📦
latex-posters
87创建 LaTeX 科研海报
科研海报在 LaTeX 中很难排版，也很难为印刷进行校对。此技能提供模板、布局指导和 PDF 检查，帮助制作符合会议要求的海报。
设计与创意 查看
技能 skill-creator
📦
skill-creator
内容修订 r2 高风险 📁 文件系统访问⚡ 包含脚本⚙️ 外部命令🌐 网络访问🔑 环境变量
构建和评估 AI 技能
创建可靠的 AI 技能需要清晰的指令、贴近实际的测试和基于度量的迭代。此技能可指导草拟、基准测试、审查、描述优化和打包。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "skill-creator" from https://skillstore.io/skills/davila7-skill-development.md and its manifest at https://skillstore.io/api/skills/davila7-skill-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“skill-creator”。 创建一个用于审查数据库迁移的技能。
预期结果:
- 一份重点明确的技能草案，其中包含触发指导和迁移审查工作流。
- 三个测试提示词，涵盖安全更改、高风险更改和无关请求。
- 一份结合人工检查和自动检查的评估方案。
正在使用“skill-creator”。 使用这些审查备注改进我的文档技能。
预期结果:
一项经过修订的技能，它能够概括反馈、移除薄弱指令、保留原始名称，并列出主要更改。
正在使用“skill-creator”。 版本二是否优于版本一？
预期结果:
- 对代表性输出进行盲测比较。
- 两个版本的通过率、耗时和 token 汇总。
- 基于实测质量和评估方差提出的建议。
安全审计
高风险v9 • 2026/7/23 打开版本化报告
Most findings are scanner false positives caused by Markdown backticks, CSS borders, JavaScript template literals, loopback networking, and ordinary key enumeration. Confirmed risks include unsandboxed nested Claude execution, inherited secrets, forced port termination, browser injection paths, unsafe symlink handling, and shared temporary files. Publication should wait until high-impact execution, XSS, and file disclosure issues are fixed.
18
已扫描文件
5,680
分析行数
28
复核项
0
已忽略误报
已确认安全问题 (6)
高
Untrusted Content Reaches Tool-Capable Nested Agents
Skill content and raw evaluation queries are sent to Claude CLI without an explicit tool denylist. Prompt injection can influence nested agent actions.
Both paths directly interpolate untrusted text and launch Claude CLI. Neither command constrains tools or supplies a minimal environment.
高
Embedded Review Data Can Break Out of Script Context
Serialized run data is inserted directly into a script element. Output containing a closing script tag can inject active HTML or JavaScript.
json.dumps does not escape the HTML closing-script sequence. The resulting string is inserted verbatim inside the template's script element.
高
Raw Template Placeholders Permit HTML Injection
The workflow replaces skill name, description, and evaluation data placeholders without requiring HTML or script-context escaping.
The placeholders occupy raw HTML and JavaScript contexts, while the replacement instructions require direct substitution and specify no escaping.
高
eval-viewer/generate_review.py:121-127eval-viewer/generate_review.py:149-202scripts/package_skill.py:93-100
Symlink Following Can Disclose Files
Viewer generation and packaging follow files found below user-selected directories. Symlinks can include files outside the intended workspace or skill root.
Path.is_file and the subsequent read or archive operation follow symlinks. No resolved-path containment check rejects targets outside the selected root.
中
Skill Name Is Used in a Filesystem Path Without Validation
A skill name from frontmatter becomes part of a command filename. Path separators can escape the intended commands directory.
The name is concatenated into a Path without a slug check or basename normalization. The file is later written and unlinked.
中
Evaluation Artifacts Are Not Marked as Untrusted Data
The grader reads transcripts and output files without instructions to ignore embedded commands. Adversarial outputs can manipulate grading or request unrelated tool actions.
The grader is explicitly directed to read arbitrary artifacts but receives no prompt-injection boundary. Exploitability depends on the hosting agent's tool permissions.
能力复核项 (28)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Python subprocess.run
result = subprocess.run(
The subprocess runs lsof, then line 298 terminates every returned PID for the selected port. A user-selected port can therefore stop an unrelated local service without confirmation.
高
innerHTML assignment (XSS risk)
wrapper.innerHTML = htmlStr;
SheetJS converts workbook content to an HTML string that is assigned to innerHTML. A crafted workbook may place active markup into the local review page unless the generated HTML is sanitized.
高
innerHTML assignment (XSS risk)
container.innerHTML = html;
The benchmark HTML includes several unescaped metadata and configuration values before assignment to innerHTML. A modified benchmark file can inject markup into the review page.
高
Python subprocess.run
result = subprocess.run(
This launches Claude with a prompt containing untrusted skill content and does not disable agent tools. Prompt injection in the reviewed skill can influence the nested agent beyond description rewriting.
高
Python subprocess.Popen
process = subprocess.Popen(
This launches Claude on raw evaluation queries with inherited credentials and no explicit tool restriction. A malicious query can request tool actions before the harness terminates the process.
中
Python environment access
env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}
The nested Claude process inherits every environment variable except CLAUDECODE. This unnecessarily exposes unrelated credentials to a process handling untrusted skill content.
中
Python environment access
env = {k: v for k, v in os.environ.items() if k != "CLAUDECODE"}
Each evaluation subprocess inherits the complete environment except CLAUDECODE. Raw test prompts therefore run in a process that can access unrelated environment secrets.
中
Ruby/shell backtick execution
- **Improving an existing skill**: the old version. Before editing, snapshot the skill (`cp -r <skil
The documented cp command contains unquoted skill and workspace placeholders. Replacing them with a path containing shell metacharacters can alter the command.
中
Ruby/shell backtick execution
```bash
The enclosed shell command passes unquoted workspace and name placeholders. Agent substitution of untrusted path text can cause shell parsing or command injection.
中
Ruby/shell backtick execution
```bash
The enclosed nohup command uses unquoted path placeholders and starts a server in the background. Malicious path text can alter shell execution, and interrupted workflows can leave the process running.
中
Ruby/shell backtick execution
3. Write to a temp file (e.g., `/tmp/eval_review_<skill-name>.html`) and open it: `open /tmp/eval_re
The open command uses an unquoted skill name inside a shared temporary path. Shell metacharacters in the name can change command execution.
中
Ruby/shell backtick execution
```bash
The optimization command uses unquoted file, skill, and model placeholders. Values containing shell syntax can change the intended command when substituted by an agent.
中
Ruby/shell backtick execution
```bash
The packaging command uses an unquoted skill path placeholder. A crafted path can be parsed as shell syntax instead of a single argument.
中
nohup (background persistent process)
nohup python <skill-creator-path>/eval-viewer/generate_review.py \
The workflow intentionally starts the review server with nohup in the background. If the workflow stops before cleanup, the local service remains running.
中
Temp directory access
3. Write to a temp file (e.g., `/tmp/eval_review_<skill-name>.html`) and open it: `open /tmp/eval_re
The instruction creates a predictable HTML filename in the shared temporary directory. Existing symlinks or name collisions can redirect or replace the generated review file.
中
Temp directory access
- **Copy to a writeable location before editing.** The installed skill path may be read-only. Copy t
The update workflow recommends a fixed skill-named directory under shared temporary storage. It does not require exclusive creation or reject an existing symlink.
中
Temp directory access
- **If packaging manually, stage in `/tmp/` first**, then copy to the output directory -- direct wri
Manual packaging is instructed to stage files in shared temporary storage without secure directory creation. A collision or symlink can redirect staged content.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<script src="https://cdn.sheetjs.com/xlsx-0.20.3/package/dist/xlsx.full.min.js" integrity="sha384-En
Opening the viewer loads executable SheetJS code from an external CDN. Integrity metadata limits tampering, but the page still makes an outbound third-party request.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Hardcoded URL
<link href="https://fonts.googleapis.com/css2?family=Poppins:wght@500;600&family=Lora:wght@400;500&d
Opening the generated page contacts Google Fonts. This is expected presentation behavior, but it discloses network metadata and prevents fully offline operation.
低
Temp file creation
live_report_path = Path(tempfile.gettempdir()) / f"skill_description_report_{skill_path.name}_{times
The report uses a predictable shared temporary path based on the skill name and current second. A local attacker can pre-create a symlink and redirect the later write.
风险因素
📁 文件系统访问 (15)
agents/grader.md:83 agents/grader.md:104 scripts/aggregate_benchmark.py:377 scripts/aggregate_benchmark.py:383 scripts/package_skill.py:13 scripts/package_skill.py:39 scripts/package_skill.py:15 scripts/package_skill.py:91 scripts/run_loop.py:13 scripts/run_loop.py:274 SKILL.md:242 SKILL.md:287 SKILL.md:369 SKILL.md:440 SKILL.md:441
⚡ 包含脚本 (9)
⚙️ 外部命令 (50)
assets/eval_review.html:82 assets/eval_review.html:89-99 assets/eval_review.html:126 eval-viewer/generate_review.py:291 eval-viewer/viewer.html:709 eval-viewer/viewer.html:1109 scripts/improve_description.py:35 scripts/improve_description.py:5 scripts/improve_description.py:21 scripts/improve_description.py:161 scripts/run_eval.py:85 scripts/run_eval.py:46 SKILL.md:17 SKILL.md:75-84 SKILL.md:84-101 SKILL.md:101-108 SKILL.md:108-120 SKILL.md:120-127 SKILL.md:127-130 SKILL.md:130-135 SKILL.md:135-145 SKILL.md:145-147 SKILL.md:147-159 SKILL.md:159-161 SKILL.md:161 SKILL.md:165-167 SKILL.md:167 SKILL.md:175-182 SKILL.md:182-185 SKILL.md:185-186 SKILL.md:186 SKILL.md:188-190 SKILL.md:190-197 SKILL.md:197-201 SKILL.md:201-205 SKILL.md:205 SKILL.md:209 SKILL.md:211-217 SKILL.md:217-225 SKILL.md:225 SKILL.md:228-230 SKILL.md:230-231 SKILL.md:231 SKILL.md:234-237 SKILL.md:237-244 SKILL.md:244-245 SKILL.md:245-247 SKILL.md:247 SKILL.md:265-269 SKILL.md:269-271
🌐 网络访问 (16)
assets/eval_review.html:7 assets/eval_review.html:8 assets/eval_review.html:9 eval-viewer/generate_review.py:449 eval-viewer/generate_review.py:443 eval-viewer/generate_review.py:446 eval-viewer/viewer.html:666 eval-viewer/viewer.html:1012 eval-viewer/viewer.html:1044 eval-viewer/viewer.html:7 eval-viewer/viewer.html:8 eval-viewer/viewer.html:9 eval-viewer/viewer.html:10 scripts/generate_report.py:39 scripts/generate_report.py:40 scripts/generate_report.py:41
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/davila7-skill-development/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/davila7-skill-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/davila7-skill-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-skill-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/davila7-skill-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
davila7. (2026). skill-creator security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-skill-development/audits/9BibTeX 引用
@techreport{davila7-davila7-skill-development-2026,
author = {davila7},
title = {skill-creator security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/davila7-skill-development/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "skill-creator security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "davila7"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/davila7-skill-development/audits/9"
identifiers:
- type: other
value: "skillstore:davila7-skill-development:audit:9"
description: "Skillstore immutable audit report identifier"
比较变体
24 个可安装变体每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。
为什么此变体排名第一
Skillstore 评分最高
作者 / 来源 Skillstore 评分 证据置信度 Skillstore 使用量 已更新
daviddworetzky-skill-creator
Skillstore 评分 79
证据置信度 高
Skillstore 使用量 11
已更新
2026-09-09
cesaraugustusgrob-skill-creator
Skillstore 评分 78
证据置信度 高
Skillstore 使用量 11
已更新
2026-09-09
cam10001110101-skill-creator
Skillstore 评分 75
证据置信度 高
Skillstore 使用量 17
已更新
2026-09-09
abdullahmalik17-skill-creator
Skillstore 评分 72
证据置信度 高
Skillstore 使用量 14
已更新
2026-09-09
daothihuong2111-skill-creator
Skillstore 评分 67
证据置信度 高
Skillstore 使用量 13
已更新
2026-09-09
chinchillaenterprises-skill-creator
Skillstore 评分 38
证据置信度 中
Skillstore 使用量 10
已更新
2026-09-09
Skillstore 评分
评分依据 证据置信度: 中 77
架构
85
可维护性
87
内容
72
社区
91
规范符合性
你能构建什么
创建新技能
将重复性工作流转化为结构化指令、资源、测试和可分发的技能包。
改进现有技能
利用用户反馈和评估结果修订指令，并验证所做更改能否改善结果。
比较技能版本
运行基线版本和更新版本，汇总指标，并在选择更优版本之前审查输出。
试试这些提示
创建基础技能
为 [workflow] 创建一个技能。提出必要的问题，草拟 SKILL.md，并提供三个贴近实际的测试提示词。
修订现有技能
审查位于 [path] 的技能。找出指令缺口，保留其名称，修订内容，并解释每一项重要更改。
对技能进行基准测试
使用 [test prompts] 评估位于 [path] 的技能。比较技能输出和基线输出，对断言进行评分，并生成审查报告。
优化触发效果
为位于 [path] 的技能创建均衡的触发测试。与我一起审查这些测试，运行描述优化，并应用在留出测试中表现最佳的结果。
最佳实践
- 使用能反映真实用户表达方式、文件、约束和边界情况的实际提示词。
- 在认定某次修订更优之前，将自动断言与人工审查相结合。
- 将留出测试与描述改进过程分开，以减少过拟合。
避免
- 不要只针对少量简单或重复的测试提示词进行优化。
- 不要仅凭通过率取代主观的人工判断。
- 在审查技能的脚本、权限和生成文件之前，不要打包或发布该技能。
常见问题
它可以从零开始创建技能吗？
可以。它会收集需求、草拟指令、提出测试方案、支持迭代，并可打包完成后的技能。
它可以改进现有技能吗？
可以。它可以保留当前名称、修订指令、比较版本并应用反馈。
它可以配合 Codex 使用吗？
核心的草拟、审查和打包工作流可以配合 Codex 使用。Claude CLI 描述优化仍是 Claude 专属功能。
是否必须使用子智能体？
不是必需的。子智能体可以改善并行评估并增强基线对比的严谨性，但仍可进行较简单的单智能体审查。
它会生成哪些文件？
它可以生成技能指令、评估数据、评分结果、基准测试报告、审查页面、反馈文件和打包后的技能归档文件。
较高的基准测试分数能保证质量吗？
不能保证。分数取决于测试设计和断言。要评估实用性、安全性和泛化能力，仍然需要人工审查。
开发者详情
作者
davila7许可证
MIT
Skillstore 修订
r2
版本提示
作者未声明版本。
引用
c43861a65bb95efcae259cd161c9d6f4dc7eec6f
维护新鲜度
2026/7/26
使用量
5 次下载 · 357 次浏览
davila7 的更多技能
查看全部📦
content-creator
87创建适合 SEO 的营销内容
营销团队需要清晰的内容，以匹配品牌语调和搜索目标。此技能提供模板、分析脚本和平台指南，用于可重复的内容生产。
写作与内容 查看
📦
treatment-plans
86创建结构化医疗治疗计划
临床治疗计划往往会变得不一致、冗长或难以审查。此技能提供重点明确的模板、可衡量的目标、时间表和本地质量检查。
文档 查看
📦
clinical-reports
86创建结构化临床报告
临床团队需要符合医疗和监管标准的清晰报告。此技能为病例报告、诊断、试验和患者记录提供模板、检查清单和验证指导。
文档 查看
📦
exploratory-data-analysis
85分析科学数据文件
科学数据文件很难检查，因为每种格式存储结构和元数据的方式都不同。此技能可检测格式、分析数据质量，并创建实用的 Markdown EDA 报告。
数据与分析 查看
📦
diffdock
85运行 DiffDock 分子对接工作流
分子对接设置经常失败，因为输入、参数和置信度分数很难对齐。此技能会指导从准备到结果审查的 DiffDock 工作流。
研究与学习 查看
相关技能
查看全部📦
building-agents
85构建 Claude Code 智能体
由 C0ntr0lledCha0s
创建可靠的 AI 智能体需要清晰的 schema、安全的工具和可重复的审查步骤。此技能为 Claude Code 工作流中的智能体设计、验证、迁移和维护提供指导。
编码与开发 查看
📦
agent-development
85构建 Claude Code 智能体
由 Dami-Randle
如果缺少结构，设计可靠的 Claude Code 智能体会很困难。此技能为智能体提示词、触发器、工具和元数据提供模板、验证规则和示例。
编码与开发 查看
📦
building-commands
84构建 Claude Code 斜杠命令
由 C0ntr0lledCha0s
团队需要易于调用和审查的可重复 AI 工作流。此技能可帮助创建、更新、验证和记录 Claude Code 斜杠命令。
编码与开发 查看
📦
creating-issues
84创建一致的 GitHub Issue
由 C0ntr0lledCha0s
当不同仓库中的 issue 标题、标签和项目元数据不一致时，团队会浪费时间。此 skill 可指导 Claude、Codex 和 Claude Code 创建一致的 GitHub issue。
编码与开发 查看
📦
golang-performance
82使用性能剖析优化 Go 性能
由 89jobrien
Go 服务在缺少明确证据的情况下可能变得缓慢或占用大量内存。此技能将指导你进行性能剖析、分配分析、并发调优以及基于基准测试的优化。
编码与开发 查看
📦
powershell-expert
81构建可靠的 PowerShell 工具
由 hmohamed01
PowerShell 项目需要一致的结构、安全的参数处理以及最新的模块指导。此技能使用实用的 PowerShell 参考资料，帮助创建脚本、模块和 GUI。
编码与开发 查看