中风险
元技能将未提供、未审计的其他技能设为强制工作流
原文依据：3 处发现了什么
该文件声称自己管理所有技能的发现与调用，并要求代理在开始工作前检查适用技能、按顺序执行且不得跳过步骤。完整功能的示例链还延伸到迁移、版本控制和发布。由于这些被调用技能的正文未提供，用户无法从本次来源判断它们是否会运行命令、修改仓库、访问网络或执行部署。
为什么需要注意
如果代理自动选择并执行已安装的其他技能，任务范围可能从用户请求扩展到额外的代码修改、提交、迁移或发布流程。此文件本身没有执行这些操作，也不能证明任何操作已经发生。
该元技能确实要求代理在工作前寻找其他技能，并将其步骤和验证设为强制流程；它还给出了可延伸到版本控制、迁移和部署的完整链。虽然文件明确说并非每项任务都需要全部技能，因此不会无条件部署，但被引用技能的内容未随来源提供，用户无法核查它们会执行哪些命令、联网或修改。用户可要求作者提供所有依赖技能及权限清单，并限制未经逐项授权的网络、提交、迁移和部署操作。
name: using-agent-skillsdescription: Discovers and invokes agent skills. Use when starting a session or when you need to discover which skill applies to the current task. This is the meta-skill that governs how all other skills are discovered and invoked.---查看另外 2 个位置
1. **Check for an applicable skill before starting work.** Skills encode processes that prevent common mistakes.2. **Skills are workflows, not suggestions.** Follow the steps in order. Don't skip verification steps.3. **Multiple skills can apply.** A feature implementation might involve `idea-refine` → `spec-driven-development` → `planning-and-task-breakdown` → `incremental-implementation` → `test-driven-development` → `code-review-and-quality` → `code-simplification` → `shipping-and-launch` in sequence.4. **When in doubt, start with a spec.** If the task is non-trivial and there's no spec, begin with `spec-driven-development`.10. test-driven-development → Prove each slice works11. code-review-and-quality → Review before merge12. code-simplification → Reduce unnecessary complexity while preserving behavior13. git-workflow-and-versioning → Clean commit history14. documentation-and-adrs → Document decisions15. deprecation-and-migration → Retire old systems and move users safely when needed16. shipping-and-launch → Deploy safely```Not every task needs every skill. A bug fix might only need: `debugging-and-error-recovery` → `test-driven-development` → `code-review-and-quality`.