Habilidades Command Development
📦

Command Development

v0.2.0 Revisão do conteúdo r1 Risco Médio ⚙️ Comandos externos📁 Acesso ao sistema de arquivos🌐 Acesso à rede

Criar comandos de barra do Claude Code

Criar comandos de barra fiáveis requer uma estrutura clara, escolhas seguras de ferramentas e argumentos úteis. Esta skill fornece padrões para ficheiros de comando, frontmatter, referências, contexto bash, plugins e testes.

Suporta: Claude Codex Code(CC)
⚠️ 50 Ruim

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente
Review the Skillstore skill "Command Development" from https://skillstore.io/skills/command-development.md and its manifest at https://skillstore.io/api/skills/command-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/command-development.md manifest assinado GET /api/skills/command-development/manifest lockfile assinado GET /api/skills/command-development/lockfile

Testar

Usando "Command Development". Crie um comando que reveja alterações staged antes do commit.

Resultado esperado:

A skill proporia um comando de projeto com uma descrição clara, acesso restrito a ferramentas git, contexto de alterações staged e critérios de revisão.

Usando "Command Development". Documente um comando de deploy existente para revisão no marketplace.

Resultado esperado:

A skill delinearia argumentos obrigatórios, ferramentas permitidas, verificações de segurança, saída esperada, notas de resolução de problemas e documentação orientada ao utilizador.

Usando "Command Development". Crie um comando de plugin que chama um analisador empacotado.

Resultado esperado:

A skill recomendaria um padrão de comando de plugin que referencia a raiz do plugin, valida entradas, executa o analisador e comunica resultados.

Auditoria de segurança

Risco Médio
v9 • 19/07/2026 Abrir o relatório versionado

Most static detections are Markdown formatting, expected Claude paths, test syntax, or documentation links. Multiple executable templates directly interpolate positional arguments into shell text, creating command-injection risk. Predictable temporary files and repeated Bash(*) grants add avoidable exposure, but no prompt injection or covert exfiltration intent was found. Static review was capped at 400/429 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.

11
Arquivos analisados
7,237
Linhas analisadas
41
Itens de revisão
0
Falsos positivos ignorados

Preocupações de segurança confirmadas (1)

Médio
SKILL.md:608SKILL.md:635SKILL.md:811
Overbroad Shell Permissions in Reusable Templates
Several reusable examples grant Bash(*) despite the skill recommending narrow permissions. Generated commands could therefore run shell operations beyond their stated workflow.
The unrestricted Bash grants are explicit and repeated in reusable command templates. The risk is partially mitigated by separate guidance favoring narrow permissions.
Itens de revisão de capacidade (41)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto
examples/plugin-commands.md:35-42
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/quality-check.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:68-71
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/security-scan.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:71-74
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/perf-analyze.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:74-81
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/best-practices.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:144-147
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/pre-release-check.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:147-150
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build-release.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:153-161
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/package.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:307-336
Ruby/shell backtick execution
Run plugin analyzer: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:359-361
Ruby/shell backtick execution
Validate environment argument: !`echo "$1" | grep -E "^(dev|staging|prod)$" && echo "VALID" || echo
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:363-369
Ruby/shell backtick execution
Verify configuration available: !`test -f ${CLAUDE_PLUGIN_ROOT}/config/$1.json && echo "FOUND" || ec
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:369-371
Ruby/shell backtick execution
**Execute build:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh $1 2>&1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:371-380
Ruby/shell backtick execution
**Validation results:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/validate-build.sh $1 2>&1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:408-411
Ruby/shell backtick execution
Determine check level: !`echo "$1" | grep -E "^prod$" && echo "FULL" || echo "BASIC"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:441-442
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/script-name.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:471-472
Ruby/shell backtick execution
Validate input: !`echo "$1" | grep -E "^pattern$" && echo "OK" || echo "ERROR"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/plugin-commands.md:541-543
Ruby/shell backtick execution
Validate: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
examples/simple-commands.md:100-109
Ruby/shell backtick execution
Test execution: !`npm test $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/advanced-workflows.md:25-28
Ruby/shell backtick execution
!`gh pr view $1 --json title,body,author,files`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/advanced-workflows.md:28-36
Ruby/shell backtick execution
Files changed: !`gh pr diff $1 --name-only`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/advanced-workflows.md:36-56
Ruby/shell backtick execution
Test status: !`gh pr checks $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/frontmatter-reference.md:405-414
Ruby/shell backtick execution
Deployment details: !`gh api /deployments/$1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:119-122
Ruby/shell backtick execution
Lint results: !`node ${CLAUDE_PLUGIN_ROOT}/bin/lint.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:157-159
Ruby/shell backtick execution
Step 1 - Prepare: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/prepare.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:159-162
Ruby/shell backtick execution
Step 3 - Execute: !`${CLAUDE_PLUGIN_ROOT}/bin/execute $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:201-202
Ruby/shell backtick execution
Run: !`${CLAUDE_PLUGIN_ROOT}/bin/process.sh $1 $2`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:302-306
Ruby/shell backtick execution
Environment check: !`echo "Deploying to: $1"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:395-397
Ruby/shell backtick execution
Stage changes: !\`git add $1\`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:397-401
Ruby/shell backtick execution
Commit changes: !\`git commit -m "$2"\`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:423-435
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/lint.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:451-457
Ruby/shell backtick execution
Validate environment: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:474-482
Ruby/shell backtick execution
Check file: !`test -f $1 && echo "EXISTS" || echo "MISSING"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:494-500
Ruby/shell backtick execution
Validate inputs: !`test -n "$1" -a -n "$2" && echo "OK" || echo "MISSING"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
references/plugin-features-reference.md:551-561
Ruby/shell backtick execution
Try processing: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/process.js $1 2>&1 || echo "ERROR: $?"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
SKILL.md:464-467
Ruby/shell backtick execution
Run tests: !`npm test $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
SKILL.md:496-500
Ruby/shell backtick execution
1. Fetch PR: !`gh pr view $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Alto
SKILL.md:547-550
Ruby/shell backtick execution
Run analysis: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
Médio
references/testing-strategies.md:222
Temp directory access
echo "Test content" > /tmp/test-file.txt
The example writes to a predictable shared /tmp filename without exclusive creation. A preexisting symlink could redirect the write and clobber another file.
Médio
references/testing-strategies.md:223
Temp directory access
echo "Second file" > /tmp/test-file-2.txt
The example writes to a predictable shared /tmp filename without exclusive creation. A preexisting symlink could redirect the write and clobber another file.
Médio
references/testing-strategies.md:238
Temp directory access
dd if=/dev/zero of=/tmp/large-file.bin bs=1M count=100
The test writes 100 MB to a fixed path under /tmp using /dev/zero. This can follow a preexisting symlink, overwrite data, or consume unnecessary disk space.
Médio
references/testing-strategies.md:243
Temp directory access
rm /tmp/test-file*.txt /tmp/large-file.bin
The cleanup uses a wildcard under a shared temporary directory. It can delete unrelated matching files created by another process or user.
Médio
references/testing-strategies.md:238
Standard device file access
dd if=/dev/zero of=/tmp/large-file.bin bs=1M count=100
The test writes 100 MB to a fixed path under /tmp using /dev/zero. This can follow a preexisting symlink, overwrite data, or consume unnecessary disk space.

Fatores de risco

⚙️ Comandos externos (50)
examples/plugin-commands.md:35-42 examples/plugin-commands.md:68-71 examples/plugin-commands.md:71-74 examples/plugin-commands.md:74-81 examples/plugin-commands.md:144-147 examples/plugin-commands.md:147-150 examples/plugin-commands.md:150-153 examples/plugin-commands.md:153-161 examples/plugin-commands.md:186-188 examples/plugin-commands.md:188-202 examples/plugin-commands.md:307-336 examples/plugin-commands.md:359-361 examples/plugin-commands.md:361-363 examples/plugin-commands.md:363-369 examples/plugin-commands.md:369-371 examples/plugin-commands.md:371-380 examples/plugin-commands.md:408-411 examples/plugin-commands.md:411-412 examples/plugin-commands.md:412-413 examples/plugin-commands.md:413-414 examples/plugin-commands.md:414-417 examples/plugin-commands.md:417-418 examples/plugin-commands.md:418-427 examples/plugin-commands.md:441-442 examples/plugin-commands.md:471-472 examples/plugin-commands.md:477-478 examples/plugin-commands.md:496-497 examples/plugin-commands.md:508-509 examples/plugin-commands.md:509-510 examples/plugin-commands.md:517-520 examples/plugin-commands.md:520-521 examples/plugin-commands.md:526-532 examples/plugin-commands.md:532-533 examples/plugin-commands.md:541-543 examples/simple-commands.md:100-109 examples/simple-commands.md:175-177 examples/simple-commands.md:177-179 examples/simple-commands.md:179-181 examples/simple-commands.md:181-187 examples/simple-commands.md:212-225 examples/simple-commands.md:431-433 examples/simple-commands.md:488-492 README.md:127-128 README.md:200-201 README.md:201-202 references/advanced-workflows.md:25-28 references/advanced-workflows.md:28-36 references/advanced-workflows.md:36-56 references/advanced-workflows.md:78-79 references/advanced-workflows.md:79-81
📁 Acesso ao sistema de arquivos (29)
examples/plugin-commands.md:548 README.md:133 README.md:133 references/advanced-workflows.md:483 references/documentation-patterns.md:129 references/documentation-patterns.md:379 references/marketplace-considerations.md:42 references/marketplace-considerations.md:55 references/marketplace-considerations.md:57 references/marketplace-considerations.md:59 references/marketplace-considerations.md:88 references/marketplace-considerations.md:143 references/marketplace-considerations.md:147 references/marketplace-considerations.md:704 references/testing-strategies.md:481 references/testing-strategies.md:152 references/testing-strategies.md:152 references/testing-strategies.md:238 references/testing-strategies.md:495 references/testing-strategies.md:222 references/testing-strategies.md:223 references/testing-strategies.md:226 references/testing-strategies.md:230 references/testing-strategies.md:234 references/testing-strategies.md:238 references/testing-strategies.md:239 references/testing-strategies.md:243 SKILL.md:63 SKILL.md:63
🌐 Acesso à rede (8)
references/documentation-patterns.md:684 references/documentation-patterns.md:685 references/marketplace-considerations.md:97 references/marketplace-considerations.md:98 references/marketplace-considerations.md:99 references/marketplace-considerations.md:636 references/marketplace-considerations.md:638 references/marketplace-considerations.md:872
Auditado por: codex Ver histórico de auditoria →
Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado
Avaliação de Segurança

Copiar link do relatório

https://skillstore.io/skills/command-development/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/command-development/security.svg)](https://skillstore.io/skills/command-development?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/command-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/command-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/command-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

anthropics. (2026). Command Development security audit report (audit version 9) [Author version 0.2.0]. Skillstore. https://skillstore.io/skills/command-development/audits/9

Citação BibTeX

@techreport{anthropics-command-development-2026, author = {anthropics}, title = {Command Development security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/command-development/audits/9}, note = {Author version 0.2.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "Command Development security audit report (audit version 9)" version: "0.2.0" type: report authors: - name: "anthropics" date-released: "2026-07-19" url: "https://skillstore.io/skills/command-development/audits/9" identifiers: - type: other value: "skillstore:command-development:audit:9" description: "Skillstore immutable audit report identifier"

Comparar variantes

3 variantes instaláveis

Cada autor permanece como um skill instalável separado. A variante recomendada é classificada pelas evidências do Skillstore.

Por que esta variante está em primeiro

Maior pontuação do Skillstore
anthropics Recomendado

anthropics-command-development

Pontuação do Skillstore 76
Confiança das evidências Médio
Uso no Skillstore 8
Atualizado

2026-09-09

anthropics Atual

command-development

Pontuação do Skillstore 50
Confiança das evidências Alto
Uso no Skillstore 18
Atualizado

2026-09-09

davila7

davila7-command-development

Pontuação do Skillstore 50
Confiança das evidências Médio
Uso no Skillstore 9
Atualizado

2026-09-09

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Alto
59
Arquitetura
100
Manutenibilidade
87
Conteúdo
82
Comunidade
65
Conformidade com a especificação

O que você pode criar

Criar comandos de revisão para equipas

Crie comandos de revisão reutilizáveis que padronizam verificações de qualidade de código, testes e documentação em todo um repositório.

Empacotar comandos de plugin

Desenhe comandos de plugin que referenciam scripts, modelos, ficheiros de configuração, agentes e skills incluídos.

Melhorar a documentação de comandos

Documente argumentos, acesso a ferramentas, exemplos, saída esperada e passos de resolução de problemas para comandos de barra existentes.

Teste estes prompts

Criar comando básico 
Crie um comando de barra simples do Claude Code para [task]. Inclua a localização de ficheiro recomendada, uma descrição curta, o corpo do comando e um exemplo de uso.
Adicionar argumentos e ferramentas 
Desenhe um comando de barra para [workflow] que aceite [arguments]. Recomende definições seguras de allowed-tools e explique como cada argumento é usado.
Criar comando de plugin 
Crie um comando de barra de plugin para [plugin feature]. Referencie modelos ou scripts incluídos, defina entradas esperadas e inclua orientação de validação.
Desenhar fluxo de trabalho interativo 
Desenhe um comando interativo do Claude Code para [multi-step workflow]. Inclua perguntas para informações em falta, pontos de confirmação, tratamento de erros e orientação de testes.

Boas práticas

  • Use a definição allowed-tools mais restrita que suporte o fluxo de trabalho do comando.
  • Documente argumentos, entradas esperadas e comportamento em caso de falha antes de adicionar lógica complexa.
  • Teste comandos com argumentos em falta, ficheiros inválidos e limites de permissões antes de partilhar.

Evitar

  • Não use acesso shell irrestrito quando um filtro de comandos mais restrito é suficiente.
  • Não interpole argumentos do utilizador em comandos shell sem validação.
  • Não crie comandos que ocultam ações destrutivas atrás de descrições vagas.

Perguntas frequentes

O que esta skill me ajuda a criar?
Ajuda-o a desenhar comandos de barra do Claude Code, incluindo estrutura, frontmatter, argumentos, referências a ficheiros e padrões de plugin.
Pode criar comandos tanto para projetos como para plugins?
Sim. Abrange comandos de projeto, comandos pessoais e comandos de plugin com recursos incluídos.
Suporta comandos interativos?
Sim. Inclui orientação para comandos que fazem perguntas, confirmam decisões e tratam informações em falta.
Executa comandos shell por si só?
Não. Documenta padrões de comandos. Qualquer comando gerado que use ferramentas shell ainda depende das permissões do Claude Code.
Como devo usar os exemplos bash em segurança?
Prefira filtros de ferramentas restritos, valide argumentos, coloque entradas shell entre aspas quando necessário e evite comandos destrutivos.
Isto pode ajudar a preparar um comando para publicação?
Sim. Inclui considerações de documentação, testes e marketplace para autores de comandos.

Detalhes do desenvolvedor

Licença

MIT

Versão do autor

v0.2.0

Revisão da Skillstore

r1

Repositório

https://github.com/anthropics/claude-code/tree/main/plugins/plugin-dev/skills/command-development

Referência

1b5b6c4962b2ad5a7a34603cab2685bbbd1b61ef

Atualidade da manutenção

26/07/2026

Uso

14 downloads · 1056 visualizações

Estrutura de arquivos

📁 examples/

📄 plugin-commands.md

📄 simple-commands.md

📄 README.md

📁 references/

📄 advanced-workflows.md

📄 documentation-patterns.md

📄 frontmatter-reference.md

📄 interactive-commands.md

📄 marketplace-considerations.md

📄 plugin-features-reference.md

📄 testing-strategies.md

📄 SKILL.md

Mais de anthropics

Ver tudo

Habilidades relacionadas

Ver tudo