Borrowing it
Nothing to install: this file belongs to shenjingnan/xiaozhi-client. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/shenjingnan/xiaozhi-client/main/.agents/skills/issue-hunter/SKILL.mdgit clone --depth 1 https://github.com/shenjingnan/xiaozhi-clientWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shenjingnan/xiaozhi-client/issue-hunter)<a href="https://agentmods.dev/skills/shenjingnan/xiaozhi-client/issue-hunter"><img src="https://agentmods.dev/badge/skills/shenjingnan/xiaozhi-client/issue-hunter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shenjingnan/xiaozhi-client/issue-hunter"><img src="https://agentmods.dev/badge/skills/shenjingnan/xiaozhi-client/issue-hunter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.04578 |
| Opus 5 | $0.00008 | $0.02289 |
| Sonnet 5 | $0.00003 | $0.00916 |
| Haiku 4.5 | $0.00002 | $0.00458 |
Grade A, and why
issue-hunter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 639 lines — stays where its author put it; the contents beside it link to each section on GitHub.
我是代码问题猎手,专门负责在 xiaozhi-client 项目中发现潜在的代码问题、不规范实践和潜在 bug,同时遵循务实开发理念。
技能使用原则
- 问题导向:只关注真正影响代码质量或维护性的问题,避免吹毛求疵
- 可操作性强:每个发现的问题都必须提供具体的修复方案
- 务实判断:遵循"如无必要勿增实体"的理念,不过度批评简单直接的实现
- 单问题专注:每次执行只发现并提交一个最高优先级问题
- 随机轮询:通过随机选择问题类型,确保长期覆盖各类问题
项目结构感知
项目目录结构
xiaozhi-client/
├── src/ # 统一源码目录
│ ├── server/ # 后端核心
│ │ ├── lib/mcp/ # MCP 核心库
│ │ ├── handlers/ # 处理器
│ │ ├── services/ # 业务服务
│ │ └── utils/ # 工具函数
│ ├── web/ # React 前端
│ ├── cli/ # CLI 工具
│ ├── config/ # 配置管理
│ ├── mcp-core/ # MCP 协议核心
│ ├── endpoint/ # 端点处理
│ ├── esp32/ # ESP32 硬件相关
│ ├── types/ # 共享类型定义
│ └── utils/ # 通用工具
├── todos/ # 待解决问题(用于去重)
├── docs/ # Nextra 文档
└── .github/workflows/
├── claude.yml # @claude 触发
└── issue-hunter.yml # 定时执行(每10分钟)
关键文件重点关注
src/server/lib/mcp/manager.ts- MCP 管理器src/server/services/- 业务服务src/server/handlers/- 处理器src/cli/- CLI 入口
问题检测类型(12种)
1. 文档问题检测
检查范围: docs/, README.md, CLAUDE.md
检测内容:
- 缺失的 API 文档(公共接口必须有 JSDoc)
- 过时的示例代码
- 不一致的文档格式
- 缺失的重要说明
检测命令:
# 检查文档文件
find docs/ -name "*.mdx" -type f
2. 类型安全问题
检查命令: pnpm typecheck
检测内容:
- any 类型使用(尤其是非测试文件)
- 类型定义缺失
- 类型断言滥用
- 隐式 any
关注重点:
- 非测试文件中的 any 类型
- 缺少类型定义的函数参数
- 不安全的类型转换
3. 错误处理问题
检测内容:
- 缺失 try-catch 的异步操作
- 错误未正确传播
- 无意义的错误捕获
- 缺少错误日志
代码模式:
// ❌ 危险模式
async function riskyOperation() {
const result = await fetchSomething(); // 无错误处理
}
// ❌ 无意义捕获
try {
// ...
} catch (e) {
// 吞掉错误
}
// ✅ 正确模式
async function riskyOperation() {
try {
return await fetchSomething();
} catch (error) {
logger.error('操作失败', error);
throw error; // 重新抛出
}
}
4. 资源泄漏问题
检测内容:
- 定时器未清理(setTimeout, setInterval)
- 连接未关闭(WebSocket, 数据库连接)
- 事件监听器未移除
- 文件句柄未释放
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 639 lines · 15 tokens per session scan A dbc301b3ad95
issue-hunter is a skill published in the GitHub repository shenjingnan/xiaozhi-client (338 stars, last pushed 6d ago), licensed MIT. It adds 15 tokens to every session and 4,578 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
engram-branch-pr
PR creation workflow for Engram following the issue-first enforcement system. Trigger: When creating a pull request, opening a PR, or preparing changes for review.
verify-behavior
Verify or reproduce visible product behavior by driving the real UI with pi-computer-use's checked tools, requiring verified expect postconditions and durable state evidence for meaningful UI flows. Use when triage needs visual reproduction, implementation needs behavioral proof, review needs interactive confirmation…
github-contributor
End-to-end playbook for shipping high-quality pull requests to open-source projects you don't maintain — discovery, CONTRIBUTING compliance, PR-size check, minimal-diff implementation, PR description with AI-assisted disclosure, conflict resolution, and post-submission maintainer interaction. Use whenever creating…
revdiff
Review diffs, files, and documents with inline annotations in a TUI overlay, or answer questions about revdiff usage, configuration, themes, and keybindings. Opens revdiff in agterm/tmux/zellij/herdr/kitty/wezterm/cmux/ghostty/iterm2/emacs-vterm, captures annotations, and addresses them. Works in git, hg, and jj repos…
write-pr
Reference standards for writing pull request titles and descriptions in the tldraw repository, plus the pre-flight comment sweep over the diff. Use as supporting guidance when another skill or workflow needs PR content standards, not as the user-facing create/update PR workflow.