修复命令
# 问题:Biome 检查失败
# 解决方案:运行自动修复
pnpm lint
# 问题:导入路径不规范
# 解决方案:使用路径别名系统
import { UnifiedMCPServer } from "@core/unified-server"; // ✅
import { StartCommand } from "@cli/commands/start"; // ✅
import { UnifiedMCPServer } from "./core/unified-server"; // ❌
# 问题:未使用的导入
# 解决方案:移除未使用的导入
pnpm lint # 会自动清理
拼写检查失败诊断
# 常见问题:技术术语被标记为拼写错误
# 解决方案1:确认确实是错误,修正拼写
# 解决方案2:如果是专业术语,添加到项目词典
echo "homeassistant" >> .cspell.json
# 解决方案3:忽略特定文件或目录
# 在 .cspell.json 中配置 ignorePaths
测试失败诊断
// 常见问题1:测试覆盖率不足
// 解决方案:补充测试用例,覆盖未测试的代码路径
// 常见问题2:异步测试处理不当
// ❌ 错误示例
test("should fetch data", () => {
const result = await fetchData();
expect(result).toBeDefined();
});
// ✅ 修复建议
test("should fetch data", async () => {
const result = await fetchData();
expect(result).toBeDefined();
});
// 常见问题3:Mock 设置不完整
// ❌ 错误示例
vi.mock("@/services/light-service");
// ✅ 修复建议
vi.mock("@/services/light-service", () => ({
LightService: {
turnOn: vi.fn(),
turnOff: vi.fn(),
},
}));
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 488 lines · 9 tokens per session scan A 7f80e7dffc19
ci-validator is a skill published in the GitHub repository shenjingnan/xiaozhi-client (337 stars, last pushed 4d ago), licensed MIT. It adds 9 tokens to every session and 3,448 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
import-prom-rule
Bulk import of a Prometheus alert rule YAML file (create a whole set of rules at once). Dedicated to handling a remote URL or local YAML text, automatically parsing the three formats groups / a plain rules array / a single rule. ⚠️ Do not use this skill for single-rule creation — when the user describes a single alert…
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
configure-env-variables
Configures environment variables for Power Pages site settings to support ALM across environments. Creates environment variable definitions in Dataverse, guides the user through linking site settings to those variables via the Power Pages Management app, adds the variables to the solution, and generates a…
atmos-profiles
Atmos profiles: profile directories, --profile and ATMOSPROFILE activation, profile merge behavior, environment switching, and routing profile-specific auth/toolchain/config overrides.
webhook-management
Configure and validate CCAM webhook targets across supported chat, incident, automation, and generic providers. Use when listing provider requirements, creating or updating a target, scoping it to alert rules, sending a test notification, reviewing delivery history, or deleting a target.
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.