Audit issue remediation capability. Reads a module's AUDIT.md, fixes security and code-quality issues one by one, and archives fixes to AUDIT_HISTORY.md. Strictly constrained to only modify files listed in AUDIT.md.
修复 AUDIT.md 中记录的安全和代码质量问题，保持修改范围最小化。
/audit-fix <module-path> # 修复指定模块
/audit-fix <module-path> --issues 1,3,5 # 只修复指定 issue
/audit-fix <module-path> --dry-run # 预览修复计划
/audit-fix --batch <severity> # 批量修复指定级别 (critical/high/medium/low)
⚠️ 严格限制: 只能修改 AUDIT.md 列出的文件和行号 ❌ 禁止: 扩展修改范围、重构其他代码、添加新功能、"顺便"优化 ✅ 允许: 新增必要的工具函数文件（如 path-utils.js）
# 检查 AUDIT.md 存在
cat <module-path>/AUDIT.md
# 或使用脚本查看
node ~/.claude/skills/project-index/scripts/audit-archive.js <module-path> --show
解析内容：
对每个 issue：
# 归档单个 issue
node ~/.claude/skills/project-index/scripts/audit-archive.js <module-path> <issue-id>
touch CLAUDE.md 更新时间戳# 提交格式
git commit -m "fix(<module>): resolve N security audit issues
- issue1: <brief description>
- issue2: <brief description>
...
BREAKING: <if any breaking changes>"
// Before
const absPath = p.startsWith('/') ? p : `${workDir}/${p}`;
// After
import path from 'path';
const resolved = path.resolve(workDir, p);
if (!resolved.startsWith(workDir + path.sep)) {
throw new Error('Path traversal detected');
}
// Before
} catch { /* ignore */ }
// After
} catch (err) {
return { error: err.message, available: false };
}
// Before
const defaultHandler = async () => 'allow-once';
// After
const defaultHandler = async () => 'deny';
// Before
workDir = process.cwd()
// After - 要求显式传入
if (!workDir) {
throw new Error('workDir is required');
}
// Before
export function foo(x, y) { ... }
// After
/**
* Brief description
* @param {string} x - Description
* @param {number} y - Description
* @returns {boolean} Description
*/
export function foo(x, y) { ... }
// Before
emit('agent.step.completed', data);
// After
emit('agent:stepCompleted', data);
// Before
const proc = spawn(cmd, args);
// After
const proc = spawn(cmd, args);
const timer = setTimeout(() => proc.kill('SIGTERM'), timeoutMs);
proc.on('exit', () => clearTimeout(timer));
使用 Task 工具并行修复多个模块：
// Claude 会话中执行（建议 6-8 并发）
const modules = ['js/agents/core', 'js/agents/runtime', ...];
// 7 个 Task 工具并行调用，每个 run_in_background: true
# 1. 导入审计任务到 Kanban
node ~/.claude/skills/audit-fix/import-to-kanban.js
# 或只导入 CRITICAL
node ~/.claude/skills/audit-fix/import-to-kanban.js --severity=critical
# 预览模式
node ~/.claude/skills/audit-fix/import-to-kanban.js --dry-run
# 2. 查看导入的任务
node ~/.claude/skills/kanban/kanban-cli.js list --status=todo
# 3. 批量执行
/kanban-batch --priority=0
# 查看所有后台任务
ls /tmp/claude/*/tasks/*.output
# 查看单个任务输出
tail -50 /tmp/claude/-mnt-f-pb-paper-burner/tasks/<agent-id>.output
# 检查审计修复状态
node ~/.claude/skills/project-index/scripts/audit-status.js
审计修复可与 Code Kanban 结合，提供任务追踪和隔离开发环境。
CLI="$HOME/.claude/skills/kanban/kanban-cli.js"
# 创建审计任务
node "$CLI" add "[AUDIT] js/agents/core/sandbox/system (7 issues)" \
--priority=0 \
--tags=type/audit,severity/critical \
--description="修复 AUDIT.md 中的 7 个安全问题"
# 查看待办
node "$CLI" list --status=todo
# 认领任务并在独立 worktree 中修复
/kanban-implement <task-id>
Worktree 隔离的好处：
# 把所有 CRITICAL 审计问题导入 Kanban 后
/kanban-batch --priority=0
自动分析依赖关系，并行执行无依赖的任务。
# 开始任务
node "$CLI" start <id>
# 完成任务
node "$CLI" done <id>
1. audit-status.js 检查问题分布
↓
2. CLI 创建 Kanban 任务 (P0=CRITICAL, P1=HIGH...)
↓
3. /kanban-batch 或手动 /kanban-implement
↓
4. 每个模块修复后：
- audit-archive.js 归档
- git commit
- node "$CLI" done <id>
修复完成后检查：
--show 返回 Issues: 0)~/.claude/skills/project-index/scripts/audit-archive.js - 归档脚本~/.claude/skills/project-index/scripts/audit-status.js - 状态检查/project-index - 索引管理/js-agents-entropy-scan - 生成审计报告Search for places (restaurants, cafes, etc.) via Google Places API proxy on localhost.
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Start voice calls via the OpenClaw voice-call plugin.
Notion API for creating and managing pages, databases, and blocks.
Gemini CLI for one-shot Q&A, summaries, and generation.
Category:developer