المهارات when-creating-skill-template-use-skill-builder

📦

when-creating-skill-template-use-skill-builder

Name: when-creating-skill-template-use-skill-builder
Author: DNYoussef

v1.0.0 مراجعة المحتوى r1 مخاطر متوسطة ⚙️ الأوامر الخارجية📁 الوصول إلى نظام الملفات

Criar Modelos de Skills do Claude Code

Criar skills de IA reutilizáveis exige arquivos e metadados consistentes. Esta skill orienta o Claude Code e o Codex por meio de um fluxo de trabalho estruturado baseado em modelos.

يدعم: Claude Codex Code(CC)

📊 71 كافٍ

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل

Review the Skillstore skill "when-creating-skill-template-use-skill-builder" from https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-creating-skill-template-use-skill-builder/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/dnyoussef-when-creating-skill-template-use-skill-builder.md manifest موقَّع GET /api/skills/dnyoussef-when-creating-skill-template-use-skill-builder/manifest lockfile موقَّع GET /api/skills/dnyoussef-when-creating-skill-template-use-skill-builder/lockfile

اختبرها

جارٍ استخدام "when-creating-skill-template-use-skill-builder". Um usuário pede um modelo de skill para geração de notas de lançamento.

النتيجة المتوقعة:

Um esboço de SKILL.md com metadados, gatilhos, fases e critérios de validação.
Uma seção de início rápido em README.md para o fluxo de trabalho de notas de lançamento.
Um resumo do fluxo de trabalho em PROCESS.md e um plano de diagrama.

جارٍ استخدام "when-creating-skill-template-use-skill-builder". Um usuário fornece um fluxo de trabalho e pede orientações de validação.

النتيجة المتوقعة:

Uma checklist para validade do YAML, arquivos obrigatórios, completude da documentação e comportamento de dry-run.
Avisos para revisar comandos locais antes da execução.
Métricas de sucesso sugeridas para a skill gerada.

جارٍ استخدام "when-creating-skill-template-use-skill-builder". Uma equipe quer uma estrutura consistente para skills de IA internas.

النتيجة المتوقعة:

A skill produz um processo de criação reutilizável com regras de nomenclatura, campos de metadados, expectativas de arquivos e pontos de verificação de revisão.

التدقيق الأمني

مخاطر متوسطة

v9 • ٥‏/٧‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

Most static findings are false positives caused by Markdown fences, JavaScript template literals, checklist text, and identifiers such as phase.key. The meaningful risk is that the skill guides users to run npx claude-flow@alpha and other local commands, which requires explicit review and safer dependency handling.

الملفات التي تم فحصها

746

الأسطر التي تم تحليلها

عناصر المراجعة

تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (1)

متوسط

SKILL.md:16-17 SKILL.md:155-156 SKILL.md:280-281 SKILL.md:341-343 SKILL.md:473-486 README.md:13-18

Unpinned Alpha CLI Execution Guidance

The skill repeatedly instructs users to run npx claude-flow@alpha commands. Running an unpinned alpha package can execute third-party code during skill generation and validation.

Multiple documented examples use npx claude-flow@alpha and the dependency is declared in the skill. This shows intentional third-party CLI execution guidance, but I found no evidence of exfiltration or malicious payloads.

عناصر مراجعة القدرات (4)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

متوسط

SKILL.md:329-338

Ruby/shell backtick execution

```bash

The referenced Bash validation block tells the user to run npx js-yaml, dot, and test against local files. These are legitimate validation commands, but they are external process execution and depend on local tooling.

متوسط

SKILL.md:341-351

Ruby/shell backtick execution

```bash

The Bash dry-run block invokes npx claude-flow@alpha and branches on shell exit status. Running a community skill command through npx can execute third-party package code.

متوسط

SKILL.md:473-479

Ruby/shell backtick execution

```bash

This common pattern instructs users to run npx claude-flow@alpha skill-run with parameters. The command is intentional guidance for external CLI execution, even though it is documented as an example.

متوسط

SKILL.md:482-487

Ruby/shell backtick execution

```bash

This Bash example invokes npx claude-flow@alpha skill-builder and writes output into a skills directory. It is useful tooling, but it executes an external package and may modify local files.

عوامل الخطر

⚙️ الأوامر الخارجية (67)

SKILL.md:46-61 SKILL.md:61-64 SKILL.md:64-90 SKILL.md:90-93 SKILL.md:93-107 SKILL.md:107-123 SKILL.md:123-134 SKILL.md:134-144 SKILL.md:144 SKILL.md:146 SKILL.md:152-155 SKILL.md:155 SKILL.md:157 SKILL.md:165 SKILL.md:167 SKILL.md:171-174 SKILL.md:174-184 SKILL.md:184 SKILL.md:186 SKILL.md:189-198 SKILL.md:198-201 SKILL.md:201-208 SKILL.md:216 SKILL.md:220-227 SKILL.md:227-230 SKILL.md:230-236 SKILL.md:239-243 SKILL.md:246-248 SKILL.md:248-264 SKILL.md:264-272 SKILL.md:278-279 SKILL.md:282-283 SKILL.md:287-289 SKILL.md:289-292 SKILL.md:292-294 SKILL.md:294-295 SKILL.md:295-303 SKILL.md:303-306 SKILL.md:306-309 SKILL.md:309-310 SKILL.md:310-311 SKILL.md:311-313 SKILL.md:313-329 SKILL.md:329-338 SKILL.md:338-341 SKILL.md:341-351 SKILL.md:351-354 SKILL.md:354-366 SKILL.md:366-382 SKILL.md:382-386 SKILL.md:386 SKILL.md:390 SKILL.md:393 SKILL.md:397 SKILL.md:400 SKILL.md:405 SKILL.md:406-409 SKILL.md:409-417 SKILL.md:417-420 SKILL.md:420-438 SKILL.md:438-456 SKILL.md:456-468 SKILL.md:468-473 SKILL.md:473-479 SKILL.md:479-482 SKILL.md:482-487 SKILL.md:284

📁 الوصول إلى نظام الملفات (1)

SKILL.md:334

دقّقه: codex عرض سجل التدقيق →

شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار

نسخ رابط التقرير

https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-creating-skill-template-use-skill-builder/security.svg)](https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-creating-skill-template-use-skill-builder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-creating-skill-template-use-skill-builder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

DNYoussef. (2026). when-creating-skill-template-use-skill-builder security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9

اقتباس BibTeX

@techreport{dnyoussef-dnyoussef-when-creating-skill-template-use-skill-builder-2026,
  author = {DNYoussef},
  title = {when-creating-skill-template-use-skill-builder security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-creating-skill-template-use-skill-builder security audit report (audit version 9)"
version: "1.0.0"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-creating-skill-template-use-skill-builder/audits/9"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-creating-skill-template-use-skill-builder:audit:9"
    description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: مرتفع

الهندسة المعمارية

100

قابلية الصيانة

المحتوى

المجتمع

الامتثال للمواصفات

ما الذي يمكنك بناؤه

Padronizar Novos Scaffolds de Skills

Crie uma estrutura de arquivos repetível e uma checklist de metadados para novas skills de IA.

Documentar Fluxos de Trabalho Reutilizáveis

Transforme uma ideia de fluxo de trabalho em documentação de skill, etapas de processo e saídas esperadas.

Revisar a Completude de Skills

Verifique se um rascunho de skill inclui os arquivos obrigatórios, etapas de validação e orientações de uso.

جرّب هذه الموجّهات

Criar um Modelo Básico de Skill

Crie um modelo de skill do Claude Code para um fluxo de trabalho chamado [name]. Inclua finalidade, gatilhos, arquivos obrigatórios e etapas de validação.

Planejar Fases da Skill

Projete a estrutura de fases para uma skill que ajuda com [workflow]. Inclua objetivos, agentes, saídas e critérios de sucesso.

Converter Documentação de Fluxo de Trabalho

Converta estas notas de fluxo de trabalho em um pacote de skill do Claude Code com SKILL.md, README.md, PROCESS.md e um esboço de diagrama de processo.

Auditar um Rascunho de Skill Gerada

Revise este rascunho de skill gerada quanto à completude dos metadados, revelação progressiva, cobertura de validação, segurança dos comandos e prontidão para o marketplace.

أفضل الممارسات

Revise todos os comandos gerados antes de executá-los localmente.
Mantenha nomes, categorias, gatilhos e saídas da skill específicos para um único fluxo de trabalho.
Valide os arquivos gerados antes de adicionar a skill a um marketplace compartilhado.

تجنب

Não copie snippets de shell gerados para produção sem revisão.
Não crie skills amplas que combinem fluxos de trabalho não relacionados.
Não publique skills geradas sem verificar a qualidade dos metadados e da documentação.