القائمة
在安装来自外部 URL / GitHub / 他人分享的 SKILL.md 之前， 对其内容做安全性和质量审查，输出审查报告和安装建议。
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Fetch and summarise recent papers from arxiv.org. Use this skill when the user wants a digest of today's or this week's cs.AI / cs.LG / cs.CL listings, a focused per-topic roundup, or a quick look at a specific submission.
Lightweight code-review checklist the agent runs before declaring a patch ready. Catches the obvious classes of issue (dead code, missing error handling, weakened tests) without a full security audit. Adapted from addyosmani's "Review" lifecycle phase.
Root-cause-first debugging loop for code or runtime errors: understand the failure before proposing a fix. Adapted from Hermes' systematic- debugging — same iron law, smaller surface, ZLAgent-tool-aware.
Do not declare a task done without running verification. For code, that means running tests / smoke; for answers, that means checking the claim against a fresh source. Adapted from obra/superpowers and addyosmani's "Verify" lifecycle phase.
Umbrella skill for user document workflows — PDF, Word, Excel, PowerPoint, text extraction, summarization. Dispatches to the right MCP / tool; proposes an install via mcp-discovery when no local capability fits. Adapted from Anthropic's docx/pdf/xlsx/pptx skills.
When the user wants something the agent doesn't have a tool for yet (travel planning, GitHub issues, Linear, weather, filesystem, ...), search the live MCP ecosystem for an existing server, propose installing it, and on confirm wire it up via mcp_manage. Adapted from Hermes' mcporter skill — same flow, ZLAgent-tool-aware.
| name | skill-vetter |
| description | 在安装来自外部 URL / GitHub / 他人分享的 SKILL.md 之前， 对其内容做安全性和质量审查，输出审查报告和安装建议。 |
| version | 0.1.0 |
| tags | ["meta","security","skills"] |
| metadata | {"zlagent":{"category":"meta","triggers":["审查这个 skill","这个 skill 安全吗","帮我检查一下这个技能","vet this skill","安装前先检查","skill 安全审查"],"capabilities":["read_url"],"related_skills":["skill-authoring","mcp-discovery"]}} |
在把外部 skill 安装进 ZLAgent 之前，提供一份明确的安全和质量报告， 让用户知道"这个 skill 会做什么"以及"有没有风险"。
不属于本 skill 的范围：
正向触发：
反向排除：
skill_manage action='read' 查即可获取 skill 内容：
read_url 拉取，失败则停止并报告结构检查（必须全通过才继续）：
--- 开头 + 结尾）name 和 description 字段安全检查（任一命中即标记 ⚠️）：
exec、subprocess、os.system、eval、shellwrite_file 写入 backend/、.env、系统路径质量检查（命中则标记 ⚠️，不阻止安装）：
输出审查报告（见下文 Output 格式）。
给出安装建议：
审查报告格式：
📋 Skill 审查报告
名称：<name>
来源：<url 或 "粘贴内容">
结构检查：✅ 通过 / ❌ 失败
- [具体问题（如有）]
安全检查：✅ 通过 / ⚠️ 发现风险
- ⚠️ [风险描述]
质量检查：✅ 通过 / ⚠️ 建议改进
- ⚠️ [改进建议]
安装建议：建议安装 / 建议拒绝 / 可以安装但注意
偏差信号：
exec → 重新扫描步骤 3