play-policy-insights

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Play Policy Insights: data safety, login credentials, and restricted permissions

Play Policy Insights：数据安全、登录凭据与受限权限

You must audit Android apps for three specific policy domains. You must check data safety, demo login credentials, and restricted permissions.

你必须针对三个特定政策领域对Android应用进行审计，检查数据安全、演示登录凭据以及受限权限。

Path Resolution

路径解析

repo_root: Absolute path to the directory containing this
```
SKILL.md
```
.
app_dir:: Absolute path to the directory containing app's code.
temp_dir: Absolute path to the scratch directory at the workspace root. It is located at
```
.scratch/play_policy_insights_<uuid>
```
. Containment Mandate: You must confine all file system writes, intermediate artifacts, and logs strictly to this directory. This ensures the skill remains portable and safe across diverse execution environments, including local harnesses and CI/CD pipelines, by avoiding reliance on system-level temporary paths or user home directories.

repo_root: 包含此
```
SKILL.md
```
文件的目录绝对路径。
app_dir: 包含应用代码的目录绝对路径。
temp_dir: 工作区根目录下临时目录的绝对路径，位于
```
.scratch/play_policy_insights_<uuid>
```
。强制隔离要求：你必须将所有文件系统写入操作、中间产物和日志严格限制在此目录内。这可确保该工具在各种执行环境（包括本地测试环境和CI/CD流水线）中保持可移植性和安全性，避免依赖系统级临时路径或用户主目录。

Critical mandates

关键要求

Execution Mode Awareness Before starting Phase 2, evaluate if your execution environment provides a tool to spawn or delegate tasks to general-purpose sub-agents (e.g., tools often named
```
invoke_agent
```
,
```
delegate_task
```
, or
```
spawn_worker
```
, using generic agent profiles like 'generalist' or 'coding_agent').
If YES, you MUST use Mode A (Delegation).
If NO, use Mode B (Sequential Self-Execution). You must read the prompt files intended for the subagents, follow their instructions, and write the expected output files to disk.
Sub-agents orchestration:
- If you use "Mode A (Delegation)", wait for "SUCCESS" confirmation from sub-agents to know when they are done.
- Idempotency & Timeout Safeguard: If a sub-agent fails or times out, you MUST verify the presence and integrity of its target output file (e.g.,
```
<temp_dir>/worker_<goal_name>.json
```
 ) before retrying. If the file exists and contains valid JSON, treat the execution as SUCCESS and proceed. Otherwise, retry up to three times.
Fail-fast mandate: The automated audit in Phase 1 is the source of truth. If
```
orchestrator.py
```
fails, you must stop immediately with an explanation of failure. Do not use manual auditing as a fallback.

执行模式感知：在开始第二阶段之前，评估你的执行环境是否提供了可生成或委派任务给通用子代理的工具（例如名为
```
invoke_agent
```
、
```
delegate_task
```
或
```
spawn_worker
```
的工具，使用'generalist'或'coding_agent'等通用代理配置文件）。
如果是，你必须使用模式A（委派模式）。
如果否，使用模式B（顺序自执行模式）。你必须读取为子代理准备的提示文件，遵循其中的指令，并将预期的输出文件写入磁盘。
子代理编排：
- 如果使用“模式A（委派模式）”，需等待子代理返回“SUCCESS”确认信息，以知晓任务完成状态。
- 幂等性与超时防护：如果子代理失败或超时，在重试之前你必须验证其目标输出文件（例如
```
<temp_dir>/worker_<goal_name>.json
```
 ）是否存在且完整。如果文件存在且包含有效的JSON内容，则将此次执行视为成功并继续后续操作。否则，最多重试三次。
快速失败要求：第一阶段的自动化审计是事实依据。如果
```
orchestrator.py
```
执行失败，你必须立即停止并说明失败原因，不得将手动审计作为备选方案。

The two-phase protocol

两阶段协议

Phase 1: Fact gathering and triage

第一阶段：事实收集与分类

Initialize and triage:
- Run
```
python3 <repo_root>/scripts/orchestrator.py init <app_dir>
```
 .
- This will create the scratch environment, perform static analysis, map the codebase, identify audit goals, and produce prompts for subagents for each audit goal and prompts for designated critic and aggregator subagents.
- You must wait (up to 5 minutes) for the script to finish.
Capture environment: Note values of the
```
temp_dir
```
, and
```
activated_goals
```
from the JSON output. You will need them in Phase 2.
Evaluate goals: If
```
activated_goals
```
is empty, skip to step 3 of Phase 2 (Aggregation). Otherwise, proceed to step 1 of Phase 2 (Detailed analysis).

初始化与分类：
- 运行
```
python3 <repo_root>/scripts/orchestrator.py init <app_dir>
```
 。
- 此操作将创建临时环境、执行静态代码分析、映射代码库、识别审计目标，并为每个审计目标生成子代理提示，同时为指定的评审代理和聚合代理生成提示。
- 你必须等待（最多5分钟）脚本执行完成。
捕获环境信息：记录JSON输出中的
```
temp_dir
```
和
```
activated_goals
```
的值，这些信息将在第二阶段中使用。
评估目标：如果
```
activated_goals
```
为空，则直接跳至第二阶段的第3步（聚合）。否则，继续执行第二阶段的第1步（详细分析）。

Phase 2: Goal-oriented audit

第二阶段：目标导向审计

Determine your execution capabilities and proceed with either Mode A OR Mode B.

根据你的执行能力选择模式A或模式B进行操作。

Mode A: Orchestrator WITH Delegation Capabilities (Parallel)

模式A：支持委派能力的编排器（并行执行）

Detailed analysis: For each goal in
```
activated_goals
```
(e.g.,
```
permissions_and_apis
```
,
```
data_safety_part_1
```
,
```
data_safety_part_2
```
), delegate to a sub-agent. Concurrency Limit: You must not spawn more than 3 sub-agents simultaneously. Spawn the first batch of up to 3, wait for their completions, and then spawn the next batch. Repeat until all goals are complete. Pass the prompt:
```
"Read your instructions from <temp_dir>/prompt_worker_<goal_name>.md and execute. MANDATORY: You must use your file-writing capabilities to save your final JSON findings directly to the file system at <temp_dir>/worker_<goal_name>.json. You are strictly forbidden from outputting the JSON in your chat response. To minimize context usage, your final response must be exactly 'SUCCESS' and nothing else."
```
Validate: Confirm every
```
<temp_dir>/worker_<goal_name>.json
```
exists and contains valid JSON. If a sub-agent fails or times out, but the valid JSON output file is already present on disk, do NOT retry; proceed normally. Only retry the corresponding worker (up to three times) if the file is missing or invalid.
Aggregate Findings: Execute the python aggregation command:
```
python3 <repo_root>/scripts/orchestrator.py aggregate <temp_dir>
```
. This produces
```
aggregated_findings.json
```
and returns a JSON object containing
```
critic_chunks
```
representing the number of chunks to verify (e.g.,
```
{"temp_dir": "...", "critic_chunks": 2}
```
).

Parallel Critic review: For each chunk index

from 1 to

critic_chunks

, delegate to a sub-agent. Concurrency Limit: You must not spawn more than 3 critic sub-agents simultaneously. Batch them in groups of 3 as above. Pass the prompt:

"Read your instructions from <temp_dir>/prompt_critic_<i>.md and execute. MANDATORY: You must use your file-writing capabilities to save your final JSON findings directly to the file system at <temp_dir>/critic_output_<i>.json. You are strictly forbidden from outputting the JSON in your chat response. To minimize context usage, your final response must be exactly 'SUCCESS' and nothing else."

Validate: Confirm each

<temp_dir>/critic_output_<i>.json

exists and contains valid JSON before proceeding. If it failed or timed out, but the valid JSON file is present, proceed normally. Otherwise, retry that specific critic chunk.

Proceed to Finalization (Step 4 below)

详细分析：针对
```
activated_goals
```
中的每个目标（例如
```
permissions_and_apis
```
、
```
data_safety_part_1
```
、
```
data_safety_part_2
```
），将任务委派给子代理。并发限制：你不得同时生成超过3个子代理。先生成第一批最多3个，等待它们完成后，再生成下一批，重复此操作直至所有目标完成。传递提示信息：
```
"Read your instructions from <temp_dir>/prompt_worker_<goal_name>.md and execute. MANDATORY: You must use your file-writing capabilities to save your final JSON findings directly to the file system at <temp_dir>/worker_<goal_name>.json. You are strictly forbidden from outputting the JSON in your chat response. To minimize context usage, your final response must be exactly 'SUCCESS' and nothing else."
```
验证：确认每个
```
<temp_dir>/worker_<goal_name>.json
```
文件存在且包含有效的JSON内容。如果子代理失败或超时，但磁盘上已存在有效的JSON输出文件，则无需重试，正常继续操作。仅当文件缺失或无效时，才对对应的代理任务进行重试（最多三次）。
聚合结果：执行Python聚合命令：
```
python3 <repo_root>/scripts/orchestrator.py aggregate <temp_dir>
```
。此操作将生成
```
aggregated_findings.json
```
文件，并返回包含
```
critic_chunks
```
（代表需要验证的块数量）的JSON对象（例如
```
{"temp_dir": "...", "critic_chunks": 2}
```
）。

并行评审检查：针对从1到

critic_chunks

的每个块索引

，将任务委派给子代理。并发限制：你不得同时生成超过3个评审子代理。按照上述方式分批处理，每批3个。传递提示信息：

"Read your instructions from <temp_dir>/prompt_critic_<i>.md and execute. MANDATORY: You must use your file-writing capabilities to save your final JSON findings directly to the file system at <temp_dir>/critic_output_<i>.json. You are strictly forbidden from outputting the JSON in your chat response. To minimize context usage, your final response must be exactly 'SUCCESS' and nothing else."

验证：在继续操作前，确认每个

<temp_dir>/critic_output_<i>.json

文件存在且包含有效的JSON内容。如果任务失败或超时，但有效的JSON文件已存在，则正常继续操作。否则，重试该特定的评审块任务。

进入最终阶段（如下第4步）

Mode B: Orchestrator WITHOUT Delegation Capabilities (Sequential)

模式B：不支持委派能力的编排器（顺序执行）

Detailed Analysis: For each goal in
```
activated_goals
```
, sequentially:
- Read the contents of
```
<temp_dir>/prompt_worker_<goal_name>.md
```
 .
- Execute the instructions contained within that file yourself.
- CRITICAL: You MUST format your findings exactly as requested in the prompt and save them to
```
<temp_dir>/worker_<goal_name>.json
```
 . Do not summarize findings in your thoughts or chat; move to the next task.
- Validate: Confirm
```
<temp_dir>/worker_<goal_name>.json
```
 exists before moving to the next goal.
Aggregate Findings: Execute the python aggregation command:
```
python3 <repo_root>/scripts/orchestrator.py --aggregate <temp_dir>
```
. This produces
```
aggregated_findings.json
```
and returns a JSON object containing
```
critic_chunks
```
representing the number of chunks to verify.
Sequential Critic review: For each chunk index
```
i
```
from 1 to
```
critic_chunks
```
, sequentially:
- Read the contents of
```
<temp_dir>/prompt_critic_.md
```
 .
- Execute the steps yourself and save your findings to
```
<temp_dir>/critic_output_.json
```
 .
- Validate: Confirm
```
<temp_dir>/critic_output_.json
```
 exists before moving to the next chunk.
Proceed to Finalization (Step 4 below)

详细分析：针对
```
activated_goals
```
中的每个目标，依次执行以下操作：
- 读取
```
<temp_dir>/prompt_worker_<goal_name>.md
```
 文件的内容。
- 自行执行文件中包含的指令。
- 关键要求：你必须严格按照提示中的要求格式化你的审计结果，并将其保存至
```
<temp_dir>/worker_<goal_name>.json
```
 。不得在思考过程或对话中总结审计结果，直接进入下一个任务。
- 验证：确认
```
<temp_dir>/worker_<goal_name>.json
```
 文件存在后，再进行下一个目标的操作。
聚合结果：执行Python聚合命令：
```
python3 <repo_root>/scripts/orchestrator.py --aggregate <temp_dir>
```
。此操作将生成
```
aggregated_findings.json
```
文件，并返回包含
```
critic_chunks
```
（代表需要验证的块数量）的JSON对象。
顺序评审检查：针对从1到
```
critic_chunks
```
的每个块索引
```
i
```
，依次执行以下操作：
- 读取
```
<temp_dir>/prompt_critic_.md
```
 文件的内容。
- 自行执行步骤并将审计结果保存至
```
<temp_dir>/critic_output_.json
```
 。
- 验证：确认
```
<temp_dir>/critic_output_.json
```
 文件存在后，再进行下一个块的操作。
进入最终阶段（如下第4步）

Finalization (Both Modes)

最终阶段（两种模式通用）

Present findings: Run

python3 <repo_root>/scripts/generate_report.py <temp_dir>

. It will produce

<temp_dir>/compliance_report.md

. Present this output file to user.

STOP: The audit is complete. Await further instructions.

呈现审计结果：运行
```
python3 <repo_root>/scripts/generate_report.py <temp_dir>
```
。该命令将生成
```
<temp_dir>/compliance_report.md
```
文件。将此输出文件提供给用户。
停止操作：审计完成，等待进一步指令。