技能 constraint-driven-development

📦

constraint-driven-development

Name: constraint-driven-development
Author: addyosmani

內容修訂 r1 中風險 ⚙️ 外部命令📁 檔案系統存取

Define Enforceable Project Quality Constraints

Teams often lack measurable quality standards, allowing checks and thresholds to drift during development. This skill defines a shared contract and connects each constraint to practical enforcement.

支援: Claude Codex Code(CC)

📊 66 尚可

Maintain this Skill? Claim it 📊 66 尚可

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "constraint-driven-development" from https://skillstore.io/skills/addyosmani-constraint-driven-development.md and its manifest at https://skillstore.io/api/skills/addyosmani-constraint-driven-development/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/addyosmani-constraint-driven-development.md 已簽名 manifest GET /api/skills/addyosmani-constraint-driven-development/manifest 已簽名 lockfile GET /api/skills/addyosmani-constraint-driven-development/lockfile

測試它

正在使用「constraint-driven-development」。 Set up constraints for a TypeScript web application with tests, preview deployments, and no documented quality gates.

預期結果:

Created a quality contract covering types, linting, secret scanning, changed-line coverage, accessibility, and performance.
Assigned fast checks to edit time, coverage to task completion, and browser checks to preview deployment.
Recorded current coverage as a ratchet and required owners and expiry dates for exceptions.

正在使用「constraint-driven-development」。 Our legacy Python service has low coverage, so fixed coverage targets fail immediately.

預期結果:

Measured current project coverage and set it as a non-regression baseline.
Applied a stronger coverage target only to changed lines.
Placed type, lint, and secret checks in the fast stage while keeping broader security scans in CI.

正在使用「constraint-driven-development」。 Review a branch where tests pass after several quality configuration changes.

預期結果:

Flagged a lowered threshold, a newly skipped test, and an added suppression for review.
Kept tightened constraints silent and requested tracked exceptions for approved deviations.
Recommended fixing the implementation instead of weakening the quality contract.

安全審計

中風險

v1 • 2026/9/19 開啟版本化報告

All 87 static alerts are false positives caused by Markdown formatting, filename regular expressions, or a constrained git helper that avoids shell interpolation. The review found no prompt injection or malicious command intent. One medium-risk semantic issue remains because the floor guard can print matched source text without redaction.

已掃描檔案

412

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

中

references/floor-guard.md:54 references/floor-guard.md:90

Matched Diff Content May Be Exposed in Logs

The floor guard stores up to 120 characters from each matched diff line and prints that text to standard error. A matching line containing a credential or other sensitive value could therefore enter local or CI logs despite the stated redaction contract.

The reference directly retains matched source text and interpolates it into console output. No redaction step is applied before logging.

風險因素

⚙️ 外部命令 (50)

📁 檔案系統存取 (5)

references/floor-guard.md:67 references/floor-guard.md:72 references/floor-guard.md:79 references/floor-guard.md:80 references/floor-guard.md:41

審計單位: codex

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/addyosmani-constraint-driven-development/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/addyosmani-constraint-driven-development/security.svg)](https://skillstore.io/skills/addyosmani-constraint-driven-development?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/addyosmani-constraint-driven-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/addyosmani-constraint-driven-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/addyosmani-constraint-driven-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

addyosmani. (2026). constraint-driven-development security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/addyosmani-constraint-driven-development/audits/1

BibTeX 引用

@techreport{addyosmani-addyosmani-constraint-driven-development-2026,
  author = {addyosmani},
  title = {constraint-driven-development security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/addyosmani-constraint-driven-development/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "constraint-driven-development security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "addyosmani"
date-released: "2026-09-19"
url: "https://skillstore.io/skills/addyosmani-constraint-driven-development/audits/1"
identifiers:
  - type: other
    value: "skillstore:addyosmani-constraint-driven-development:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

Set Standards for a New Project

Define measurable quality gates before implementation expands, with defaults tied to available tools and current project evidence.

Protect an Autonomous Workflow

Add fast checks and diff guards that detect weakened thresholds, silenced tools, skipped tests, and unfinished work.

Stabilize Existing CI Gates

Convert inconsistent checks into documented constraints with owners, commands, lifecycle stages, baselines, and explicit exception expiry dates.

試試這些提示

Create a Basic Quality Contract

Review this project and help me define a basic quality contract. Ask one question at a time and use measured defaults when I am unsure.

Define Measurable Gates

Create project constraints for coverage, security, and linting. Measure the current baseline, explain each threshold, and identify the command that verifies it.

Stage Checks by Cost

Add quality gates for edit, task, review, and CI phases. Keep fast checks under five seconds and scope expensive checks to changed files.

Audit Constraint Integrity

Audit our constraints for weakened thresholds, new suppressions, skipped tests, removed assertions, unfinished stubs, and untracked exceptions. Propose remediations without lowering standards.

最佳實務

Measure the current baseline before choosing thresholds that could leave the project permanently failing.
Place each check according to execution cost, and keep the edit loop focused on changed files.
Record every exception with a reason, owner, and expiry date.

避免

Do not lower a threshold or disable a checker merely to make a change pass.
Do not define a numeric constraint without naming the command that verifies it.
Do not rely only on tests written by the same system that produced the implementation.

常見問題

What does this skill create?

It creates a project quality contract, usually in CONSTRAINTS.md, with measurable rules, verification commands, lifecycle stages, and exception handling.

Does it require a new project?

No. It can measure an existing codebase and establish ratchets that prevent current quality metrics from declining.

What happens when I do not know a target number?

The skill measures the current value, records it as a baseline, and prevents regression until the team chooses a stronger target.

Will every check run after each edit?

No. Fast checks run near edits, while expensive coverage, browser, mutation, and security checks move to later stages.

Can the floor guard replace code review?

No. It detects common diff patterns with regular expressions, but human review remains necessary for context, intent, and sophisticated changes.

How are temporary exceptions handled?

Each exception should include a rule, path, reason, owner, and expiry date so deviations remain visible and accountable.

開發者詳細資訊

作者

addyosmani

授權

MIT

Skillstore 修訂

版本提示

作者未聲明版本。

儲存庫

https://github.com/addyosmani/agent-skills/tree/c004a74784a08295d52749b04cda634125b9a581/skills/constraint-driven-development

引用

5d5054f8a23586f9b500fece1cb613a9dffc787b

維護新鮮度

2026/9/19

使用量

0 次下載 · 0 次瀏覽

檔案結構

📁 references/

📄 floor-guard.md

📄 SKILL.md