Manual Audit Checklist

Routing

• Enumerate user-level SKILL.md, AGENTS.md, rules, hooks, and requirements.
• Search for always, must, whenever, implicitly, 无需显式点名, and 满足任一即触发.
• Identify every external platform named by a global rule.
• Confirm generic development requests remain with the host model unless explicitly delegated.
• Resolve symlinks and Junctions to their physical source.

Installation and persistence

• List globally installed packages related to Agent CLIs.
• Inspect package postinstall, self-update, and Skill-sync behavior.
• Check whether upgrades restore removed global Skills.
• Check startup items, scheduled tasks, services, and running bridges.

Credentials

• Inventory sensitive environment variable names without printing values.
• Distinguish process, user, machine, project, and task scope.
• Check bridge snapshots and child-environment merge behavior.
• Check credential file ownership and ACLs.
• Confirm unrelated child agents receive no credentials.

Permissions

• Record the effective sandbox and approval policy, including launch-time overrides.
• Review trusted-project entries and remove stale paths.
• Inspect project-level instructions for automatic writes or mandatory delegation.
• Require approval for external writes and destructive actions.

External side effects

• Assign one writer for each platform operation.
• Use an idempotency key for create/update actions.
• Reconcile unknown results before retrying.
• Keep publishing and account changes behind separate explicit authorization.

Closeout

• Rotate credentials only after the exposure path is contained.
• Rerun the audit after restart and upgrade.
• Document observed evidence separately from inference.
• Verify reports and tickets contain no credential values or private paths.