Is no-field-guessing safe to install?

SaferSkills independently audited no-field-guessing (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

skills/disciplines/no-field-guessing/SKILL.md · 1 file

skills/disciplines/no-field-guessing/SKILL.md1.6 KB · Markdown

name: no-field-guessing

description: 严禁猜测字段名 — 数据库/接口字段必须从知识库或契约文档获取。Use when writing SQL, designing data models, generating API contracts, or any task that names database fields.

No-Field-Guessing — 严禁猜测字段名

规则

1. 字段来源(优先级从高到低)

项目级 `knowledge-path.md` 指向的真实知识库(测试库表结构、API 文档)
skill 级 `config/domain-knowledge/{领域}.md` 引用的知识库
业务同义不同名:在文档注释中显式标注("业务上称为 X = 知识库定义的 Y")
找不到:用占位符 EXT_FIELD_X(待用户确认后改),严禁编造

2. 严禁做的事

❌ 看到需求里说"ASN 单号"就写 ASN_ID / ASN_NBR(正确是 TC_ASN_ID)
❌ 看到"货箱号"就写 LPN_NBR(正确是 TC_LPN_ID)
❌ 看到"批号"就写 LOT_ID(正确是 BATCH_NBR)
❌ 看到"ASN 明细关联"就写 ASN_ID(正确是 ASN_DTL_ID)

3. 必做

✅ 写任何 SQL / 数据模型 / API 契约前,先读 knowledge-path.md
✅ 字段映射表必须与知识库定义一致
✅ 跑 python3 scripts/field-alignment-check.py 验证

反例

❌ 错误:
| ASN 单号 | ASN_ID |
| 货箱号 | LPN_NBR |
| 批号 | LOT_ID |

✅ 正确:
| ASN 单号 | ASN.TC_ASN_ID | ❌ 严禁用 ASN_NBR |
| 货箱号 | LPN.TC_LPN_ID | ❌ 严禁用 LPN_NBR |
| 批号 | ASN_DETAIL.BATCH_NBR | ❌ 严禁用 LOT_ID |

引用

来源:references/workflow-discipline.md 实战教训 2024-2026
字段名速查表:用户全局 CLAUDE.md 的"关键字段映射"小节

no-field-guessing— agent skill

Is no-field-guessing safe to install?

No-Field-Guessing — 严禁猜测字段名

规则

1. 字段来源(优先级从高到低)

2. 严禁做的事

3. 必做

反例

引用

Audit the pieces. Scan the whole. Decide.