技能 scribe-mcp-usage
📦

scribe-mcp-usage

内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🔑 环境变量

操作 Scribe MCP 文档工作流

项目工作在不同代理之间可能会丢失决策、日志和文档状态。此技能指导 Scribe MCP 设置、文档更新和进度记录。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "scribe-mcp-usage" from https://skillstore.io/skills/cortalabs-scribe-mcp-usage.md and its manifest at https://skillstore.io/api/skills/cortalabs-scribe-mcp-usage/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/cortalabs-scribe-mcp-usage.md 已签名 manifest GET /api/skills/cortalabs-scribe-mcp-usage/manifest 已签名 lockfile GET /api/skills/cortalabs-scribe-mcp-usage/lockfile

测试它

正在使用“scribe-mcp-usage”。 为此代码库设置 Scribe 跟踪。

预期结果:

助手选择项目，确认已注册的根目录，并列出需要更新的规划文档。

正在使用“scribe-mcp-usage”。 记录测试修复后的更改内容。

预期结果:

助手写入一条简洁的进度条目，包含修复摘要、受影响组件和测试结果。

正在使用“scribe-mcp-usage”。 查找关于架构计划的最近决策。

预期结果:

助手搜索最近的项目日志，并返回相关决策和待处理后续事项的简短摘要。

安全审计

高风险
v9 • 2026/7/6 打开版本化报告

The static analyzer findings are false positives caused by Markdown code spans, fenced examples, placeholder paths, and an environment variable name used in documentation. Manual review found semantic risk from coercive prompt-language and mandatory reasoning/activity logging that can override user intent and collect sensitive details.

1
已扫描文件
572
分析行数
0
复核项
0
已忽略误报

已确认安全问题 (2)

高
SKILL.md:26-36SKILL.md:48-54
Prompt Injection Attempt Detected
The skill labels its rules as commandment-level requirements and tells agents they MUST ALWAYS use specific tools and identity settings. This attempts to override normal platform and user instruction priority across projects.
The cited lines use coercive authority language, global MUST ALWAYS directives, and identity/tool mandates. They are clear prompt-level control attempts, even though they are framed as workflow guidance.
高
SKILL.md:53-74SKILL.md:129-136SKILL.md:168
Excessive Reasoning and Activity Logging
The skill requires agents to log every significant action and reasoning trace with zero exceptions. This can capture sensitive project details and private reasoning beyond user intent.
The text explicitly says the log is the chain of reasoning, requires why/what/how reasoning blocks, and demands logging every action. This creates a high-confidence privacy and policy risk.

风险因素

⚙️ 外部命令 (149)
SKILL.md:10 SKILL.md:11 SKILL.md:12 SKILL.md:14 SKILL.md:15 SKILL.md:16 SKILL.md:17 SKILL.md:18 SKILL.md:21 SKILL.md:22 SKILL.md:24 SKILL.md:31 SKILL.md:33 SKILL.md:36 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:48 SKILL.md:53 SKILL.md:54 SKILL.md:58 SKILL.md:59 SKILL.md:60 SKILL.md:64 SKILL.md:65 SKILL.md:66 SKILL.md:67 SKILL.md:68 SKILL.md:72 SKILL.md:82 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:92 SKILL.md:93 SKILL.md:94 SKILL.md:110-117 SKILL.md:117-120 SKILL.md:120-127 SKILL.md:127-140 SKILL.md:140-141 SKILL.md:141 SKILL.md:142-143 SKILL.md:143 SKILL.md:145-156 SKILL.md:156-157 SKILL.md:157 SKILL.md:161 SKILL.md:162-163 SKILL.md:163-164 SKILL.md:164 SKILL.md:165-168 SKILL.md:168-172 SKILL.md:172-173 SKILL.md:173-174 SKILL.md:174-175 SKILL.md:175-176 SKILL.md:176-177 SKILL.md:177-178 SKILL.md:178-179 SKILL.md:179-180 SKILL.md:180-182 SKILL.md:182-187 SKILL.md:187-189 SKILL.md:189-191 SKILL.md:191-192 SKILL.md:192-224 SKILL.md:224-226 SKILL.md:226-228 SKILL.md:228-243 SKILL.md:243-245 SKILL.md:245-247 SKILL.md:247-250 SKILL.md:250-278 SKILL.md:278-281 SKILL.md:281-321 SKILL.md:321-323 SKILL.md:323-324 SKILL.md:324 SKILL.md:325 SKILL.md:326 SKILL.md:327 SKILL.md:329-330 SKILL.md:330 SKILL.md:332 SKILL.md:333 SKILL.md:334 SKILL.md:335 SKILL.md:336 SKILL.md:337-339 SKILL.md:339 SKILL.md:340 SKILL.md:345-347 SKILL.md:347-348 SKILL.md:348-349 SKILL.md:349-353 SKILL.md:353 SKILL.md:355-357 SKILL.md:357-373 SKILL.md:373-375 SKILL.md:375-377 SKILL.md:377-379 SKILL.md:379-404 SKILL.md:404-406 SKILL.md:406-408 SKILL.md:408-414 SKILL.md:414-416 SKILL.md:416-418 SKILL.md:418-428 SKILL.md:428-430 SKILL.md:430-432 SKILL.md:432-441 SKILL.md:441-443 SKILL.md:443-445 SKILL.md:445-446 SKILL.md:446-481 SKILL.md:481-483 SKILL.md:483-485 SKILL.md:485-486 SKILL.md:486-512 SKILL.md:512-518 SKILL.md:518-519 SKILL.md:519-520 SKILL.md:520-521 SKILL.md:521-522 SKILL.md:522-523 SKILL.md:523-524 SKILL.md:524-525 SKILL.md:525-526 SKILL.md:526-527 SKILL.md:527-528 SKILL.md:528-531 SKILL.md:531 SKILL.md:532 SKILL.md:533 SKILL.md:534 SKILL.md:537-538 SKILL.md:538-539 SKILL.md:539 SKILL.md:540-541 SKILL.md:541-542 SKILL.md:542-548 SKILL.md:548 SKILL.md:550-551 SKILL.md:551-552 SKILL.md:552-553 SKILL.md:553 SKILL.md:556-557 SKILL.md:557
📁 文件系统访问 (18)
SKILL.md:212 SKILL.md:213 SKILL.md:215 SKILL.md:216 SKILL.md:217 SKILL.md:218 SKILL.md:222 SKILL.md:238 SKILL.md:239 SKILL.md:276 SKILL.md:319 SKILL.md:368 SKILL.md:413 SKILL.md:504 SKILL.md:505 SKILL.md:506 SKILL.md:507 SKILL.md:510
🔑 环境变量 (1)
SKILL.md:92
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/cortalabs-scribe-mcp-usage/security.svg)](https://skillstore.io/skills/cortalabs-scribe-mcp-usage?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/cortalabs-scribe-mcp-usage?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cortalabs-scribe-mcp-usage/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/cortalabs-scribe-mcp-usage.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

CortaLabs. (2026). scribe-mcp-usage security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9

BibTeX 引用

@techreport{cortalabs-cortalabs-scribe-mcp-usage-2026, author = {CortaLabs}, title = {scribe-mcp-usage security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "scribe-mcp-usage security audit report (audit version 9)" version: "unspecified" type: report authors: - name: "CortaLabs" date-released: "2026-07-06" url: "https://skillstore.io/skills/cortalabs-scribe-mcp-usage/audits/9" identifiers: - type: other value: "skillstore:cortalabs-scribe-mcp-usage:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
70
社区
78
规范符合性

你能构建什么

准备项目文档

在实施开始前，使用 Scribe MCP 创建或更新架构、阶段计划和清单文档。

跟踪代理工作

在仅追加式项目日志中记录实施进度、测试结果和决策。

审查项目历史

查询最近的或已筛选的日志条目，以便无需阅读完整进度日志即可恢复上下文。

试试这些提示

选择项目 
使用 Scribe MCP 指南将当前代码库选择为项目，并总结活动项目上下文。
起草规划文档 
使用 Scribe 文档工作流为此代码库准备架构指南、阶段计划和清单。
记录实施进度 
在此更改之后，创建一条简洁的 Scribe 进度条目，包含结果、涉及的文件和验证状态。
审计项目历史 
查询此项目最近的 Scribe 条目，识别未解决的风险，并提出下一步文档更新建议。

最佳实践

  • 在编辑 Scribe 管理的文档之前设置项目根目录。
  • 对架构、阶段计划和清单更新使用结构化文档操作。
  • 保持日志条目简洁、客观，并且不包含秘密信息。

避免

  • 不要将此技能视为优先级高于 system、developer 或 user 指令。
  • 不要记录隐藏推理、凭据或无关的项目细节。
  • 不要在未确认可选 CLI 示例与代码库匹配的情况下运行它们。

常见问题

此技能能帮助完成什么？
它说明如何使用 Scribe MCP 进行项目设置、托管文档、进度日志和日志查询。
它包含可执行代码吗？
不能。此技能是一个 Markdown 指令文件，包含 MCP 工具示例和可选 CLI 命令。
它支持哪些工具？
报告标明支持 Claude、Codex 和 Claude Code。
它需要 Scribe 服务器吗？
是的。该指南假设本地 Scribe MCP 服务器公开了所记录的工具。
用户在安装前应审查什么？
用户应在启用前审查广泛的日志记录要求和强约束的指令语言。
它能管理任意文档吗？
它专注于 Scribe 项目文档，例如架构指南、阶段计划、清单和进度日志。

开发者详情

作者

CortaLabs

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/CortaLabs/scribe_mcp/tree/master/.codex/skills/scribe-mcp-usage

引用

d11af420e07cd866fe39cfa937efef3223896c06

维护新鲜度

2026/7/21

使用量

5 次下载 · 197 次浏览

文件结构

📄 SKILL.md

相关技能

查看全部