技能 Command Development
📦
Command Development
v0.2.0 内容修订 r1 中风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问
构建 Claude Code 斜杠命令
团队需要可复用的命令，并且这些命令在不同项目中表现一致。此技能会指导命令结构、frontmatter、参数、Bash 上下文、插件资源、测试和文档。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "Command Development" from https://skillstore.io/skills/davila7-command-development.md and its manifest at https://skillstore.io/api/skills/davila7-command-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“Command Development”。 用户请求一个简单的代码审查斜杠命令。
预期结果:
一个简洁的命令设计，包含描述、只读工具访问、审查清单和预期反馈格式。
正在使用“Command Development”。 用户请求一个运行质量检查器的插件命令。
预期结果:
一个插件命令方案，引用插件资源、缩小 Bash 访问范围、验证输入，并总结检查器输出。
正在使用“Command Development”。 用户询问如何准备命令以进行 marketplace 分发。
预期结果:
一份清单，涵盖命名、可移植性、依赖项、示例、测试步骤和安全审查要点。
安全审计
中风险v9 • 2026/7/19 打开版本化报告
The 400 presented static findings are mostly documentation and test examples, with no prompt injection or malicious intent found. Copy-ready inline Bash examples that interpolate positional input remain confirmed because generated commands may permit shell injection. Broad Bash permissions and unrestricted dynamic file references also require correction, and 29 capped static matches still need manual review. Static review was capped at 400/429 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
11
已扫描文件
7,237
分析行数
36
复核项
0
已忽略误报
已确认安全问题 (2)
中
Overly Broad Bash Permissions in Templates
Copy-ready plugin examples grant Bash(*) despite earlier advice to scope commands. Generated commands receive unrestricted shell permission beyond their stated tasks.
Both cited frontmatter examples explicitly use Bash(*), while their tasks only need narrow file or script access.
中
Unconstrained Dynamic File References
Copy-ready templates insert positional input into @ file references without path restrictions. Generated commands could read unintended files from absolute or traversal paths.
The examples directly concatenate $1 into file-reference paths and show no project-root containment or rejection of absolute and traversal paths.
能力复核项 (36)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
中
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/quality-check.js $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/security-scan.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/perf-analyze.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/best-practices.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/pre-release-check.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build-release.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`bash ${CLAUDE_PLUGIN_ROOT}/scripts/package.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Run plugin analyzer: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Validate environment argument: !`echo "$1" | grep -E "^(dev|staging|prod)$" && echo "VALID" || echo
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Verify configuration available: !`test -f ${CLAUDE_PLUGIN_ROOT}/config/$1.json && echo "FOUND" || ec
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
**Execute build:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/build.sh $1 2>&1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
**Validation results:** !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/validate-build.sh $1 2>&1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Determine check level: !`echo "$1" | grep -E "^prod$" && echo "FULL" || echo "BASIC"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/script-name.js $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Validate input: !`echo "$1" | grep -E "^pattern$" && echo "OK" || echo "ERROR"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Validate: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Test execution: !`npm test $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`gh pr view $1 --json title,body,author,files`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Files changed: !`gh pr diff $1 --name-only`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Test status: !`gh pr checks $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Deployment details: !`gh api /deployments/$1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Lint results: !`node ${CLAUDE_PLUGIN_ROOT}/bin/lint.js $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Step 1 - Prepare: !`bash ${CLAUDE_PLUGIN_ROOT}/scripts/prepare.sh $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Step 3 - Execute: !`${CLAUDE_PLUGIN_ROOT}/bin/execute $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Run: !`${CLAUDE_PLUGIN_ROOT}/bin/process.sh $1 $2`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Environment check: !`echo "Deploying to: $1"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Stage changes: !\`git add $1\`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Commit changes: !\`git commit -m "$2"\`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
!`node ${CLAUDE_PLUGIN_ROOT}/scripts/lint.js $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Validate environment: !`echo "$1" | grep -E "^(dev|staging|prod)$" || echo "INVALID"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Check file: !`test -f $1 && echo "EXISTS" || echo "MISSING"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Validate inputs: !`test -n "$1" -a -n "$2" && echo "OK" || echo "MISSING"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Try processing: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/process.js $1 2>&1 || echo "ERROR: $?"`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Run tests: !`npm test $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
1. Fetch PR: !`gh pr view $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
中
Ruby/shell backtick execution
Run analysis: !`node ${CLAUDE_PLUGIN_ROOT}/scripts/analyze.js $1`
This copy-ready inline Bash example substitutes positional command input directly into shell syntax. Without a robust argument boundary or strict allowlist, crafted input may alter the invoked command.
风险因素
⚙️ 外部命令 (50)
examples/plugin-commands.md:35-42 examples/plugin-commands.md:68-71 examples/plugin-commands.md:71-74 examples/plugin-commands.md:74-81 examples/plugin-commands.md:144-147 examples/plugin-commands.md:147-150 examples/plugin-commands.md:150-153 examples/plugin-commands.md:153-161 examples/plugin-commands.md:186-188 examples/plugin-commands.md:188-202 examples/plugin-commands.md:307-336 examples/plugin-commands.md:359-361 examples/plugin-commands.md:361-363 examples/plugin-commands.md:363-369 examples/plugin-commands.md:369-371 examples/plugin-commands.md:371-380 examples/plugin-commands.md:408-411 examples/plugin-commands.md:411-412 examples/plugin-commands.md:412-413 examples/plugin-commands.md:413-414 examples/plugin-commands.md:414-417 examples/plugin-commands.md:417-418 examples/plugin-commands.md:418-427 examples/plugin-commands.md:441-442 examples/plugin-commands.md:471-472 examples/plugin-commands.md:477-478 examples/plugin-commands.md:496-497 examples/plugin-commands.md:508-509 examples/plugin-commands.md:509-510 examples/plugin-commands.md:517-520 examples/plugin-commands.md:520-521 examples/plugin-commands.md:526-532 examples/plugin-commands.md:532-533 examples/plugin-commands.md:541-543 examples/simple-commands.md:100-109 examples/simple-commands.md:175-177 examples/simple-commands.md:177-179 examples/simple-commands.md:179-181 examples/simple-commands.md:181-187 examples/simple-commands.md:212-225 examples/simple-commands.md:431-433 examples/simple-commands.md:488-492 README.md:127-128 README.md:200-201 README.md:201-202 references/advanced-workflows.md:25-28 references/advanced-workflows.md:28-36 references/advanced-workflows.md:36-56 references/advanced-workflows.md:78-79 references/advanced-workflows.md:79-81
📁 文件系统访问 (29)
examples/plugin-commands.md:548 README.md:133 README.md:133 references/advanced-workflows.md:483 references/documentation-patterns.md:129 references/documentation-patterns.md:379 references/marketplace-considerations.md:42 references/marketplace-considerations.md:55 references/marketplace-considerations.md:57 references/marketplace-considerations.md:59 references/marketplace-considerations.md:88 references/marketplace-considerations.md:143 references/marketplace-considerations.md:147 references/marketplace-considerations.md:704 references/testing-strategies.md:481 references/testing-strategies.md:152 references/testing-strategies.md:152 references/testing-strategies.md:238 references/testing-strategies.md:495 references/testing-strategies.md:222 references/testing-strategies.md:223 references/testing-strategies.md:226 references/testing-strategies.md:230 references/testing-strategies.md:234 references/testing-strategies.md:238 references/testing-strategies.md:239 references/testing-strategies.md:243 SKILL.md:63 SKILL.md:63
🌐 网络访问 (8)
references/documentation-patterns.md:684 references/documentation-patterns.md:685 references/marketplace-considerations.md:97 references/marketplace-considerations.md:98 references/marketplace-considerations.md:99 references/marketplace-considerations.md:636 references/marketplace-considerations.md:638 references/marketplace-considerations.md:872
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/davila7-command-development/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/davila7-command-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/davila7-command-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-command-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/davila7-command-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
davila7. (2026). Command Development security audit report (audit version 9) [Author version 0.2.0]. Skillstore. https://skillstore.io/skills/davila7-command-development/audits/9BibTeX 引用
@techreport{davila7-davila7-command-development-2026,
author = {davila7},
title = {Command Development security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/davila7-command-development/audits/9},
note = {Author version 0.2.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Command Development security audit report (audit version 9)"
version: "0.2.0"
type: report
authors:
- name: "davila7"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/davila7-command-development/audits/9"
identifiers:
- type: other
value: "skillstore:davila7-command-development:audit:9"
description: "Skillstore immutable audit report identifier"
比较变体
3 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 评分最高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
anthropics 推荐
anthropics-command-development
Skillstore 评分 76
证据置信度 中
Skillstore 使用量 8
已更新
2026-09-09
Skillstore 评分
评分依据 证据置信度: 中 59
架构
100
可维护性
87
内容
70
社区
65
规范符合性
你能构建什么
标准化团队工作流
为审查、测试、文档和发布检查创建共享项目命令。
创建插件命令
设计使用插件资源、脚本、agents、skills 和模板的插件命令。
改进个人自动化
为多个代码库中的重复开发任务构建个人斜杠命令。
试试这些提示
创建基础命令
创建一个用于审查已更改文件的 Claude Code 斜杠命令。包含简短描述和清晰说明。
添加参数和文件
设计一个斜杠命令，接受一个文件路径参数，读取该文件，并为其生成文档。
使用安全的 Bash 上下文
编写一个在分析前收集 Git 状态的命令。使用范围最窄的 allowed-tools 值，并解释任何 Bash 用法。
构建插件工作流
创建一个插件斜杠命令，用于验证参数、读取插件模板、运行插件脚本，并安全地报告失败。
最佳实践
- 使用能够支持该命令的范围最窄的 allowed-tools 设置。
- 在使用每个用户提供的参数之前，对其进行验证并编写文档。
- 使用缺失、无效、很长和异常输入来测试命令。
避免
- 当特定命令过滤器已经足够时，不要授予 Bash(*)。
- 不要在未经验证的情况下将斜杠命令参数直接传入 shell 命令。
- 不要硬编码个人插件路径或本地机器路径。
常见问题
这个技能能帮助我构建什么？
它帮助为项目、个人和插件工作流构建 Claude Code 斜杠命令。
该技能会自行执行 shell 命令吗？
不能。它记录的是命令模式，这些模式在用户创建命令时可能包含 shell 执行。
我可以将它用于插件命令吗？
可以。它涵盖插件命令位置、插件资源、脚本、agents、skills 和模板。
我应该如何处理命令参数？
记录预期参数，尽早验证它们，并避免直接进行 shell 插值。
为什么 allowed-tools 很重要？
它会限制命令在 Claude Code 会话期间可以访问或执行的内容。
发布命令之前我应该审查什么？
审查 Bash 用法、文件访问、参数验证、依赖项假设、示例和 marketplace 文档。
开发者详情
作者
davila7许可证
MIT
作者版本
v0.2.0
Skillstore 修订
r1
引用
dbe0e719813583400773166a0621f8a9b8185c72
维护新鲜度
2026/7/20
使用量
4 次下载 · 212 次浏览