📦
Agent Development
84构建可靠的 Claude Code 代理
当触发条件、frontmatter 或提示词不够明确时，代理文件可能会失败。这个技能提供适用于生产级代理的结构化模式、示例和验证步骤。
文档 查看
技能 Command Development
📦
Command Development
v0.2.0 内容修订 r1 中风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问
构建 Claude Code 斜杠命令
创建可靠的斜杠命令需要清晰的结构、安全的工具选择和有用的参数。此技能提供命令文件、frontmatter、引用、bash 上下文、插件和测试的模式。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "Command Development" from https://skillstore.io/skills/command-development.md and its manifest at https://skillstore.io/api/skills/command-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“Command Development”。 创建一个在提交前审查暂存更改的命令。
预期结果:
该技能会提出一个项目命令，包含清晰描述、受限的 git 工具访问、暂存更改上下文和审查标准。
正在使用“Command Development”。 为 marketplace 审查记录现有部署命令。
预期结果:
该技能会概述必需参数、允许的工具、安全检查、预期输出、故障排查说明和面向用户的文档。
正在使用“Command Development”。 构建一个调用打包分析器的插件命令。
预期结果:
该技能会推荐一种插件命令模式，用于引用插件根目录、验证输入、运行分析器并报告结果。
安全审计
中风险v9 • 2026/7/19 打开版本化报告
Most static detections are Markdown formatting, expected Claude paths, test syntax, or documentation links. Multiple executable templates directly interpolate positional arguments into shell text, creating command-injection risk. Predictable temporary files and repeated Bash(*) grants add avoidable exposure, but no prompt injection or covert exfiltration intent was found. Static review was capped at 400/429 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
11
已扫描文件
7,237
分析行数
41
复核项
0
已忽略误报
已确认安全问题 (1)
中
Overbroad Shell Permissions in Reusable Templates
Several reusable examples grant Bash(*) despite the skill recommending narrow permissions. Generated commands could therefore run shell operations beyond their stated workflow.
The unrestricted Bash grants are explicit and repeated in reusable command templates. The risk is partially mitigated by separate guidance favoring narrow permissions.
能力复核项 (41)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/quality-check.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/security-scan.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/perf-analyze.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/best-practices.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/pre-release-check.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build-release.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/package.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Run plugin analyzer: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Validate environment argument: !`echo "$1" | grep -E "^(dev|staging|prod)$" && echo "VALID" || echo
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Verify configuration available: !`test -f ${CLAUDE_PLUGIN_ROOT}/config/$1.json && echo "FOUND" || ec
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
**Execute build:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh $1 2>&1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
**Validation results:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/validate-build.sh $1 2>&1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Determine check level: !`echo "$1" | grep -E "^prod$" && echo "FULL" || echo "BASIC"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/script-name.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Validate input: !`echo "$1" | grep -E "^pattern$" && echo "OK" || echo "ERROR"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Validate: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Test execution: !`npm test $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`gh pr view $1 --json title,body,author,files`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Files changed: !`gh pr diff $1 --name-only`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Test status: !`gh pr checks $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Deployment details: !`gh api /deployments/$1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Lint results: !`node ${CLAUDE_PLUGIN_ROOT}/bin/lint.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Step 1 - Prepare: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/prepare.sh $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Step 3 - Execute: !`${CLAUDE_PLUGIN_ROOT}/bin/execute $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Run: !`${CLAUDE_PLUGIN_ROOT}/bin/process.sh $1 $2`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Environment check: !`echo "Deploying to: $1"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Stage changes: !\`git add $1\`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Commit changes: !\`git commit -m "$2"\`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/lint.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Validate environment: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Check file: !`test -f $1 && echo "EXISTS" || echo "MISSING"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Validate inputs: !`test -n "$1" -a -n "$2" && echo "OK" || echo "MISSING"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Try processing: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/process.js $1 2>&1 || echo "ERROR: $?"`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Run tests: !`npm test $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
1. Fetch PR: !`gh pr view $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
高
Ruby/shell backtick execution
Run analysis: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
The executable inline command inserts a positional argument directly into shell text. Crafted input could alter token boundaries or quoting and execute additional shell syntax.
中
Temp directory access
echo "Test content" > /tmp/test-file.txt
The example writes to a predictable shared /tmp filename without exclusive creation. A preexisting symlink could redirect the write and clobber another file.
中
Temp directory access
echo "Second file" > /tmp/test-file-2.txt
The example writes to a predictable shared /tmp filename without exclusive creation. A preexisting symlink could redirect the write and clobber another file.
中
Temp directory access
dd if=/dev/zero of=/tmp/large-file.bin bs=1M count=100
The test writes 100 MB to a fixed path under /tmp using /dev/zero. This can follow a preexisting symlink, overwrite data, or consume unnecessary disk space.
中
Temp directory access
rm /tmp/test-file*.txt /tmp/large-file.bin
The cleanup uses a wildcard under a shared temporary directory. It can delete unrelated matching files created by another process or user.
中
Standard device file access
dd if=/dev/zero of=/tmp/large-file.bin bs=1M count=100
The test writes 100 MB to a fixed path under /tmp using /dev/zero. This can follow a preexisting symlink, overwrite data, or consume unnecessary disk space.
风险因素
⚙️ 外部命令 (50)
examples/plugin-commands.md:35-42 examples/plugin-commands.md:68-71 examples/plugin-commands.md:71-74 examples/plugin-commands.md:74-81 examples/plugin-commands.md:144-147 examples/plugin-commands.md:147-150 examples/plugin-commands.md:150-153 examples/plugin-commands.md:153-161 examples/plugin-commands.md:186-188 examples/plugin-commands.md:188-202 examples/plugin-commands.md:307-336 examples/plugin-commands.md:359-361 examples/plugin-commands.md:361-363 examples/plugin-commands.md:363-369 examples/plugin-commands.md:369-371 examples/plugin-commands.md:371-380 examples/plugin-commands.md:408-411 examples/plugin-commands.md:411-412 examples/plugin-commands.md:412-413 examples/plugin-commands.md:413-414 examples/plugin-commands.md:414-417 examples/plugin-commands.md:417-418 examples/plugin-commands.md:418-427 examples/plugin-commands.md:441-442 examples/plugin-commands.md:471-472 examples/plugin-commands.md:477-478 examples/plugin-commands.md:496-497 examples/plugin-commands.md:508-509 examples/plugin-commands.md:509-510 examples/plugin-commands.md:517-520 examples/plugin-commands.md:520-521 examples/plugin-commands.md:526-532 examples/plugin-commands.md:532-533 examples/plugin-commands.md:541-543 examples/simple-commands.md:100-109 examples/simple-commands.md:175-177 examples/simple-commands.md:177-179 examples/simple-commands.md:179-181 examples/simple-commands.md:181-187 examples/simple-commands.md:212-225 examples/simple-commands.md:431-433 examples/simple-commands.md:488-492 README.md:127-128 README.md:200-201 README.md:201-202 references/advanced-workflows.md:25-28 references/advanced-workflows.md:28-36 references/advanced-workflows.md:36-56 references/advanced-workflows.md:78-79 references/advanced-workflows.md:79-81
📁 文件系统访问 (29)
examples/plugin-commands.md:548 README.md:133 README.md:133 references/advanced-workflows.md:483 references/documentation-patterns.md:129 references/documentation-patterns.md:379 references/marketplace-considerations.md:42 references/marketplace-considerations.md:55 references/marketplace-considerations.md:57 references/marketplace-considerations.md:59 references/marketplace-considerations.md:88 references/marketplace-considerations.md:143 references/marketplace-considerations.md:147 references/marketplace-considerations.md:704 references/testing-strategies.md:481 references/testing-strategies.md:152 references/testing-strategies.md:152 references/testing-strategies.md:238 references/testing-strategies.md:495 references/testing-strategies.md:222 references/testing-strategies.md:223 references/testing-strategies.md:226 references/testing-strategies.md:230 references/testing-strategies.md:234 references/testing-strategies.md:238 references/testing-strategies.md:239 references/testing-strategies.md:243 SKILL.md:63 SKILL.md:63
🌐 网络访问 (8)
references/documentation-patterns.md:684 references/documentation-patterns.md:685 references/marketplace-considerations.md:97 references/marketplace-considerations.md:98 references/marketplace-considerations.md:99 references/marketplace-considerations.md:636 references/marketplace-considerations.md:638 references/marketplace-considerations.md:872
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/command-development/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/command-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/command-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/command-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/command-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
anthropics. (2026). Command Development security audit report (audit version 9) [Author version 0.2.0]. Skillstore. https://skillstore.io/skills/command-development/audits/9BibTeX 引用
@techreport{anthropics-command-development-2026,
author = {anthropics},
title = {Command Development security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/command-development/audits/9},
note = {Author version 0.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Command Development security audit report (audit version 9)"
version: "0.2.0"
type: report
authors:
- name: "anthropics"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/command-development/audits/9"
identifiers:
- type: other
value: "skillstore:command-development:audit:9"
description: "Skillstore immutable audit report identifier"
比较变体
3 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 评分最高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
anthropics 推荐
anthropics-command-development
Skillstore 评分 76
证据置信度 中
Skillstore 使用量 8
已更新
2026-09-09
Skillstore 评分
评分依据 证据置信度: 高 59
架构
100
可维护性
87
内容
82
社区
65
规范符合性
你能构建什么
创建团队审查命令
构建可复用的审查命令，在整个代码库中标准化代码质量、测试和文档检查。
打包插件命令
设计引用捆绑脚本、模板、配置文件、agents 和 skills 的插件命令。
改进命令文档
为现有斜杠命令记录参数、工具访问、示例、预期输出和故障排查步骤。
试试这些提示
创建基础命令
为 [task] 创建一个简单的 Claude Code 斜杠命令。包含推荐的文件位置、简短描述、命令主体和用法示例。
添加参数和工具
为接受 [arguments] 的 [workflow] 设计一个斜杠命令。推荐安全的 allowed-tools 设置，并解释每个参数如何使用。
构建插件命令
为 [plugin feature] 创建一个插件斜杠命令。引用捆绑的模板或脚本，定义预期输入，并包含验证指导。
设计交互式工作流
为 [multi-step workflow] 设计一个交互式 Claude Code 命令。包含缺失信息的问题、确认点、错误处理和测试指导。
最佳实践
- 使用支持命令工作流的最窄 allowed-tools 设置。
- 在添加复杂逻辑之前，记录参数、预期输入和失败行为。
- 在共享前，使用缺失参数、无效文件和权限限制测试命令。
避免
- 当更窄的命令过滤器足够时，不要使用不受限制的 shell 访问。
- 不要在未验证的情况下将用户参数插入 shell 命令。
- 不要创建用含糊描述隐藏破坏性操作的命令。
常见问题
这个技能能帮助我构建什么？
它帮助你设计 Claude Code 斜杠命令，包括结构、frontmatter、参数、文件引用和插件模式。
它能为项目和插件创建命令吗？
可以。它涵盖带有捆绑资源的项目命令、个人命令和插件命令。
它支持交互式命令吗？
可以。它包含针对会提问、确认决策和处理缺失信息的命令的指导。
它会自行运行 shell 命令吗？
不支持。它记录命令模式。任何使用 shell 工具生成的命令仍取决于 Claude Code 权限。
我应如何安全使用 bash 示例？
优先使用受限的工具过滤器，验证参数，在需要时引用 shell 输入，并避免破坏性命令。
这能帮助准备发布命令吗？
可以。它包含面向命令作者的文档、测试和 marketplace 注意事项。
开发者详情
作者
anthropics许可证
MIT
作者版本
v0.2.0
Skillstore 修订
r1
仓库
https://github.com/anthropics/claude-code/tree/main/plugins/plugin-dev/skills/command-development引用
1b5b6c4962b2ad5a7a34603cab2685bbbd1b61ef
维护新鲜度
2026/7/20
使用量
14 次下载 · 1056 次浏览
anthropics 的更多技能
查看全部📦
writing-hookify-rules
82为 Claude Code 编写 Hookify 规则
在 bash、file、stop 和 prompt 事件中正确编写 hook 规则可能并不容易。此技能为 Claude、Codex 和 Claude Code 提供创建和测试 Hookify 规则的实用指导。
DevOps 与基础设施 查看
📦
Plugin Settings
81配置本地插件设置
插件作者需要一种安全方式来存储按项目的设置，同时避免提交用户特定状态。此技能说明了适用于 Claude、Codex 和 Claude Code 插件的本地 Markdown 与 YAML frontmatter 模式。
文档 查看
📦
Plugin Structure
80构建 Claude Code 插件结构
插件作者在添加 commands、agents、skills、hooks 或 MCP servers 之前，需要一个可靠的结构。此技能说明预期布局、manifest 字段、命名规则和可移植路径模式。
文档 查看
📦
example-skill
80创建 Claude Code 技能模板
技能作者需要一个清晰的插件技能结构参考。此技能说明必需的 SKILL.md 文件、可选支持文件、frontmatter 字段以及编写指导。
文档 查看
📦
frontend-design
79构建独具特色的前端界面
通用界面可能会让有用的产品显得未完成或缺乏记忆点。此技能引导 Claude、Codex 和 Claude Code 完成更精致的前端工作，并形成清晰的视觉方向。
设计与创意 查看
相关技能
查看全部📦
building-commands
84构建 Claude Code 斜杠命令
由 C0ntr0lledCha0s
团队需要易于调用和审查的可重复 AI 工作流。此技能可帮助创建、更新、验证和记录 Claude Code 斜杠命令。
编码与开发 查看
📦
building-agents
85构建 Claude Code 智能体
由 C0ntr0lledCha0s
创建可靠的 AI 智能体需要清晰的 schema、安全的工具和可重复的审查步骤。此技能为 Claude Code 工作流中的智能体设计、验证、迁移和维护提供指导。
编码与开发 查看
📦
creating-issues
84创建一致的 GitHub Issue
由 C0ntr0lledCha0s
当不同仓库中的 issue 标题、标签和项目元数据不一致时，团队会浪费时间。此 skill 可指导 Claude、Codex 和 Claude Code 创建一致的 GitHub issue。
编码与开发 查看
📦
analyzing-component-quality
82分析 Claude Code 组件质量
由 C0ntr0lledCha0s
团队在发布 Claude Code 组件之前需要一致的评审。此技能会对清晰度、权限、触发条件、安全性和可用性进行评分，并提供具体的改进指导。
编码与开发 查看
📦
powershell-expert
81构建可靠的 PowerShell 工具
由 hmohamed01
PowerShell 项目需要一致的结构、安全的参数处理以及最新的模块指导。此技能使用实用的 PowerShell 参考资料，帮助创建脚本、模块和 GUI。
编码与开发 查看
📦
github-pr
80更快审查 GitHub 拉取请求
由 Bind
代码审查协调通常需要反复执行 GitHub CLI 检查并发表评论。此技能记录了用于分诊、指南查找和行内反馈的 PR 审查辅助工具。
编码与开发 查看