SkillAtlasSkill 详情

fresh-eyes-review

This is the open-source content repository behind

审核状态：已审核Quality 80Security 88

复制安装命令

用 Codex 或 Claude 安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它先审查 Skill 页面再帮你安装。

复制前请先查看来源、License 和安全提示。

项目 README

来源文件：README.md

抓取于 2026年9月3日

Skill Store — Marketplace Repository

This is the open-source content repository behind Skill Store. It stores every approved Agent Skill, the records that go with it, and the automated security audits published with each skill.

This repo is a companion to the Skill Store platform, not the place to submit skills. Skills are added through skillstore.io — its review pipeline writes to this repo automatically. Please do not open a pull request here to add a skill; PRs adding skills will be closed. See Contributing a skill below.

Installing a skill

The recommended way to install any skill is the skillstore CLI — one command works for both Claude Code and Codex:

npx skillstore add author/skill-name

For example:

npx skillstore add aiskillstore/code-review

It downloads the skill and drops it into the right skills/ directory for your tool. Claude Code auto-discovers it; for Codex, restart the session.

Prefer to do it by hand, or installing via Claude Web? See the full Installation Guides for every method (CLI, manual, and ZIP upload) and the scope directories (~/.agents/skills/, .claude/skills/, ~/.claude/skills/, .codex/skills/, …).

Contributing a skill

Submit through the platform — not through a pull request:

  1. Go to skillstore.io/submit.
  2. Enter the GitHub repository URL that contains your SKILL.md.
  3. Your submission runs through automated security analysis.
  4. A maintainer reviews and approves it.
  5. On approval, the skill is published here and appears on skillstore.io.

What makes a valid skill

  • SKILL.md — the skill definition (required, per the Agent Skills spec)
  • Supporting files the skill references (optional)
  • LICENSE (recommended)

Security audit

Every submission is scanned automatically before it can be published. The audit flags things like:

  • Dangerous code patterns (eval, exec, raw system commands)
  • File access outside the project scope
  • Network calls to external hosts
  • Obfuscated or minified code
  • Credential / secret handling

Security analysis is report-only: findings inform maintainers and users, but a risk result does not automatically block an otherwise approved skill from being published. See our Security Trust Center for the methodology, limitations, and risk-level definitions.

Live Security Passport example:

Skillstore security

Repository layout

.
├── skills/        # Approved, published skills (one folder each, with SKILL.md)
├── pending/       # Submissions awaiting review
├── packages/
│   ├── cli/       # The `skillstore` CLI (npx skillstore add …)
│   └── skillstore/
├── schemas/       # JSON schemas for skill records
├── scripts/       # Maintenance & scoring scripts
└── .github/workflows/   # Submission, audit, and sync automation

The contents of this repo are maintained by Skill Store's automated pipeline. Manual changes are limited to maintainers.

Links

License

The marketplace catalog is MIT-licensed. Individual skills carry their own licenses — check each skill's LICENSE file.

DevOps 与部署Agent / MCP / Skill 创作商业与运营

中风险

  • 来源需自行核对维护者身份。
  • 未检测到明显脚本安装指令。
  • 未检测到明显外部权限要求。
  • 未检测到高风险命令。
  • 扫描发现：1 条。

Codex — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库：git clone https://github.com/aiskillstore/marketplace.git
  3. 将 "skills/2389-research/fresh-eyes-review" 文件夹复制到 Codex 的 skills 目录中。
  4. 重启 Codex 让新的 skill 生效。

Codex — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Codex 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Codex 让新的 skill 生效。

Claude Code — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库：git clone https://github.com/aiskillstore/marketplace.git
  3. 将 "skills/2389-research/fresh-eyes-review" 文件夹复制到 Claude Code 的 skills 目录中。
  4. 重启 Claude Code 让新的 skill 生效。

Claude Code — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Claude Code 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Claude Code 让新的 skill 生效。

Cursor — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库：git clone https://github.com/aiskillstore/marketplace.git
  3. 将 "skills/2389-research/fresh-eyes-review" 文件夹复制到 Cursor 的 skills 目录中。
  4. 重启 Cursor 让新的 skill 生效。

Cursor — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Cursor 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Cursor 让新的 skill 生效。

GitHub Copilot — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库：git clone https://github.com/aiskillstore/marketplace.git
  3. 将 "skills/2389-research/fresh-eyes-review" 文件夹复制到 GitHub Copilot 的 skills 目录中。
  4. 重启 GitHub Copilot 让新的 skill 生效。

GitHub Copilot — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 GitHub Copilot 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 GitHub Copilot 让新的 skill 生效。

Windsurf — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库：git clone https://github.com/aiskillstore/marketplace.git
  3. 将 "skills/2389-research/fresh-eyes-review" 文件夹复制到 Windsurf 的 skills 目录中。
  4. 重启 Windsurf 让新的 skill 生效。

Windsurf — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Windsurf 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Windsurf 让新的 skill 生效。
查看 SKILL.md 原文
name: fresh-eyes-review
description: This skill should be used as a mandatory final sanity check before git commit, PR creation, or declaring work done. Triggers on "commit", "push", "PR", "pull request", "done", "finished", "complete", "ship", "deploy", "ready to merge". Catches security vulnerabilities, logic errors, and business rule bugs that slip through despite passing tests.

Fresh-Eyes Review

Core Principle

"NO COMMIT WITHOUT FRESH-EYES REVIEW FIRST"

This represents a final quality gate executed after implementation completion, passing tests, and peer review. The discipline applies universally, even without explicit skill activation.

Key Distinctions

Fresh-eyes review differs fundamentally from testing and code review:

ApproachFocusBlind Spots
TestingValidates expected behaviorCan't test for unknown edge cases
Code reviewPatterns and qualityReviewer trusts author's intent
Fresh-eyesDeliberate re-reading with psychological distanceCatches what you thought was correct

Critical insight: "100% test coverage and passing scenarios" can coexist with "critical bugs" waiting discovery.

Required Process

Step 1 - Announce Commitment

Explicitly declare: "Starting fresh-eyes review of [N] files. This will take 2-5 minutes."

This announcement creates accountability and reframes your mindset from implementation to audit.

Step 2 - Security Vulnerability Checklist

Review all touched files for security issues:

VulnerabilityWhat to Check
SQL InjectionAll database queries use parameterized statements, never string concatenation
XSSAll user-provided content is escaped before rendering in HTML
Path TraversalFile paths are validated, ../ sequences rejected or normalized
Command InjectionShell commands don't include unsanitized user input
IDORResources are access-controlled, not just unguessable IDs
Auth BypassEvery protected endpoint checks authentication and authorization

Example finding:

// Before: SQL injection vulnerability
const user = await db.query(`SELECT * FROM users WHERE id = '${userId}'`);

// After: Parameterized query
const user = await db.query('SELECT * FROM users WHERE id = $1', [userId]);

Step 3 - Logic Error Checklist

Error TypeWhat to Check
Off-by-oneArray indices, loop bounds, pagination limits
Race conditionsConcurrent access to shared state, async operations
Null/undefinedEvery . chain could throw; defensive checks present?
Type coercion== vs ===, implicit conversions
State mutationsUnexpected side effects on input parameters?
Error swallowingEmpty catch blocks, ignored promise rejections

Example finding:

// Before: Off-by-one in pagination
const hasMore = results.length < pageSize;

// After: Correct boundary
const hasMore = results.length === pageSize;

Step 4 - Business Rule Checklist

CheckQuestions
CalculationsDo formulas match requirements exactly? Currency rounding correct?
ConditionsAND vs OR logic correct? Negations applied properly?
Edge casesEmpty input, single item, maximum values, zero values?
Error messagesUser-friendly? Leak no sensitive information?
Default valuesSensible defaults when optional fields omitted?

Example finding:

// Before: Tax calculation uses wrong rounding
const tax = price * 0.08;

// After: Proper currency rounding
const tax = Math.round(price * 0.08 * 100) / 100;

Step 5 - Performance Checklist

IssueWhat to Check
N+1 queriesLoops that make database calls should be batched
Unbounded loopsMaximum iterations, timeout protection
Memory leaksEvent listeners removed, streams closed, references cleared
Missing indexesQueries filter/sort on indexed columns?
Large payloadsPagination implemented? Response size bounded?

Step 6 - Fix Immediately

Address findings before declaring completion:

  1. Make the fix
  2. Add test covering the issue (if not present)
  3. Re-run full test suite
  4. Re-run linter/type checker

Step 7 - Declare Results

Mandatory announcement:

Fresh-eyes complete. [N] issues found and fixed:
- [Brief description of each issue and fix]

Include this even for zero findings—it proves execution.

Time Commitment

File CountExpected Duration
1-3 files2 minutes
4-10 files3-4 minutes
10+ files5 minutes max

Warning signs:

  • Faster than 2 minutes suggests insufficient depth
  • More than 5 minutes indicates scope creep—stay focused on the changed code

Resistance Patterns to Reject

The following rationalizations must be explicitly rejected:

RationalizationReality
"Tests are comprehensive"Tests validate design, not correctness
"I'm confident it's correct"Confidence is inversely correlated with bugs
"Partner is waiting"3 minutes now saves 3 hours debugging later
"Production is blocked"Rushing causes the outages being rushed to fix
"Senior dev already approved"They reviewed intent, not implementation details
"It's just a small change"Small changes cause large outages

These circumstances represent precisely when critical bugs escape into production.

Example Workflow

User: "I'm done implementing the auth feature, let me commit"
Assistant: [Triggers fresh-eyes-review skill]

Starting fresh-eyes review of 4 files. This will take 2-5 minutes.

[Reviews auth.ts for security]
- Found: Missing input validation on email field
- Fixed: Added email format validation

[Reviews handler.ts for logic]
- Found: Off-by-one error in pagination
- Fixed: Changed < to <= in boundary check

[Reviews db.ts for performance]
- No issues found

[Reviews api.ts for business rules]
- No issues found

Re-running tests... All tests pass

Fresh-eyes complete. 2 issues found and fixed.

发现问题？提交给管理员复核

评分：

评论 (0)

暂无评论，成为第一个评论者吧！