跳转到正文
skillsafebeta
← 报告库
用途分类 / 其他用途

Write Product Spec Skill 安全审计

作者说它能做什么（原文）

Write a PRODUCT.md spec for a significant user-facing feature in Warp, focused on detailed behavior and validation. Use when the user asks for a product spec, desired behavior doc, or PRD, wants to define feature behavior before implementation, or when the feature is substantial or behaviorally ambiguous enough that a written spec would improve implementation or review.

第三方安全检查结论

这次检查未发现明显风险

已检查文件
1
发现的风险
0
会不会运行危险命令？检查是否下载程序后直接运行、让他人远程控制电脑，或藏起要运行的命令。未发现风险
会不会泄露文件和密钥？检查是否发送含密码或密钥的文件，以及代码里是否直接写了密钥。未发现风险
会不会删除文件或一直在后台运行？检查是否大范围删除文件、改写磁盘，或设置自动启动。未发现风险
会不会绕过安全保护？检查是否跳过网站安全验证、开放过多文件权限，或取消操作前的确认。未发现风险
会不会误导 AI 或隐藏内容？检查工作说明是否要求 AI 忽略你的指令、干扰检查结果，或夹带看不见的文字。未发现风险
会不会偷偷改推广链接或收款方？检查是否强制替换推广链接或收款对象，同时要求隐瞒更改。未发现风险

Skill 逻辑拆解

8 个说明模块

该 Skill 的主要作用是为重要功能编写面向用户行为的 PRODUCT.md，明确禁止在其中加入内部类型、算法或其他实现细节。

查看原文
SKILL.md:8来自说明文档打开原文件
Write a `PRODUCT.md` spec for a significant feature in Warp.## OverviewThe product spec should make the desired behavior unambiguous enough that an agent can implement it correctly and avoid regressions. Describe the feature purely from the user's perspective — what the user sees, does, and experiences, and the invariants that must hold for them. Do not include implementation details (internal types, state layout, module boundaries, data flow, algorithms).

它会在 specs/<id>/PRODUCT.md 创建或维护持久文件；目录 ID 来自 Linear 工单、GitHub issue 或用户提供的功能名称。

查看原文
SKILL.md:25来自说明文档打开原文件
Write specs to `specs/<id>/PRODUCT.md`, where `<id>` is one of:- a Linear ticket number (e.g. `specs/APP-1234/PRODUCT.md`)- a GitHub issue id, prefixed with `gh-` (e.g. `specs/gh-4567/PRODUCT.md`)- a short kebab-case feature name (e.g. `specs/vertical-tabs-hover-sidecar/PRODUCT.md`)`specs/` should contain only id-named directories as direct children — no engineer-named subdirectories.
SKILL.md:102来自说明文档打开原文件
## Keep the spec currentApproved specs may ship in the same PR as the implementation. As implementation evolves, update `PRODUCT.md` in the same PR when user-facing behavior or UX details change. The checked-in spec should describe the feature that actually ships.

对于有界面或交互设计的功能，它要求先询问是否存在 Figma mock，并在规格中记录提供的链接；纯后端功能不询问。

查看原文
SKILL.md:41来自说明文档打开原文件
If the feature has any UI or interaction design, ask the user whether a Figma mock exists before drafting the Behavior section, and include the link in the spec when one is provided. A mock is often the most reliable source of truth for visual states, spacing, and edge-case layouts — not asking can cause the Behavior section to guess at intent the designer already settled.- If the user provides a link, include it under a short `## Figma` section (or inline near the top of Behavior) as `Figma: <link>`.- If the user confirms no mock exists, note `Figma: none provided` so the absence is explicit rather than ambiguous.- If the feature is purely backend (data model, API, CLI with no visual surface), skip the question and omit the section.

该 Skill 提及可能使用 Linear MCP 或 gh 创建外部工单，但明确限制为只有用户主动要求时才可创建，并在团队、标签或仓库不明确时要求澄清。

查看原文
SKILL.md:33来自说明文档打开原文件
Ticket / issue references are optional. If the user has a Linear ticket or GitHub issue, use its id. If they don't, ask them for a feature name to use as the directory. Only create a new Linear ticket or GitHub issue when the user explicitly asks for one; in that case use the Linear MCP tools or `gh` CLI respectively (and `ask_user_question` if team, labels, or repo are unclear).
从这里开始 · 工作说明SKILL.md
write-product-spec
连线表示工作说明包含的模块，不是实际运行顺序。点击模块可查看原文。 另有 1 个章节，可在原文件中查看。
文件与检查记录1 个文件

检查范围与遗漏

逐文件查看涉及的内容

下方列出本次涉及的原文范围；纳入检查不代表已查清所有问题。

  • SKILL.md已纳入全文

这份报告只针对上方版本。我们看了拿到的代码和说明文件，没有实际运行 Skill，也没有检查它另外安装的软件包。因此，这不是“保证安全”的承诺；换了版本或使用环境，结果也可能不同。

  • SKILL.md工作说明
读取了多少行
165
文件校验值（用于核对版本）
4e7ef781aad1cd42e3178680f6e9d72de439d66c1b99023e4386103065a5fb19