codebase-audit
全面代码库审计 — 自适应并行深度分析（前后端契约、数据完整性、异常处理/安全、架构/技术债、配置/缓存），结构化 findings + 对抗验证 + 基线对比，输出按严重程度排序的统一报告和修复路线图。支持 quick 快速体检模式。Use when user asks to audit,…
Connecting the steps of a workflow
What it does
Comprehensive codebase audit that adapts its agent configuration to the project's tech stack, forces structured findings, adversarially verifies Critical/High findings before they enter the report, diffs against the previous audit's ledger (resolved / still-open / new), and outputs a severity-sorted report plus a phased repair roadmap.
trigger when user asks to find silent degradation, data flow
You don’t need to name it. Ask for the job in your own words — your AI loads the skill when the request matches.
What it can touch
Includes 9 scripts
Your AI can run these when the skill is used — on your computer in a coding tool (which asks first unless you have told it not to), or in the AI’s own sandbox in Claude and ChatGPT.
How we know
Found in the skill’s folder: evals/fixture/app/__init__.py, evals/fixture/app/config.py, evals/fixture/app/handlers.py, evals/fixture/app/main.py….
1 smaller thing worth knowing
Contains commands that delete or overwrite. Usually legitimate — listed so nothing is hidden.
How we know
Contains commands that delete or overwrite — evals/README.md line 30. Read 2026-10-05, commit 414b597.
evals/README.md, line 30 ↗No serious risk pattern found
Launch7’s automated check read all 20 text files in this skill and matched none of its serious risk patterns. This is not a guarantee: a check like this can miss new or disguised tricks, and the author can change the files after the check.
How we know
Read 2026-10-05, commit 414b597 by pipeline/trust/analyze.py — 40+ patterns for hidden text, prompt injection, downloads that run, credential access and more. It reads; it never runs the skill.
Recently maintained
Its repository has had changes recently.
How we know
Last push to majiayu000/spellbook: 2026-10-02 (3 days before the scan).
Read automatically from the skill’s own files on GitHub on 5 Oct 2026. Launch7 does not run or manually review skills: this lists what the check saw, and nothing here means “safe”. How we check
Add it to your AI
Partly. Upload it in Claude’s settings — the instructions work; the scripts need the full folder.
Built in your browser from the SKILL.md on GitHub — nothing passes through Launch7.
In Claude, open Customize → Skills, press +, then Create skill → Upload a skill, and choose the .zip.
Make sure code execution is switched on (Settings → Capabilities). Skills need it.
Start a new chat and ask for the job in your own words — Claude picks the skill up when it fits.
This skill ships 9 scripts beside its instructions. The download here is the SKILL.md alone — enough for the instructions, not for the parts that run code. Use the command route, or take the full folder from the repository.
How Claude does this: support.claude.com · checked 28 Sep 2026 · “Supported” means documented by the vendor; Launch7 has not run it end to end
More from majiayu000
All from this publisher →- ai-agents
Production-grade AI agent patterns with MCP integration, agentic RAG, handoff orchestration, multi-layer guardrails, and observability (modern best…
- langsmith-fetch
Debug LangChain and LangGraph agents by fetching execution traces from LangSmith Studio.
- mckinsey-consultant
The publisher’s description is only a heading. Open the skill to read what it does.
- agentsmd-scaffold
Generate or update repository-specific AGENTS.md instruction files from real repo evidence.
- app-ui-design
Mobile app UI design expert for iOS and Android.
