技能 spawn
📦
spawn
内容修订 r2 高风险 🔑 环境变量⚙️ 外部命令📁 文件系统访问
生成代理和终端命令
开发者经常需要交互式代理或长时间运行的 CLI 任务，同时不阻塞主会话。此技能会为编码代理和通用命令打开终端会话，并记录输出捕获方式。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "spawn" from https://skillstore.io/skills/consiliency-spawn.md and its manifest at https://skillstore.io/api/skills/consiliency-spawn/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“spawn”。 为长时间视频转换生成一个终端。
预期结果:
会为该命令打开一个新终端。助手会报告是否捕获调试输出以及在哪里找到它。
正在使用“spawn”。 启动 Codex 来审查失败的测试套件。
预期结果:
该技能会选择 Codex cookbook，构建 CLI 命令，打开终端，并返回捕获的输出路径。
正在使用“spawn”。 为 Cursor Agent 打开登录流程。
预期结果:
会为 Cursor 身份验证命令打开一个终端。调用方等待登录流程完成或超时。
安全审计
高风险v12 • 2026/10/13 打开版本化报告
The 86 findings include real shell quoting and temporary-file risks, alongside false positives from documentation, platform detection, and dictionary operations. Provider instructions also recommend disabling approval safeguards and, for Codex, the sandbox. No evidence found of credential theft, concealed malware, or instructions to manipulate this audit.
12
已扫描文件
1,587
分析行数
23
复核项
0
已忽略误报
已确认安全问题 (1)
高
agent/cookbook/codex-cli.md:44-46agent/cookbook/codex-cli.md:69-83agent/cookbook/cursor-cli.md:40-43
Approval and sandbox safeguards disabled by default
The Codex cookbook says: "Always run with `--dangerously-bypass-approvals-and-sandbox` for full auto mode". Cursor similarly recommends force-allowing commands, increasing exposure to destructive actions and injected repository instructions.
These are explicit operational instructions to remove approval controls, not merely flag descriptions. Codex examples also disable sandboxing.
能力复核项 (23)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Python subprocess.run
subprocess.run(
The AppleScript contains unescaped shell_cmd text, including unquoted cwd. Quotes or metacharacters in directory names can change the executed script.
高
Python subprocess.run
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
The fallback interpolates command into nested Unix and Windows shell text with shell=True. Embedded quotes can cross parser boundaries and execute unintended commands.
高
Python subprocess.Popen
subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
The argument list launches PowerShell with generated script text. POSIX shlex.quote does not safely escape PowerShell cwd values, allowing directory text to become code.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
Caller-supplied command text is executed with shell=True and no restricted argument mode. Legitimate shell use is intended, but untrusted interpolated data can execute commands.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
The debug path executes arbitrary command text with shell=True. The caller trust boundary is unspecified, so unsafe interpolation remains a risk.
高
Python subprocess.Popen
subprocess.Popen(command, shell=True, cwd=cwd)
The fallback passes caller-supplied command directly to shell=True without validation. Requested shell execution is legitimate, but untrusted command construction is not protected.
高
PowerShell invocation
"wt.exe", "-w", "new", "powershell.exe",
PowerShell receives generated script text using POSIX quoting for cwd. That mismatch can interpret directory-name characters as PowerShell syntax.
高
Windows cmd.exe
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
Command text is embedded in a cmd.exe command passed through another shell. Missing parser-specific escaping permits unintended interpretation of embedded quotes and metacharacters.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Agent output is written by tee into shared /tmp without private permissions or exclusive creation. Sensitive responses may be readable under common umasks.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
Debug logs collect terminal output in shared /tmp without permission hardening. Logs may expose sensitive output to other local users.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The completion marker is not securely created or checked for ownership. Another local user who discovers the filename can spoof completion.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The WSL script writes agent output into shared /tmp through tee. No private directory, restrictive permissions, or exclusive creation protects the response.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The WSL debug log stores full terminal output in shared /tmp. Its creation does not enforce privacy or resist existing symlinks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The WSL completion marker uses a shared temporary path without exclusive creation or ownership verification. A local attacker can spoof its existence.
中
Temp directory access
script_file = f"/tmp/fork-script-{output_id}.sh"
A shell script containing caller commands is placed directly in shared /tmp. Later nonexclusive creation and permissions 0755 expose its contents and permit symlink attacks.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The tmux branch saves agent output in shared /tmp using tee. It does not ensure private permissions or exclusive file creation.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The tmux debug path stores terminal output in a shared temporary file. Sensitive output can remain readable under common umasks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The tmux completion marker has no secure creation or ownership checks. Its existence can be spoofed by another local user.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Background execution writes responses into shared /tmp without permission hardening. Sensitive agent output can be exposed to other local users.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The background debug file collects stdout and stderr without private permissions or exclusive creation. This creates disclosure and symlink risks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The background completion marker is placed in shared /tmp and checked only for existence. Local users can forge completion after discovering its path.
中
Python file write/append
with open(script_file, 'w') as f:
open(script_file, 'w') follows existing symlinks and truncates their targets. The script is created in shared /tmp without exclusive or no-follow flags.
中
Python os file operations
os.chmod(script_file, 0o755)
chmod sets command-bearing scripts to 0755, exposing prompts to other local users. It also follows a substituted symlink when changing target permissions.
风险因素
🔑 环境变量 (3)
⚙️ 外部命令 (49)
agent/fork_terminal.py:58 agent/fork_terminal.py:176 agent/fork_terminal.py:93 agent/fork_terminal.py:161 agent/fork_terminal.py:196 agent/fork_terminal.py:216 agent/fork_terminal.py:222 agent/fork_terminal.py:227 agent/fork_terminal.py:281 agent/fork_terminal.py:76 agent/fork_terminal.py:90 agent/fork_terminal.py:173 agent/fork_terminal.py:176 agent/fork_terminal.py:140 agent/fork_terminal.py:146 agent/fork_terminal.py:152 agent/SKILL.md:52 agent/SKILL.md:60 agent/SKILL.md:134 agent/SKILL.md:138 agent/SKILL.md:139 agent/SKILL.md:140 agent/SKILL.md:144 agent/SKILL.md:146 agent/SKILL.md:147 agent/SKILL.md:148 agent/SKILL.md:149 agent/SKILL.md:150 agent/SKILL.md:154 agent/SKILL.md:156-163 agent/SKILL.md:163-167 agent/SKILL.md:167-169 agent/SKILL.md:169-172 SKILL.md:17 SKILL.md:47 SKILL.md:49-58 SKILL.md:58-62 SKILL.md:62-79 SKILL.md:79-89 SKILL.md:89-90 terminal/SKILL.md:8 terminal/SKILL.md:22 terminal/SKILL.md:23 terminal/SKILL.md:31 terminal/SKILL.md:33 terminal/SKILL.md:43 terminal/SKILL.md:59 terminal/SKILL.md:61-72 terminal/SKILL.md:72-76
📁 文件系统访问 (23)
agent/fork_terminal.py:107 agent/fork_terminal.py:108 agent/fork_terminal.py:41 agent/fork_terminal.py:42 agent/fork_terminal.py:43 agent/fork_terminal.py:134 agent/fork_terminal.py:135 agent/fork_terminal.py:136 agent/fork_terminal.py:137 agent/fork_terminal.py:183 agent/fork_terminal.py:184 agent/fork_terminal.py:185 agent/fork_terminal.py:210 agent/fork_terminal.py:211 agent/fork_terminal.py:212 agent/fork_terminal.py:157 agent/fork_terminal.py:159 agent/fork_terminal.py:126 agent/prompts/fork-summary-user-prompt.md:13 agent/SKILL.md:138 agent/SKILL.md:139 terminal/SKILL.md:41 terminal/SKILL.md:59
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/consiliency-spawn/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/consiliency-spawn?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/consiliency-spawn?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/consiliency-spawn/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/consiliency-spawn.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
Consiliency. (2026). spawn security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/consiliency-spawn/audits/12BibTeX 引用
@techreport{consiliency-consiliency-spawn-2026,
author = {Consiliency},
title = {spawn security audit report (audit version 12)},
institution = {Skillstore},
year = {2026},
number = {12},
url = {https://skillstore.io/skills/consiliency-spawn/audits/12},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "spawn security audit report (audit version 12)"
version: "unspecified"
type: report
authors:
- name: "Consiliency"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/consiliency-spawn/audits/12"
identifiers:
- type: other
value: "skillstore:consiliency-spawn:audit:12"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
70
社区
83
规范符合性
你能构建什么
运行长时间 CLI 作业
为构建、媒体或包管理命令打开单独的终端，同时主助手继续工作。
启动交互式编码代理
使用提示、模型选择和可选的输出捕获来启动选定的 AI 编码 CLI。
处理提供商登录流程
当编码 CLI 需要浏览器或交互式登录时，为提供商身份验证打开终端。
试试这些提示
打开构建终端
使用 spawn-terminal 打开新终端并运行 npm run build。先检查命令帮助或 package 脚本。
启动 Claude Code 代理
使用 spawn-agent 和 Claude Code 来审查当前 bug 报告。保持权限保守，并返回输出路径。
运行带摘要的 Codex
使用 spawn-agent 和 Codex。包含我们当前任务的简洁摘要，然后要求它检查失败的测试。
比较代理结果
为 Codex 和 Cursor 分别生成代理来调查性能回归。捕获干净输出并总结分歧。
最佳实践
- 在终端中生成任何命令之前，都要先审查该命令。
- 对于不受信任的提示，优先使用沙盒化或基于确认的代理模式。
- 当捕获的输出文件可能包含敏感数据时，将其删除。
避免
- 不要在绕过审批或拥有完整系统访问权限的情况下运行不受信任的提示。
- 不要在提示、命令参数或捕获的输出文件中传递密钥。
- 不要将此技能用于可以在当前会话中安全运行的简单命令。
常见问题
此技能有什么作用？
它会为 AI 编码代理或通用 CLI 命令打开新的终端会话。
记录了哪些代理？
该技能记录了 Claude Code、Codex、Gemini、Cursor、OpenCode 和 Copilot 的命令模式。
它能捕获输出吗？
可以。它可以将干净的代理输出或调试终端输出写入临时文件。
它会安装 CLI 工具吗？
不能。所需的 CLI 工具和凭据必须已经存在于用户系统中。
为什么此技能对安全敏感？
它会启动外部进程，并且一些 cookbook 推荐强大的自动审批模式。
用户应如何降低风险？
用户应优先使用沙盒模式，验证命令，避免使用密钥，并移除临时输出文件。
开发者详情
作者
Consiliency许可证
MIT
Skillstore 修订
r2
版本提示
作者未声明版本。
引用
18789a6c1a8a9ebc818b76ac8686bbd38eb802a8
维护新鲜度
2026/10/13
使用量
12 次下载 · 222 次浏览
文件结构