跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Subagent Driven Development Skill 安全审计

作者说它能做什么（原文）

Use when executing implementation plans with independent tasks in the current session

第三方安全检查结论

先别安装或运行

已检查文件
7
发现的风险
6
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。发现 3 项风险
中风险

同名计划会共享并覆盖同一个工作空间

原文依据：5 处
发现了什么

工作空间名称只取计划文件的基本名，不包含目录或内容标识。两个不同目录中的 `release.md` 都会解析到同一个 `.superpowers/sdd/release/`，与“另一个计划永远不会被读取或写入”的声明不符。任务摘要也会以固定名称覆盖写入。

为什么需要注意

一个计划可能读取另一个计划的进度、报告或差异，覆盖其任务摘要，甚至因误读 `Task N: complete` 而跳过任务。这会泄露项目上下文并造成错误实施决策。

工作空间键仅由计划文件的基本名生成；目录和内容都不参与区分。因此不同目录里的同名 Markdown 计划会解析到同一目录，后一次运行还会以固定任务文件名覆盖摘要。这与注释所称的计划隔离不一致，可能混用台账、报告或审查材料，进而影响代理对已完成任务和代码状态的判断。用户可要求使用规范化完整路径或内容哈希作为空间标识。

scripts/sdd-workspace:31来自说明文档打开原文件
slug=$(basename "$plan" .md)[ -n "$slug" ] && [ "$slug" != "." ] && [ "$slug" != ".." ] \  || { echo "cannot derive a workspace name from: $plan" >&2; exit 2; }root=$(git rev-parse --show-toplevel)base="$root/.superpowers/sdd"dir="$base/$slug"mkdir -p "$dir"printf '*\n' > "$base/.gitignore"cd "$dir" && pwd
查看另外 4 个位置
scripts/task-brief:24来自说明文档打开原文件
else  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")  out="$dir/task-${n}-brief.md"fi
scripts/task-brief:28来自说明文档打开原文件
awk -v n="$n" '  /^```/ { infence = !infence }  !infence && /^#+[ \t]+Task[ \t]+[0-9]+/ {    intask = ($0 ~ ("^#+[ \t]+Task[ \t]+" n "([^0-9]|$)"))  }  intask { print }' "$plan" > "$out"
SKILL.md:136来自说明文档打开原文件
- Each plan owns a workspace: at skill start, run this skill's  `scripts/sdd-workspace PLAN_FILE` — it prints the plan's git-ignored  directory (`<repo-root>/.superpowers/sdd/<plan-basename>/`), home to  every artifact for THIS plan: ledger, briefs, reports, review packages.  Another plan's directory is never yours to read or write.- Check for this plan's ledger at `<workspace>/progress.md`. If its first
scripts/task-brief:21来自说明文档打开原文件
if [ $# -eq 3 ]; then  out=$3else  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")  out="$dir/task-${n}-brief.md"fi
中风险

可选输出路径允许覆盖任意可写文件

原文依据：4 处
发现了什么

`task-brief` 和 `review-package` 都接受调用者提供的 `OUTFILE`，没有限制它必须位于专用工作空间。两个脚本随后使用 `>` 直接覆盖该路径。

为什么需要注意

错误、恶意计划指令或被操纵的代理参数可清空并替换工作树内或代理权限范围内的任何可写文件，例如配置、源码或代理说明文件。

两个脚本都允许调用者提供未经目录约束的输出路径，并使用 shell 的 `>` 覆盖目标。只有在显式传入第四或第三参数时才会发生；正常默认路径位于专用工作空间。若代理、计划或调用者可影响该参数，任何当前权限可写的文件都可能被截断并替换为任务摘要或差异包。用户可限制脚本只能在解析并校验后的工作空间内写入，并拒绝符号链接或越界路径。

scripts/task-brief:21来自说明文档打开原文件
if [ $# -eq 3 ]; then  out=$3else  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")  out="$dir/task-${n}-brief.md"fi
查看另外 3 个位置
scripts/task-brief:28来自说明文档打开原文件
awk -v n="$n" '  /^```/ { infence = !infence }  !infence && /^#+[ \t]+Task[ \t]+[0-9]+/ {    intask = ($0 ~ ("^#+[ \t]+Task[ \t]+" n "([^0-9]|$)"))  }  intask { print }' "$plan" > "$out"
scripts/review-package:25来自说明文档打开原文件
if [ $# -eq 4 ]; then  out=$4else  dir=$("$(cd "$(dirname "$0")" && pwd)/sdd-workspace" "$plan")  out="$dir/review-$(git rev-parse --short "$base")..$(git rev-parse --short "$head").diff"fi
scripts/review-package:41来自说明文档打开原文件
  echo  echo "## Diff"  git diff -U10 "${base}..${head}"} > "$out"
中风险

完成后会永久删除详细审查与进度资料

原文依据：4 处
发现了什么

工作空间保存台账、任务摘要、实施报告和审查包，但最终流程执行 `rm -rf` 删除整个目录。只要求在最终消息中复制含 `Ruling:` 的台账行；其他测试输出、报告、差异包和进度记录不会被保留在 Git 历史中。

为什么需要注意

用户会失去复核测试声明、审查过程和任务决策背景所需的本地证据。若后来发现缺陷或需要合规审计，只剩代码提交和最终摘要，删除内容通常无法从 Git 恢复。

该工作空间明确存放台账、任务摘要、实施报告和审查包；最终审查及修复完成后，流程要求用 `rm -rf` 删除整个计划空间。Git 历史保留代码提交，但这些被 gitignore 的审计材料不会因此进入历史。最终消息只强制复制含 `Ruling:` 的台账行，所以其他测试输出、报告和进度记录可能永久丢失。用户可要求删除前归档必要审计材料，或明确同意其保留期限和位置。

SKILL.md:136来自说明文档打开原文件
- Each plan owns a workspace: at skill start, run this skill's  `scripts/sdd-workspace PLAN_FILE` — it prints the plan's git-ignored  directory (`<repo-root>/.superpowers/sdd/<plan-basename>/`), home to  every artifact for THIS plan: ledger, briefs, reports, review packages.  Another plan's directory is never yours to read or write.- Check for this plan's ledger at `<workspace>/progress.md`. If its first
查看另外 3 个位置
SKILL.md:473来自说明文档打开原文件
Before you delete anything, collect every ledger line containing `Ruling:` —preflight rulings, parked findings, breaker adjudications, all of them — intoyour final message under "Rulings I made", in the order you made them, eachwith what it costs if wrong. The list is exhaustive: if the ledger holds aruling, the list holds it. That list is the only place the decisions youtook on your human partner's behalf reach them — they read it and reworkwhatever you got wrong. A ruling that dies with the workspace was a decisionmade in secret.
SKILL.md:482来自说明文档打开原文件
When the final whole-branch review is clean and its fixes are merged,delete this plan's workspace (`rm -rf <workspace>`) — the git history isthe record now. Sibling directories belong to other plans; leave themalone.
scripts/sdd-workspace:11来自说明文档打开原文件
## The workspace lives in the working tree (not under .git/) because Claude Code# treats .git/ as a protected path and denies agent writes there — which blocks# an implementer subagent from writing its report file. A self-ignoring# .gitignore at .superpowers/sdd/ keeps every plan's workspace out of# `git status` and out of accidental commits without modifying any tracked file.#
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。发现 2 项风险
中风险

真实的重要缺陷可在修复上限后被搁置并继续

原文依据：3 处
发现了什么

五轮后，控制代理可以把“真实但下游不依赖”的问题记为搁置，并将任务标为完成。最终审查也只有一次修复机会，之后剩余问题由控制代理裁决，而非强制交还用户决定。

为什么需要注意

已知的正确性、安全性或可维护性缺陷可能保留在提交中，后续任务和最终分支结果仍继续推进。用户可能直到分支完成阶段才看到这些裁决。

五轮后，流程明确允许把审查者认为真实但“不承载下游”的缺陷搁置；之后任务仍可记为完成。最终审查也只有一轮修复，剩余问题由控制器裁决，仅把承载性问题在收尾选项中呈现给用户。因此一个真实的重要缺陷可能在合并前未修复，风险取决于控制器对“承载性”和严重性的判断。用户可要求任何真实的 Critical/Important 残留都必须由用户明确接受。

SKILL.md:411来自说明文档打开原文件
**The breaker.** When round 5's re-review still leaves findings open, stopdispatching. Adjudicate each open finding yourself — you hold the plan andthe cross-task context the reviewer lacks:- **The reviewer is wrong, or the point is contestable:** park it —  `Task <N>: parked — <finding> — Ruling: <why the code stands>`. The final  review sees both sides.- **Real, but nothing downstream builds on it:** park it the same way, with  a ruling that says it's real and deferred.- **Real and load-bearing** — a later task builds on it, or it reveals a  plan defect: rule on the smallest change that unblocks the dependent work,  ledger it as `Task <N>: Ruling: <finding> — <what you decided and why>`,  and carry it into the next task's dispatch. Parking a structural failure  silently lets every dependent task build on it. Stop only when the defect  leaves every path forward a guess.
查看另外 2 个位置
SKILL.md:433来自说明文档打开原文件
When the review comes back clean — or every open finding is parked with aruling at the cap — append the completion line to the ledger in the samemessage as your other bookkeeping:- `Task <N>: complete (commits <base7>..<head7>, review clean)`- `Task <N>: complete (commits <base7>..<head7>, <K> parked)` after a  tripped breakerThen mark the todo complete and move on. Never move to the next task whilethe review has open Critical/Important issues that are neither fixed norparked-with-ruling at the cap.
SKILL.md:458来自说明文档打开原文件
If the final whole-branch review returns findings, dispatch ONE fix subagentwith the complete findings list — not one fixer per finding.Per-finding fixers each rebuild context and re-run suites; a realsession's final-review fix wave cost more than all its tasks combined.Then run exactly one scoped re-review of the fix wave(`scripts/review-package PLAN_FILE FIX_BASE HEAD` over the fix range,[re-review-prompt.md](re-review-prompt.md)).Adjudicate any residual findings as in the task loop's breaker: park withrulings, or rule on the load-bearing ones and ledger what you decided. Onlythe four classes above stop you here. There is no second fix wave —residual load-bearing findings surface to your human partner whenfinishing-a-development-branch presents the options.
中风险

通过审查不代表测试结果被独立验证

原文依据：4 处
发现了什么

审查模板明确称实施者报告是“未经验证的声明”，但又禁止重新运行测试套件；只有代码阅读产生具体疑点时才运行单个聚焦测试。因此伪造、过时或误读的测试输出可能不被发现。

为什么需要注意

代码可能在测试未通过、未运行或覆盖不足的情况下获得任务质量批准，尤其是差异看起来合理但运行时行为不同的时候。

审查者被要求把实施报告视为未经验证的声明并对照差异检查，但同时不得为确认报告而重跑套件；只有代码阅读引出具体疑点时才可运行聚焦测试。这是有意的成本控制，并非完全不验证代码，但意味着伪造、过时、环境相关或被误读的测试结果可能在静态差异看不出问题时通过。用户可要求高风险变更由独立环境重跑指定测试或校验测试产物。

task-reviewer-prompt.md:64来自说明文档打开原文件
    ## Do Not Trust the Report    Treat the implementer's report as unverified claims about the code. It    may be incomplete, inaccurate, or optimistic. Verify the claims against    the diff. Design rationales in the report are claims too: "left it per    YAGNI," "kept it simple deliberately," or any other justification is the    implementer grading their own work. Judge the code on its merits — a    stated rationale never downgrades a finding's severity.
查看另外 3 个位置
task-reviewer-prompt.md:75来自说明文档打开原文件
    The implementer already ran the tests and reported results with TDD    evidence for exactly this code. Do not re-run the suite to confirm their    report. Run a test only when reading the code raises a specific doubt    that no existing run answers — and then a focused test, never a    package-wide suite, race detector run, or repeated/high-count loop. If    heavy validation seems warranted, recommend it in your report instead of    running it. If you cannot run commands in this environment, name the    test you would run.
re-review-prompt.md:66来自说明文档打开原文件
    The implementer re-ran the tests covering the amended code and appended    the results to the report file. Treat the report as unverified claims:    confirm the fix report names the covering tests and shows their output,    and verify the claims against the diff. Do not re-run the suite to    confirm their report. Run a test only when reading the code raises a    specific doubt that no existing run answers — and then a focused test,    never a package-wide suite.
task-reviewer-prompt.md:73来自说明文档打开原文件
    ## Tests    The implementer already ran the tests and reported results with TDD    evidence for exactly this code. Do not re-run the suite to confirm their    report. Run a test only when reading the code raises a specific doubt    that no existing run answers — and then a focused test, never a    package-wide suite, race detector run, or repeated/high-count loop. If    heavy validation seems warranted, recommend it in your report instead of    running it. If you cannot run commands in this environment, name the    test you would run.
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。发现 1 项风险
高风险

计划内容被直接提升为子代理的可执行指令

原文依据：4 处
发现了什么

Skill 将计划中的任务文本提取成摘要，并要求子代理把它当作包含“必须逐字使用的精确值”的需求，然后“完全按任务指定”实施和提交。实施者模板没有要求把计划内容视为不可信数据，也没有继承控制器的四类停止条件。

为什么需要注意

如果计划来自不可信来源、被篡改，或正文中夹有提示注入，子代理可能执行超出用户预期的命令、修改文件或创建提交。控制器稍后审查差异并不能保证在副作用发生前拦截它。

该流程会把所选计划中的任务原文写入摘要，并明确告诉实施子代理将其视为需求、逐字采用精确值、实施并提交。模板虽然要求遇到不清楚之处时询问，但没有要求先把计划内容当作不可信输入审查，也没有把控制器的安全停止条件传给实施者。若计划含有越权、恶意或被注入的操作，子代理可能把它当成已授权工作执行。用户可要求作者加入明确的信任边界、允许范围和实施前安全审查。

SKILL.md:251来自说明文档打开原文件
- **Task brief:** before dispatching an implementer, run this skill's  `scripts/task-brief PLAN_FILE N` — it extracts the task's full text to a  uniquely named file and prints the path. Compose the dispatch so the  brief stays the single source of  requirements. Your dispatch should contain: (1) one line on where this  task fits in the project; (2) the brief path, introduced as "read this  first — it is your requirements, with the exact values to use verbatim";  (3) interfaces and decisions from earlier tasks that the brief cannot  know; (4) your resolution of any ambiguity you noticed in the brief;  (5) the report-file path and report contract. Exact values (numbers,  magic strings, signatures, test cases) appear only in the brief. Never  make a subagent read the whole plan file.- **Report file:** name the implementer's report file after the brief
查看另外 3 个位置
implementer-prompt.md:15来自说明文档打开原文件
    Read your task brief first: [BRIEF_FILE]    It contains the full task text from the plan.
implementer-prompt.md:34来自说明文档打开原文件
    Once you're clear on requirements:    1. Implement exactly what the task specifies    2. Write tests (following TDD if task says to)    3. Verify implementation works    4. Commit your work    5. Self-review (see below)    6. Report back    Work from: [directory]    **While you work:** If you encounter something unexpected or unclear, **ask questions**.    It's always OK to pause and clarify. Don't guess or make assumptions.
SKILL.md:27来自说明文档打开原文件
Four things stop you, and only these: an irreversible or destructiveoperation; a security-sensitive action; a side effect outside this worktreethat norms say you ask about first (a merge, a push to a shared branch, apublish); and a plan so broken that every path forward is a guess. For those,stop and ask.
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

此 Skill 会把实施计划拆成任务，并为每项任务派遣实施子代理、任务审查子代理，最后再进行整分支审查。实施子代理会修改代码、运行测试并创建 Git 提交。

查看原文
SKILL.md:8来自说明文档打开原文件
Execute plan by dispatching a fresh implementer subagent per task, a task review (spec compliance + code quality) after each, and a broad whole-branch review at the end.**Why subagents:** You delegate tasks to specialized agents with isolated context. By precisely crafting their instructions and context, you ensure they stay focused and succeed at their task. They should never inherit your session's context or history — you construct exactly what they need. This also preserves your own context for coordination work.**Core principle:** Fresh subagent per task + task review (spec + quality) + broad final review = high quality, fast iteration
implementer-prompt.md:34来自说明文档打开原文件
    Once you're clear on requirements:    1. Implement exactly what the task specifies    2. Write tests (following TDD if task says to)    3. Verify implementation works    4. Commit your work    5. Self-review (see below)    6. Report back

三个脚本会在仓库内的 `.superpowers/sdd/<计划基本名>/` 下创建任务摘要、审查差异和进度记录；审查包包含指定 Git 范围的提交列表、统计和完整差异。

查看原文
scripts/sdd-workspace:31来自说明文档打开原文件
slug=$(basename "$plan" .md)[ -n "$slug" ] && [ "$slug" != "." ] && [ "$slug" != ".." ] \  || { echo "cannot derive a workspace name from: $plan" >&2; exit 2; }root=$(git rev-parse --show-toplevel)base="$root/.superpowers/sdd"dir="$base/$slug"mkdir -p "$dir"printf '*\n' > "$base/.gitignore"cd "$dir" && pwd
scripts/review-package:32来自说明文档打开原文件
{  echo "# Review package: ${base}..${head}"  echo  echo "## Commits"  git log --oneline "${base}..${head}"  echo  echo "## Files changed"  git diff --stat "${base}..${head}"  echo  echo "## Diff"  git diff -U10 "${base}..${head}"} > "$out"

审查代理通常不重新运行完整测试，而是检查实施者报告中的测试输出和代码差异；只有发现具体疑点时才允许运行聚焦测试。

查看原文
task-reviewer-prompt.md:75来自说明文档打开原文件
    The implementer already ran the tests and reported results with TDD    evidence for exactly this code. Do not re-run the suite to confirm their    report. Run a test only when reading the code raises a specific doubt    that no existing run answers — and then a focused test, never a    package-wide suite, race detector run, or repeated/high-count loop. If    heavy validation seems warranted, recommend it in your report instead of    running it. If you cannot run commands in this environment, name the    test you would run.
re-review-prompt.md:66来自说明文档打开原文件
    The implementer re-ran the tests covering the amended code and appended    the results to the report file. Treat the report as unverified claims:    confirm the fix report names the covering tests and shows their output,    and verify the claims against the diff. Do not re-run the suite to    confirm their report. Run a test only when reading the code raises a    specific doubt that no existing run answers — and then a focused test,    never a package-wide suite.

流程允许控制代理对计划冲突和审查意见作出裁决，并在最多五轮修复后将某些未解决问题记入台账继续执行；结束时会删除该计划的工作空间。

查看原文
SKILL.md:411来自说明文档打开原文件
**The breaker.** When round 5's re-review still leaves findings open, stopdispatching. Adjudicate each open finding yourself — you hold the plan andthe cross-task context the reviewer lacks:- **The reviewer is wrong, or the point is contestable:** park it —  `Task <N>: parked — <finding> — Ruling: <why the code stands>`. The final  review sees both sides.- **Real, but nothing downstream builds on it:** park it the same way, with  a ruling that says it's real and deferred.- **Real and load-bearing** — a later task builds on it, or it reveals a  plan defect: rule on the smallest change that unblocks the dependent work,  ledger it as `Task <N>: Ruling: <finding> — <what you decided and why>`,  and carry it into the next task's dispatch. Parking a structural failure  silently lets every dependent task build on it. Stop only when the defect  leaves every path forward a guess.
SKILL.md:482来自说明文档打开原文件
When the final whole-branch review is clean and its fixes are merged,delete this plan's workspace (`rm -rf <workspace>`) — the git history isthe record now. Sibling directories belong to other plans; leave themalone.
从这里开始 · 工作说明SKILL.md
subagent-driven-development
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 1 个章节，可在原文件中查看。

文件引用关系图

3 处引用
哪些文件发起引用引用了什么
连线表示真实的文件引用，不是运行顺序。点击节点可高亮相关连线，并查看具体文件和原文位置。虚线表示还有文件需要定位。
文件与检查记录7 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文
  • scripts/review-package已纳入全文
  • scripts/sdd-workspace已纳入全文
  • scripts/task-brief已纳入全文
  • implementer-prompt.md已纳入全文
  • re-review-prompt.md已纳入全文
  • task-reviewer-prompt.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
  • implementer-prompt.md配套文件
  • re-review-prompt.md配套文件
  • scripts/review-package配套文件
  • scripts/sdd-workspace配套文件
  • scripts/task-brief配套文件
  • task-reviewer-prompt.md配套文件

代码和说明中提到的操作

运行命令
SKILL.md:318来自说明文档打开原文件
  `scripts/review-package PLAN_FILE BASE HEAD` and pass the reviewer the file path  it prints (or, without bash: `git log --oneline`, `git diff --stat`,  and `git diff -U10` for the range, redirected to one uniquely named
scripts/review-package:1来自说明文档打开原文件
#!/usr/bin/env bash# Generate a review package: commit list, stat summary, and the net
scripts/sdd-workspace:1来自说明文档打开原文件
#!/usr/bin/env bash# Resolve and ensure the working-tree directory SDD uses for one plan's
读取文件
SKILL.md:384来自说明文档打开原文件
findings, and this framing: "A prior implementer attempted this task[N] times; you own it now. Read the report file for what was tried." A loopthat survives three resumes usually means the implementer cannot see its
SKILL.md:509来自说明文档打开原文件
[Setup: worktree verified][Read plan file once: docs/superpowers/plans/feature-plan.md][Resolve workspace: scripts/sdd-workspace docs/superpowers/plans/feature-plan.md — no ledger inside, fresh start]
implementer-prompt.md:85来自说明文档打开原文件
    - The task involves restructuring existing code in ways the plan didn't anticipate    - You've been reading file after file trying to understand the system without progress
修改文件
SKILL.md:483来自说明文档打开原文件
When the final whole-branch review is clean and its fixes are merged,delete this plan's workspace (`rm -rf <workspace>`) — the git history isthe record now. Sibling directories belong to other plans; leave them
读取了多少行
1,178
文件校验值（用于核对版本）
bf1d87234bb7ed340307d54567bf15189a4f27cbfe8ae83ea304d22b93424cf4