intended-vs-implemented

仓库创建 2026年3月2日最近提交 24 天前SkillHot 收录 21 天前

▸ 精选理由

为安全与正确性审计提供方法论，帮助找出传统静态检查漏掉的偏差。

这个 Skill 做什么

定义并发现系统文档意图与实际实现之间的差距与高价值缺陷。

对照文档意图和代码实现找出两者不一致的地方，比如记录了权限却没被执行或接口比文档开放。适合审计 AI 生成代码、复核访问控制或验证代码是否符合自己写的规范。不同于普通静态扫描，它把“意图”作为判断依据，能定位那类传统扫描器容易漏掉的高价值缺陷。

▸ 展开 SKILL.md 英文原文

The method for finding the gap between what a system is supposed to do and what the code actually does — the class of bug generic scanners miss because they have no model of intent. Defines what counts as documented intent, what counts as implementation evidence, which mismatches matter, and how to avoid hand-wavy findings. Use when auditing AI-built code, reviewing access control against documented permissions, or checking whether a codebase matches its own documentation.

Skill 开发管理意图审计实现差异代码审查通用

2.5w

Stars

2.5k

Forks

仓库内 Skill

+1.8k

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/phuryn/pm-skills/main/pm-ai-shipping/skills/intended-vs-implemented/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/phuryn/pm-skills/main/pm-ai-shipping/skills/intended-vs-implemented/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Intended vs. Implemented: Auditing the Gap

## Purpose

A linter scans code in a vacuum. It can tell you the code is *internally* consistent; it cannot tell you the code does what you *meant*, because it has no model of your intent. The highest-value security and correctness bugs live in that gap — a permission documented but never enforced, a "cron-only" endpoint anyone can call, a field marked public-only that leaks private data.

This skill is the method for finding that gap. It is the differentiator: it only works when intent has been written down first (see the **shipping-artifacts** skill), and that's exactly why commodity tools can't replicate it.

## Context

Use this when document

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有