القائمة
审计 skill 的安全风险。扫描凭据泄露、危险命令、网络外传、文件越界等问题。用于：(1) 安装新 skill 前的安全检查 (2) 定期审计现有 skills (3) 发布 skill 前的自检。触发词：skill 安全、审计、security audit、检查 skill。
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
| name | skill-security-audit |
| description | 审计 skill 的安全风险。扫描凭据泄露、危险命令、网络外传、文件越界等问题。用于：(1) 安装新 skill 前的安全检查 (2) 定期审计现有 skills (3) 发布 skill 前的自检。触发词：skill 安全、审计、security audit、检查 skill。 |
审计 skills 目录中的安全风险，生成报告。
# 替代 clawdhub install，自动审计
bash skills/skill-security-audit/scripts/safe-install.sh weather
# 安装指定版本
bash skills/skill-security-audit/scripts/safe-install.sh my-skill --version 1.2.3
# 有警告也强制安装
bash skills/skill-security-audit/scripts/safe-install.sh risky-skill --force
# 替代 clawdhub publish，发布前审计
bash skills/skill-security-audit/scripts/safe-publish.sh ./my-skill --slug my-skill --version 1.0.0
# CRITICAL 问题会阻止发布，无法绕过
# 审计单个 skill
bash skills/skill-security-audit/scripts/audit.sh skills/target-skill
# 审计所有 skills
bash skills/skill-security-audit/scripts/audit.sh skills/
# 包含文档文件（更严格）
bash skills/skill-security-audit/scripts/audit.sh skills/ --include-docs
# 输出 JSON（给程序用）
bash skills/skill-security-audit/scripts/audit.sh skills/ --json
| 类别 | 严重程度 | 检测内容 |
|---|---|---|
| 凭据泄露 | 🔴 CRITICAL | OpenAI/Anthropic/AWS/GitHub/Google/Slack API key |
| JWT Token | 🔴 CRITICAL | 长 JWT token（100+字符，可能是真实凭据） |
| 数据库凭据 | 🔴 CRITICAL | MongoDB/MySQL/Postgres/Redis 连接串含密码 |
| 私钥 | 🔴 CRITICAL | RSA/DSA/EC/PGP 私钥 |
| 硬编码 Cookie | 🟠 HIGH | a1/web_session/id_token 等 cookie 值 |
| 硬编码密码 | 🟠 HIGH | password/secret/api_key 硬编码值 |
| 危险命令 | 🟠 HIGH | rm -rf、eval()、curl | bash |
| 敏感目录 | 🟠 HIGH | ~/.ssh、~/.aws、/etc/passwd |
| sudo | 🟡 MEDIUM | sudo 命令（权限提升） |
| 网络请求 | 🟡 MEDIUM | HTTP 到非白名单域名 |
| 权限问题 | 🟡 MEDIUM | chmod 777 |
| 依赖风险 | 🟢 LOW | 未锁定版本的依赖 |
| 问题级别 | 默认行为 | 可覆盖 |
|---|---|---|
| CRITICAL | ❌ 阻止安装 | --allow-critical（危险！） |
| HIGH/MEDIUM | ⚠️ 询问确认 | --force |
| LOW | ✅ 允许 | - |
| 问题级别 | 默认行为 | 可覆盖 |
|---|---|---|
| CRITICAL | ❌ 阻止发布 | 不可覆盖 |
| HIGH | ⚠️ 询问确认 | --force |
| MEDIUM | ⚠️ 询问确认 | --force |
| LOW | ✅ 允许 | - |
# security-audit: ignore-next-line
EXAMPLE_KEY="sk-test-not-real-key-for-documentation"
创建 .security-audit-ignore：
scripts/test_*.sh
references/examples/*
assets/*
skill-security-audit/
├── SKILL.md
├── scripts/
│ ├── audit.sh # 核心审计脚本
│ ├── safe-install.sh # 安全安装 wrapper
│ └── safe-publish.sh # 安全发布 wrapper
└── references/
└── detection-rules.md # 检测规则详情
# 添加到 ~/.bashrc 或 ~/.zshrc
alias skill-install='bash ~/clawd/skills/skill-security-audit/scripts/safe-install.sh'
alias skill-publish='bash ~/clawd/skills/skill-security-audit/scripts/safe-publish.sh'
alias skill-audit='bash ~/clawd/skills/skill-security-audit/scripts/audit.sh'
# 使用
skill-install weather
skill-publish ./my-skill --slug my-skill
skill-audit skills/
AI 图片生成。支持豆包 Seedream（火山方舟）和 Pollinations（免费备选）。文生图、图生图、组图生成。
给万物打品味分。基于 Rubrics+ 评分体系，从设计(Design)、原创性(Originality)、工艺(Craft)、功能性(Functionality) 四个维度为任何事物评分（1-4分）。支持动态权重调整。适用于：评价网站、App、产品设计、代码架构、穿搭、家居、食物摆盘、海报、PPT、任何你想打分的东西。触发词：品味打分、taste score、打个分、评分、品味评价、rubrics。
Game design coach — guide users from a one-line idea to a high-quality OpenGame prompt step by step. Trigger when user says "design a game", "game idea", "help me think of a game", "game design", "refine prompt", etc.
AI Development Lifecycle — standardized, version-driven workflow for AI agents developing on codebases. Two modes: (1) Assisted: human drives each phase decision. (2) Autonomous: agent self-directs (declare in task context). On first use, agent analyzes project and generates OPERATIONS.md at root. Each task follows 7 phases: orientation (mandatory summary), design, scratch validation, implementation, testing, documentation, commit. Progress tracked in version log. Use when starting any coding task, refactoring, or bugfix on a codebase.
Analyze and restructure bloated SKILL.md files into a lean three-layer architecture (必读/按需/示例). Use when (1) a SKILL.md exceeds 150 lines or feels cluttered, (2) designing a new skill and wanting the right structure from the start, (3) auditing all skills for context efficiency. Triggers on：skill 瘦身、skill 太长、精简 skill、slim skill、optimize skill structure.
Interact with Jike (即刻) social network — QR login, feed reading, posting, commenting, searching, and user profile lookup. Use when Claude needs to: (1) Log into Jike via QR code scan, (2) Read following/discovery feeds, (3) Create, read, or delete posts, (4) Add or remove comments, (5) Search content or users, (6) Check notifications. Triggers on: "jike", "即刻", "刷即刻", "发即刻", "jike feed", "jike post".