code-audit-rigor

chinlung/claude-dev-workflow

程式碼審查工具箱 - routine 兩輪審查指令（/review-branch、/review-pr，共用語言規則包；跨輪記憶——未變動的檔跳過、已駁回的 anchor 不重貼、已驗證未修的帶入下一輪；每條 finding 標本次引入／既有；依路徑印風險 tier；/review-pr 在 inline thread 回貼並 resolve）+ 量化決策框架（EV 計算、評分校準、STRIDE+CWE 分類、強制交叉引用契約）+ 工程化保證（語言規則包分層匹配由腳本解析、機械化 scope/coverage 核銷、引用程式碼 grep 錨定）。靈感來自 codexstar69/bug-hunter 對抗式 review 與 alibaba/open-code-review 決定性工程層。本工具箱刻意不含 auto-fix 與 LLM-readable 注入面：只審查與驗證，不改寫程式碼——finding 轉 patch 的工作交由 claude-security plugin 的 suggest-patches。

version

2.1.3

GitHub stars

1

Sponsors

SnugThe clipboard manager you and your agent can use, safelyAgent CaffeineClose your lid, come back to finished workWaxBlock anything with supervision, without erasing your iPhoneOpen StepsSponsoredFree and open-source skills that make AI coding agents easier to understand, verify, and control.