codebook-debugging — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codebook-debugging (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
没有找到根因,不准提出修复方案。"先改改试试" = 浪费时间 + 制造新 bug。
修任何东西之前:
git diff,最近的 commit,新加的依赖。如果连续 3 次修复失败:停下来质疑架构,不要再试第 4 次。
codebook-tdd skill)codebook-dev-workflow skill Phase 5)— 修复者不能审查自己的修复门禁: 子代理审查未通过,不得提交。
遇到解析问题,第一步永远是看 AST:
import tree_sitter_language_pack as tsl
parser = tsl.get_parser("python") # 或 "swift", "java" 等
tree = parser.parse(source_bytes)
def print_tree(node, indent=0):
print(" " * indent + f"{node.type} [{node.start_point[0]}:{node.start_point[1]}]")
for c in node.children:
print_tree(c, indent + 2)
print_tree(tree.root_node)用它来验证:
LANG_CONFIG 匹配body,Swift 用 class_body)在 parse_file 的 visitor 中插入临时 print:
def visitor(node, depth):
if node.type in class_types:
print(f"ENTER class: {name}, stack={class_stack}")
elif node.type in func_types:
print(f"FUNC: {name}, is_method={is_method}, parent={parent_class}, stack={class_stack}")from src.cli import _read_json, _read_toml, _read_yaml, _detect_targets
# 查看所有检测到的目标
for t in _detect_targets():
print(f"{t.display_name}: exists={t.exists()}, path={t.config_path}")
# 读取并检查特定配置
config = _read_json(Path("~/.cursor/mcp.json").expanduser())
print(json.dumps(config, indent=2))# 直接调用 MCP tool 看响应
echo '{"jsonrpc":"2.0","method":"tools/list","id":1}' | python -m src.server| 症状 | 常见根因 | 调查方向 |
|---|---|---|
| 解析结果全是零 | LANG_CONFIG 缺少该语言 | 检查 config dict |
| 函数被错标为方法 | class_stack 作用域管理 | 追踪 push/pop 时机 |
| docstring 为 None | AST 节点结构不匹配 | 打印 AST 看实际结构 |
| import 丢失 | 语言专用提取函数未覆盖 | 打印 import 节点的 children |
| CLI 安装后工具没生效 | 配置路径或 key_path 错误 | 读回配置文件检查 |
| 依赖图为空 | 零函数/类 → NetworkX 无节点 | 先查解析是否正常 |
codebook-tdd:Phase 4 的回归测试遵循 TDD 的 RED-GREEN-REFACTOR 循环codebook-dev-workflow:修复完成后必须走 Phase 5 子代理审查,再进入 Phase 6 交付看到以上任何一条:停下来,回到 Phase 1。
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.