跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

To Spec Skill 安全审计

作者说它能做什么（原文）

Turn the current conversation into a spec and publish it to the project issue tracker: no interview, just synthesis of what you've already discussed.

第三方安全检查结论

发现安全风险

已检查文件
2
发现的风险
2
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。发现 1 项风险
中风险

对话及代码库信息会在完整内容确认前发布到问题跟踪器

原文依据：4 处
发现了什么

Skill 会从当前对话和代码库提取问题、架构、接口、模式及交互等信息，然后直接发布。流程只要求确认测试边界，没有要求展示完整草稿、检查敏感信息或确认问题跟踪器的可见范围。

为什么需要注意

如果对话或代码库包含内部设计、客户信息、未公开功能或其他敏感上下文，这些内容可能进入对更多成员可见、长期保留或被通知订阅者的问题记录。

该 Skill 被调用且已配置问题跟踪器时，会综合当前对话与代码库信息，并把规格发布到外部项目问题跟踪器。流程仅要求用户确认测试边界，没有要求先展示完整草稿、筛查凭据或商业敏感信息，也没有确认问题的可见范围。因此，对话中的敏感细节或代码库架构信息可能被发布给有权查看该跟踪器的人。用户可要求作者增加发布前全文确认、敏感信息检查和目标项目/可见性确认。

SKILL.md:7来自说明文档打开原文件
This skill takes the current conversation context and codebase understanding and produces a spec. Do NOT interview the user; just synthesize what you already know.The issue tracker and triage label vocabulary should have been provided to you. If not, tell the user to run `/setup-matt-pocock-skills`.
查看另外 3 个位置
SKILL.md:13来自说明文档打开原文件
1. Explore the repo to understand the current state of the codebase, if you haven't already. Use the project's domain glossary vocabulary throughout the spec, and respect any ADRs in the area you're touching.2. Sketch out the seams at which you're going to test the feature. Existing seams should be preferred to new ones. Use the highest seam possible. If new seams are needed, propose them at the highest point you can. The fewer seams across the codebase, the better - the ideal number is one.Check with the user that these seams match their expectations.3. Write the spec using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.
SKILL.md:43来自说明文档打开原文件
## Implementation DecisionsA list of implementation decisions that were made. This can include:- The modules that will be built/modified- The interfaces of those modules that will be modified- Technical clarifications from the developer- Architectural decisions- Schema changes- API contracts- Specific interactions
SKILL.md:19来自说明文档打开原文件
3. Write the spec using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。发现 1 项风险
中风险

自动标记为“ready-for-agent”可能错误表达实施已获准

原文依据：2 处
发现了什么

发布后，Skill 被明确要求应用 `ready-for-agent`，并跳过额外分流。流程没有要求用户批准最终规格或确认该状态标签。

为什么需要注意

团队可能把不完整、误解或未经批准的规格视为已准备实施，影响排期、分派和开发决策。是否会自动启动其他流程取决于项目自身配置，所给证据未说明。

流程明确要求发布规格并立即加上 `ready-for-agent`，且声明无需额外分流；发布前唯一明确的用户确认是测试边界，而不是最终规格或该状态标签。若团队把该标签用于启动自动化或表示已批准实施，就可能让未获完整确认的规格进入执行队列。风险取决于该项目对标签的实际定义。用户可要求作者在加标签前确认最终规格，并说明标签是否会触发代理或自动化。

SKILL.md:15来自说明文档打开原文件
2. Sketch out the seams at which you're going to test the feature. Existing seams should be preferred to new ones. Use the highest seam possible. If new seams are needed, propose them at the highest point you can. The fewer seams across the codebase, the better - the ideal number is one.Check with the user that these seams match their expectations.3. Write the spec using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.
查看另外 1 个位置
agents/openai.yaml:4来自说明文档打开原文件
  short_description: "Turn a conversation into a spec"policy:  allow_implicit_invocation: false

Skill 逻辑拆解

8 个说明模块

此 Skill 会读取当前对话和代码库，并将综合出的规格发布到项目问题跟踪器；这不只是生成本地草稿。

查看原文
SKILL.md:7来自说明文档打开原文件
This skill takes the current conversation context and codebase understanding and produces a spec. Do NOT interview the user; just synthesize what you already know.
SKILL.md:13来自说明文档打开原文件
1. Explore the repo to understand the current state of the codebase, if you haven't already. Use the project's domain glossary vocabulary throughout the spec, and respect any ADRs in the area you're touching.
SKILL.md:19来自说明文档打开原文件
3. Write the spec using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.

配置禁止隐式调用，因此通常需要用户明确选择此 Skill；但被调用后，发布仍是流程中的直接步骤。

查看原文
SKILL.md:4来自说明文档打开原文件
description: "Turn the current conversation into a spec and publish it to the project issue tracker: no interview, just synthesis of what you've already discussed."disable-model-invocation: true---
agents/openai.yaml:4来自说明文档打开原文件
  short_description: "Turn a conversation into a spec"policy:  allow_implicit_invocation: false
SKILL.md:19来自说明文档打开原文件
3. Write the spec using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.

流程要求就测试边界征求用户意见，但没有要求用户审核完整规格或单独确认发布及标签。

查看原文
SKILL.md:15来自说明文档打开原文件
2. Sketch out the seams at which you're going to test the feature. Existing seams should be preferred to new ones. Use the highest seam possible. If new seams are needed, propose them at the highest point you can. The fewer seams across the codebase, the better - the ideal number is one.Check with the user that these seams match their expectations.3. Write the spec using the template below, then publish it to the project issue tracker. Apply the `ready-for-agent` triage label - no need for additional triage.
从这里开始 · 工作说明SKILL.md
to-spec
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。
文件与检查记录2 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • agents/openai.yaml已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • agents/openai.yaml配套文件
读取了多少行
82
文件校验值（用于核对版本）
360099c2af03fb044092fe18ea7b12a86ee1975a7b2bd17b312c4ce0d4d2eb6a