Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add u9401066/template-is-all-you-need --skill code-auditgit clone --depth 1 https://github.com/u9401066/template-is-all-you-needWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/u9401066/template-is-all-you-need/code-audit)<a href="https://agentmods.dev/skills/u9401066/template-is-all-you-need/code-audit"><img src="https://agentmods.dev/badge/skills/u9401066/template-is-all-you-need/code-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.02456 |
| Opus 5 | $0.00039 | $0.01228 |
| Sonnet 5 | $0.00016 | $0.00491 |
| Haiku 4.5 | $0.00008 | $0.00246 |
Grade A, and why
code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 295 lines — stays where its author put it; the contents beside it link to each section on GitHub.
深度程式碼審計
描述
對整個程式庫進行系統性的深度審計，涵蓋程式碼品質、安全性、架構合規性、測試覆蓋率和文檔同步度。比 code-reviewer（單檔審查）和 code-review-workflow（PR 審查）更全面，適合定期健檢。
觸發條件
- 「程式碼審計」「AUDIT」「全面審查」
- 「deep review」「深度審查」「健檢」
- 「codebase audit」「完整檢查」
法規依據
- 憲法：CONSTITUTION.md 第一章（DDD 架構）
- 子法：bylaws/ddd-architecture.md
- 子法：bylaws/git-workflow.md
🔧 審計流程（5 大維度）
Phase 1: 🏗️ 架構合規性審計
目標：驗證 DDD 分層架構是否被正確遵守
# 檢查目錄結構
Get-ChildItem -Path src/ -Directory -Recurse | Select-Object FullName
檢查清單：
| 項目 | 檢查方式 | 嚴重度 |
|---|---|---|
| Domain 層無外部依賴 | grep_search Domain 層的 import |
🔴 Critical |
| Repository Interface 在 Domain | 檢查 interfaces 位置 | 🔴 Critical |
| 依賴方向正確 | 分析 import 圖 | 🔴 Critical |
| Application 層不過度膨脹 | 計算行數 | 🟡 Medium |
| Presentation 只呼叫 Application | 檢查 import | 🟠 High |
# 偵測 Domain 層違規 import 的搜尋模式
# ❌ Domain 層不應出現這些：
import_violations = [
"from fastapi",
"from flask",
"from sqlalchemy",
"from django",
"import requests",
"from infrastructure",
"from presentation",
]
Phase 2: 📊 程式碼品質審計
自動化工具：
# Ruff - 全面 linting
uv run ruff check src/ --output-format=grouped --statistics
# Ruff - 格式檢查
uv run ruff format --check src/
# MyPy - 型別安全
uv run mypy src/ --ignore-missing-imports --show-error-codes
# Vulture - 死碼偵測
uv run vulture src/ --min-confidence 80
# 圈複雜度
uv run ruff check src/ --select=C901 --output-format=concise
人工檢查項目：
| 指標 | 閾值 | 工具 |
|---|---|---|
| 函數長度 | < 50 行 | grep + 人工 |
| 類別大小 | < 300 行 | grep + 人工 |
| 圈複雜度 | McCabe < 10 | ruff C901 |
| 重複程式碼 | 無明顯重複 | semantic_search |
| 命名一致性 | snake_case/CamelCase | ruff |
| 型別覆蓋率 | 公開 API 100% | mypy |
Phase 3: 🔒 安全性審計
呼叫 security-reviewer skill 執行 OWASP Top 10 檢查
# Bandit - 靜態安全分析
uv run bandit -r src/ -ll -f txt
# 依賴漏洞
uv run pip-audit 2>/dev/null || echo "pip-audit 未安裝"
# Secrets 偵測
git log --all --diff-filter=A -- "*.env" "*.key" "*.pem" 2>/dev/null || true
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 295 lines · 0 tokens per session scan A fbbfaae39326
code-audit is a skill published in the GitHub repository u9401066/template-is-all-you-need (3 stars, last pushed 6mo ago), licensed Apache-2.0. It adds 79 tokens to every session and 2,456 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-review-architecture
Architecture-focused code review covering hexagonal boundary violations, DDD anti-patterns, CQRS misuse, and microservices coupling issues. Applied in addition to the language-specific review skill when architecture markers are detected. Invoked when reviewing hexagonal architectures, DDD patterns, or microservices…
Code Review Checklist
Runs a systematic checklist review on any code diff or file, covering correctness, security, performance, and readability.
ledger-audit
Retrospective pass over a project built before the ledger existed: reconstruct the structural decisions already made and the conventions applied without a reason. (decision-ledger).
ledger-report
Mastery map for this project: which areas of the codebase are defended, which are thin. Run it at a commit, a pull request, or on request. (decision-ledger).
clean-code-reviewer
Reviews code against Robert C. Martin's Clean Code principles. Use when users share code for review, ask for refactoring suggestions, or want to improve code quality. Produces actionable feedback organized by Clean Code principles with concrete before/after examples.
code-review
Reviews code changes using CodeRabbit AI. Use when user asks for code review, PR feedback, code quality checks, security issues, or wants autonomous fix-review cycles.