跳转到正文
报告库
用途分类 / 其他用途

Internal Comms Skill 安全审计

作者说它能做什么(原文)

A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).

第三方安全检查结论

发现安全风险

已检查文件
6
发现的风险
2
会不会运行危险命令?检查是否下载程序后直接运行、让他人远程控制电脑,或藏起要运行的命令。未发现风险
会不会泄露文件和密钥?检查是否发送含密码或密钥的文件,以及代码里是否直接写了密钥。发现 1 项风险
中风险

跨 Slack、邮件、云盘和日历的宽泛收集可能把敏感内部信息带入通信草稿

原文依据:4 处
发现了什么

指南要求尽可能从多个公司系统拉取信息,并“尽量收集更多上下文”。筛选依据主要是反应数、浏览量、回复量或会议重要性,而不是数据敏感度、用户指定范围或接收者权限。

为什么需要注意

在代理已连接这些系统时,草稿可能包含机密项目、管理层邮件、会议内容或内部文档链接。若草稿随后面向更广泛员工发布,原本仅对小范围可见的信息可能被重新传播。

这是实际的信息收集指令,不只是示例:制作 3P 更新时,助手被要求尽可能读取 Slack、Google Drive、邮件和日历,并“尽量收集更多上下文”。如果这些连接器已获授权但范围很宽,助手可能把高互动或高浏览量的敏感材料带入面向领导或同事的草稿;指南没有要求按接收者权限或保密级别过滤。它并未要求自动发送,且无访问权限时会改为询问用户。用户可要求作者加入明确的数据范围、敏感信息排除和发布前人工审阅。

examples/3p-updates.md:14来自说明文档打开原文件
## Tools AvailableWhenever possible, try to pull from available sources to get the information you need:- Slack: posts from team members with their updates - ideally look for posts in large channels with lots of reactions- Google Drive: docs written from critical team members with lots of views- Email: emails with lots of responses of lots of content that seems relevant- Calendar: non-recurring meetings that have a lot of importance, like product reviews, etc.
查看另外 3 个位置
examples/3p-updates.md:22来自说明文档打开原文件
Try to gather as much context as you can, focusing on the things that covered the time period you're writing for:- Progress: anything between a week ago and today- Plans: anything from today to the next week- Problems: anything between a week ago and todayIf you don't have access, you can ask the user for things they want to cover. They might also include these things to you directly, in which case you're mostly just formatting for this particular format.
examples/company-newsletter.md:12来自说明文档打开原文件
- Slack: look for messages in channels with lots of people, with lots of reactions or lots of responses within the thread- Email: look for things from executives that discuss company-wide announcements- Calendar: if there were meetings with large attendee lists, particularly things like All-Hands meetings, big company announcements, etc. If there were documents attached to those meetings, those are great links to include.- Documents: if there were new docs published in the last week or two that got a lot of attention, you can link them. These should be things like company-wide vision docs, plans for the upcoming quarter or half, things authored by critical executives, etc.- External press: if you see references to articles or press we've received over the past week, that could be really cool too.
examples/company-newsletter.md:2来自说明文档打开原文件
## InstructionsYou are being asked to write a company-wide newsletter update. You are meant to summarize the past week/month of a company in the form of a newsletter that the entire company will read. It should be maybe ~20-25 bullet points long. It will be sent via Slack and email, so make it consumable for that.
会不会删除文件或一直在后台运行?检查是否大范围删除文件、改写磁盘,或设置自动启动。未发现风险
会不会绕过安全保护?检查是否跳过网站安全验证、开放过多文件权限,或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容?检查工作说明是否要求 AI 忽略你的指令、干扰检查结果,或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方?检查是否强制替换推广链接或收款对象,同时要求隐瞒更改。发现 1 项风险
中风险

根据互动量和文档内容推断公司事实,可能生成未经授权或误导性的全公司表述

原文依据:7 处
发现了什么

简报指南以反应数、回复量和浏览量作为突出内容的信号;FAQ 指南还允许从文档内容推断问题。虽然它要求标注不确定性并优先采用官方通信,但没有要求事实负责人批准最终答案或公司级声明。

为什么需要注意

热门但非正式、过时或缺少背景的信息可能被写成代表公司的“我们”表述或 FAQ 答案,影响员工对战略、招聘、融资、发布计划等事项的判断。

风险有源码依据,但候选描述混合了两种输出。全公司简报会按互动量、回复量和文档关注度挑选材料,并计划通过 Slack 和邮件传播;FAQ 还允许从文档内容推断问题。若互动信号被误当作真实性或发布授权,可能形成误导性或越权的公司级表述。FAQ 的“优先官方来源、标明不确定性、需要时请求高管回应”可降低风险,但未规定事实负责人批准;源码也只要求起草,并未自动发送。用户可限制为已批准来源并要求发布前由内容负责人核准。

examples/company-newsletter.md:5来自说明文档打开原文件
Ideally it includes the following attributes:- Lots of links: pulling documents from Google Drive that are very relevant, linking to prominent Slack messages in announce channels and from executives, perhgaps referencing emails that went company-wide, highlighting significant things that have happened in the company.- Short and to-the-point: each bullet should probably be no longer than ~1-2 sentences- Use the "we" tense, as you are part of the company. Many of the bullets should say "we did this" or "we did that"
查看另外 6 个位置
examples/company-newsletter.md:12来自说明文档打开原文件
- Slack: look for messages in channels with lots of people, with lots of reactions or lots of responses within the thread- Email: look for things from executives that discuss company-wide announcements- Calendar: if there were meetings with large attendee lists, particularly things like All-Hands meetings, big company announcements, etc. If there were documents attached to those meetings, those are great links to include.- Documents: if there were new docs published in the last week or two that got a lot of attention, you can link them. These should be things like company-wide vision docs, plans for the upcoming quarter or half, things authored by critical executives, etc.- External press: if you see references to articles or press we've received over the past week, that could be really cool too.
examples/faq-answers.md:12来自说明文档打开原文件
You should use the company's available tools, where communication and work happens. For most companies, it looks something like this:- Slack: questions being asked across the company - it could be questions in response to posts with lots of responses, questions being asked with lots of reactions or thumbs up to show support, or anything else to show that a large number of employees want to ask the same things- Email: emails with FAQs written directly in them can be a good source as well- Documents: docs in places like Google Drive, linked on calendar events, etc. can also be a good source of FAQs, either directly added or inferred based on the contents of the doc
examples/faq-answers.md:25来自说明文档打开原文件
## Answer Guidelines- Base answers on official company communications when possible- If information is uncertain, indicate that clearly- Link to authoritative sources (docs, announcements, emails)- Keep tone professional but approachable- Flag if a question requires executive input or official response
examples/company-newsletter.md:2来自说明文档打开原文件
## InstructionsYou are being asked to write a company-wide newsletter update. You are meant to summarize the past week/month of a company in the form of a newsletter that the entire company will read. It should be maybe ~20-25 bullet points long. It will be sent via Slack and email, so make it consumable for that.Ideally it includes the following attributes:- Lots of links: pulling documents from Google Drive that are very relevant, linking to prominent Slack messages in announce channels and from executives, perhgaps referencing emails that went company-wide, highlighting significant things that have happened in the company.- Short and to-the-point: each bullet should probably be no longer than ~1-2 sentences
examples/company-newsletter.md:9来自说明文档打开原文件
## Tools to useIf you have access to the following tools, please try to use them. If not, you can also let the user know directly that their responses would be better if they gave them access.- Slack: look for messages in channels with lots of people, with lots of reactions or lots of responses within the thread- Email: look for things from executives that discuss company-wide announcements- Calendar: if there were meetings with large attendee lists, particularly things like All-Hands meetings, big company announcements, etc. If there were documents attached to those meetings, those are great links to include.- Documents: if there were new docs published in the last week or two that got a lot of attention, you can link them. These should be things like company-wide vision docs, plans for the upcoming quarter or half, things authored by critical executives, etc.- External press: if you see references to articles or press we've received over the past week, that could be really cool too.
examples/faq-answers.md:11来自说明文档打开原文件
## Tools AvailableYou should use the company's available tools, where communication and work happens. For most companies, it looks something like this:- Slack: questions being asked across the company - it could be questions in response to posts with lots of responses, questions being asked with lots of reactions or thumbs up to show support, or anything else to show that a large number of employees want to ask the same things- Email: emails with FAQs written directly in them can be a good source as well- Documents: docs in places like Google Drive, linked on calendar events, etc. can also be a good source of FAQs, either directly added or inferred based on the contents of the doc

Skill 逻辑拆解

3 个说明模块

该 Skill 根据通信类型加载 examples/ 中对应指南,并遵循其中的格式、语气和信息收集说明。

查看原文
SKILL.md:21来自说明文档打开原文件
1. **Identify the communication type** from the request2. **Load the appropriate guideline file** from the `examples/` directory:    - `examples/3p-updates.md` - For Progress/Plans/Problems team updates    - `examples/company-newsletter.md` - For company-wide newsletters    - `examples/faq-answers.md` - For answering frequently asked questions    - `examples/general-comms.md` - For anything else that doesn't explicitly match one of the above3. **Follow the specific instructions** in that file for formatting, tone, and content gathering

3P 指南会让代理从 Slack、Google Drive、电子邮件和日历收集一周范围内的信息;没有访问权限时才改为询问用户。

查看原文
examples/3p-updates.md:14来自说明文档打开原文件
## Tools AvailableWhenever possible, try to pull from available sources to get the information you need:- Slack: posts from team members with their updates - ideally look for posts in large channels with lots of reactions- Google Drive: docs written from critical team members with lots of views- Email: emails with lots of responses of lots of content that seems relevant- Calendar: non-recurring meetings that have a lot of importance, like product reviews, etc.
examples/3p-updates.md:22来自说明文档打开原文件
Try to gather as much context as you can, focusing on the things that covered the time period you're writing for:- Progress: anything between a week ago and today- Plans: anything from today to the next week- Problems: anything between a week ago and todayIf you don't have access, you can ask the user for things they want to cover. They might also include these things to you directly, in which case you're mostly just formatting for this particular format.

公司简报被设计为约 20–25 个要点,并面向全公司通过 Slack 和电子邮件阅读;指南鼓励加入内部文档、消息和邮件链接。

查看原文
examples/company-newsletter.md:2来自说明文档打开原文件
## InstructionsYou are being asked to write a company-wide newsletter update. You are meant to summarize the past week/month of a company in the form of a newsletter that the entire company will read. It should be maybe ~20-25 bullet points long. It will be sent via Slack and email, so make it consumable for that.
examples/company-newsletter.md:4来自说明文档打开原文件
Ideally it includes the following attributes:- Lots of links: pulling documents from Google Drive that are very relevant, linking to prominent Slack messages in announce channels and from executives, perhgaps referencing emails that went company-wide, highlighting significant things that have happened in the company.- Short and to-the-point: each bullet should probably be no longer than ~1-2 sentences- Use the "we" tense, as you are part of the company. Many of the bullets should say "we did this" or "we did that"

FAQ 指南要求从公司工具中寻找广泛关注的问题,并允许根据文档内容推断 FAQ,同时要求不确定时明确说明并优先采用官方通信。

查看原文
examples/faq-answers.md:10来自说明文档打开原文件
## Tools AvailableYou should use the company's available tools, where communication and work happens. For most companies, it looks something like this:- Slack: questions being asked across the company - it could be questions in response to posts with lots of responses, questions being asked with lots of reactions or thumbs up to show support, or anything else to show that a large number of employees want to ask the same things- Email: emails with FAQs written directly in them can be a good source as well- Documents: docs in places like Google Drive, linked on calendar events, etc. can also be a good source of FAQs, either directly added or inferred based on the contents of the doc
examples/faq-answers.md:25来自说明文档打开原文件
## Answer Guidelines- Base answers on official company communications when possible- If information is uncertain, indicate that clearly- Link to authoritative sources (docs, announcements, emails)- Keep tone professional but approachable- Flag if a question requires executive input or official response
从这里开始 · 工作说明SKILL.md
internal-comms
连线表示工作说明包含的模块,不是实际运行顺序。点击模块可查看原文。

文件引用关系图

1 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用,不是运行顺序。点击节点可高亮相关连线,并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录6 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围;纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • LICENSE.txt已纳入全文
  • examples/3p-updates.md已纳入全文
  • examples/company-newsletter.md已纳入全文
  • examples/faq-answers.md已纳入全文
  • examples/general-comms.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件,没有实际运行 Skill,也没有检查它另外安装的软件包。因此,这不是“保证安全”的承诺;换了版本或使用环境,结果也可能不同。

  • LICENSE.txt许可说明
  • SKILL.md工作说明
  • examples/3p-updates.md配套文件
  • examples/company-newsletter.md配套文件
  • examples/faq-answers.md配套文件
  • examples/general-comms.md配套文件
读取了多少行
394
文件校验值(用于核对版本)
d99fbc59afe383cbdd73584613009c1c05d29a5f4aa0abdcfab54ac2dfde4b6c