技能 when-validating-code-works-use-functionality-audit
📦

when-validating-code-works-use-functionality-audit

内容修订 r1 高风险 ⚙️ 外部命令📁 文件系统访问🌐 网络访问🔑 环境变量

通过运行时审计验证代码功能

代码看起来可能已经完整，却在运行时失败。此技能会指导沙盒设置、测试执行、调试、回归检查和报告编写。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "when-validating-code-works-use-functionality-audit" from https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-validating-code-works-use-functionality-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/dnyoussef-when-validating-code-works-use-functionality-audit.md 已签名 manifest GET /api/skills/dnyoussef-when-validating-code-works-use-functionality-audit/manifest 已签名 lockfile GET /api/skills/dnyoussef-when-validating-code-works-use-functionality-audit/lockfile

测试它

正在使用“when-validating-code-works-use-functionality-audit”。 在生成的更改后验证身份验证模块。

预期结果:

  • 审计状态：部分通过。
  • 单元测试已通过，但两个集成检查在令牌刷新行为上失败。
  • 建议修复：更新刷新处理，并重新运行身份验证回归套件。

正在使用“when-validating-code-works-use-functionality-audit”。 合并前检查数据处理函数。

预期结果:

  • 审计状态：通过。
  • 正常路径、缺失字段和格式无效情况均已通过。
  • 覆盖率有所提升，且相关测试中未检测到回归。

正在使用“when-validating-code-works-use-functionality-audit”。 审查服务更改的部署就绪状态。

预期结果:

  • 审计状态：未就绪。
  • 该服务通过了本地单元测试，但未通过一个生产就绪门禁。
  • 建议操作：在部署前解决失败的健康检查场景。

安全审计

高风险
v12 • 2026/7/9 打开版本化报告

Most static findings are false positives from Markdown formatting, Graphviz labels, local test imports, and dummy environment examples. The confirmed risks are operational: the skill runs external commands, installs dependencies, mounts workspaces into Docker, deletes a fixed temporary directory, and stores audit artifacts in shared memory. No prompt injection attempt was found in the reviewed files.

4
已扫描文件
1,927
分析行数
23
复核项
0
已忽略误报

已确认安全问题 (2)

高
SKILL.md:74-79SKILL.md:156-161SKILL.md:638
Untrusted Code Execution Workflow
The skill instructs users to create a sandbox, install packages, and run project tests. Package lifecycle scripts and tests can execute arbitrary code, and the Docker fallback mounts the current workspace.
The cited workflow directly installs dependencies, runs tests, and mounts the workspace into Docker. These are legitimate audit actions, but they execute untrusted project and package code.
中
PROCESS.md:221-226SKILL.md:406SKILL.md:615
Persistent Storage of Audit Artifacts
The workflow stores logs, reports, and metrics in Claude Flow memory. These artifacts can contain secrets, stack traces, file paths, or implementation details from the audited project.
The cited lines store execution metrics, full test logs, and final reports in shared memory. The risk depends on log contents, so confidence is high but not absolute.
能力复核项 (23)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
SKILL.md:638
Shell command substitution
docker run -it --rm -v $(pwd):/workspace node:18 bash
The Docker fallback mounts the current working directory into a container. This reduces host dependency conflicts, but the container can read and modify mounted project files.
中
PROCESS.md:129
Shell command substitution
SANDBOX_CONFIG=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-1/tester/s
This retrieves sandbox configuration by executing npx claude-flow from a shell command. It is expected for the workflow, but it is still external command execution from a community skill.
中
PROCESS.md:130
Shell command substitution
cd $(echo $SANDBOX_CONFIG | jq -r '.path')
The workflow changes directory using a path read from shared memory without validation or quoting. A bad or stale path could redirect later file operations outside the intended sandbox.
中
PROCESS.md:221
Shell command substitution
--value "$(cat execution-metrics.json)"
The command persists generated execution metrics into Claude Flow memory. This is part of the workflow, but it can move audit data outside the temporary workspace.
中
PROCESS.md:226
Shell command substitution
--value "$(cat test-output.log | base64)"
The command base64-encodes full test logs and stores them in Claude Flow memory. Test logs can include secrets, paths, stack traces, or customer data.
中
PROCESS.md:251
Shell command substitution
EXEC_RESULTS=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-2/tester/exe
This retrieves execution results through npx claude-flow during the audit. The external command is intentional, but it increases the trust required for the skill runtime.
中
PROCESS.md:379
Shell command substitution
--value "$(cat issue-categories.json)"
The workflow stores issue analysis from a generated file into Claude Flow memory. The file may include sensitive code paths or failure details from the audited project.
中
PROCESS.md:383
Shell command substitution
--value "$(cat fix-strategy.json)"
The workflow stores a generated fix strategy into Claude Flow memory. This can persist project-specific implementation details beyond the sandbox.
中
PROCESS.md:408
Shell command substitution
FIX_STRATEGY=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-3/coder/fix-
This retrieves fix strategy data through npx claude-flow. The external command is expected, but it depends on trusted shared memory state.
中
PROCESS.md:484
Shell command substitution
--value "$(cat production-readiness.json)"
The workflow stores production readiness output in Claude Flow memory. Readiness files can contain project names, paths, and deployment context.
中
PROCESS.md:509
Shell command substitution
SANDBOX_CONFIG=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-1/tester/s
This retrieves sandbox configuration through npx claude-flow for final reporting. The report generation step depends on trusted shared memory state.
中
PROCESS.md:510
Shell command substitution
EXEC_RESULTS=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-2/tester/exe
This retrieves execution results through npx claude-flow for final reporting. The external command can expose audit state if the memory backend is not trusted.
中
PROCESS.md:511
Shell command substitution
ROOT_CAUSES=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-3/coder/root-
This retrieves root-cause data through npx claude-flow for final reporting. The retrieved data may include sensitive failure context from the project.
中
PROCESS.md:512
Shell command substitution
READINESS=$(npx claude-flow memory retrieve --key "testing/functionality-audit/phase-4/validator/rea
This retrieves readiness data through npx claude-flow for final reporting. The external command and shared memory use require trust in the local toolchain.
中
PROCESS.md:605
Shell command substitution
--value "$(cat functionality-audit-report.md)"
The workflow stores the full audit report in Claude Flow memory. Audit reports can contain logs, paths, test names, and implementation details.
中
PROCESS.md:609
Shell command substitution
--value "$(cat audit-metrics.json)"
The workflow stores audit metrics in Claude Flow memory. Metrics can expose project structure and test readiness information.
中
README.md:110
Temp directory access
rm -rf /tmp/audit-sandbox
The troubleshooting step uses rm -rf on a fixed temporary directory. It is scoped to /tmp, but destructive cleanup commands should still be treated carefully.
中
SKILL.md:161
Shell command substitution
npx claude-flow memory store --key "testing/functionality-audit/phase-2/tester/execution-results" --
This stores execution results through npx claude-flow after running tests. It is expected, but it persists audit state outside the test command itself.
中
SKILL.md:232
Shell command substitution
npx claude-flow memory store --key "testing/functionality-audit/phase-3/coder/root-causes" --value "
This stores generated root-cause analysis through npx claude-flow. The stored content can include project-specific failure details.
中
SKILL.md:305
Shell command substitution
npx claude-flow memory store --key "testing/functionality-audit/phase-4/validator/readiness" --value
This stores production readiness data through npx claude-flow. The data can contain deployment and test context that should be controlled.
中
SKILL.md:406
Shell command substitution
npx claude-flow memory store --key "testing/functionality-audit/final-report" --value "$(cat functio
This stores a complete functionality audit report through npx claude-flow. Reports can contain logs, paths, test output, and implementation details.
中
SKILL.md:615
Shell command substitution
--value "$(cat functionality-audit-report.md)"
This shares the audit report with another workflow through Claude Flow memory. Cross-skill sharing can propagate sensitive audit artifacts if logs are not redacted.
中
SKILL.md:79
Standard device file access
npm install --save-dev jest @types/jest ts-node typescript 2>/dev/null || true
The line installs npm development dependencies in the audit environment. npm installs can execute package lifecycle scripts, so this is real operational risk even though output is redirected.

风险因素

⚙️ 外部命令 (50)
PROCESS.md:153-156 PROCESS.md:165-169 PROCESS.md:572 PROCESS.md:573-574 PROCESS.md:574-575 PROCESS.md:575-576 PROCESS.md:576-582 PROCESS.md:32 PROCESS.md:34 PROCESS.md:129 PROCESS.md:130 PROCESS.md:197 PROCESS.md:200 PROCESS.md:201 PROCESS.md:202 PROCESS.md:212 PROCESS.md:221 PROCESS.md:226 PROCESS.md:251 PROCESS.md:252 PROCESS.md:379 PROCESS.md:383 PROCESS.md:408 PROCESS.md:424 PROCESS.md:425 PROCESS.md:428 PROCESS.md:431 PROCESS.md:442 PROCESS.md:456 PROCESS.md:457 PROCESS.md:463 PROCESS.md:468 PROCESS.md:469 PROCESS.md:470 PROCESS.md:484 PROCESS.md:509 PROCESS.md:510 PROCESS.md:511 PROCESS.md:512 PROCESS.md:520 PROCESS.md:521 PROCESS.md:525 PROCESS.md:526 PROCESS.md:527 PROCESS.md:528 PROCESS.md:534 PROCESS.md:535 PROCESS.md:540 PROCESS.md:541 PROCESS.md:542
📁 文件系统访问 (26)
PROCESS.md:150 PROCESS.md:166 PROCESS.md:267 PROCESS.md:291 PROCESS.md:154 PROCESS.md:166 PROCESS.md:267 PROCESS.md:291 PROCESS.md:157 PROCESS.md:137 PROCESS.md:704 PROCESS.md:32 PROCESS.md:33 README.md:79 README.md:80 README.md:110 README.md:111 SKILL.md:707 SKILL.md:78 SKILL.md:79 SKILL.md:74 SKILL.md:75 SKILL.md:461 SKILL.md:462 SKILL.md:699 SKILL.md:700
🌐 网络访问 (2)
SKILL.md:711 SKILL.md:717
🔑 环境变量 (3)
SKILL.md:654 SKILL.md:650 SKILL.md:649
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-validating-code-works-use-functionality-audit/security.svg)](https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-validating-code-works-use-functionality-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-validating-code-works-use-functionality-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

DNYoussef. (2026). when-validating-code-works-use-functionality-audit security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit/audits/12

BibTeX 引用

@techreport{dnyoussef-dnyoussef-when-validating-code-works-use-functionality-audit-2026, author = {DNYoussef}, title = {when-validating-code-works-use-functionality-audit security audit report (audit version 12)}, institution = {Skillstore}, year = {2026}, number = {12}, url = {https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit/audits/12}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "when-validating-code-works-use-functionality-audit security audit report (audit version 12)" version: "unspecified" type: report authors: - name: "DNYoussef" date-released: "2026-07-09" url: "https://skillstore.io/skills/dnyoussef-when-validating-code-works-use-functionality-audit/audits/12" identifiers: - type: other value: "skillstore:dnyoussef-when-validating-code-works-use-functionality-audit:audit:12" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
70
社区
74
规范符合性

你能构建什么

验证 AI 生成的功能

在审查或合并之前，使用真实输入运行生成的代码。

检查发布就绪状态

在生产部署之前确认测试、覆盖率和回归情况。

调试已报告的失败

对失败的测试进行分类，并通过可重复的审计流程指导修复。

试试这些提示

运行基础审计 
使用此技能验证已更改的模块。创建临时测试工作区，运行现有测试，并报告失败及后续步骤。
审计新功能 
使用此技能通过真实的正常路径、边界情况和错误输入来测试新功能。捕获日志、覆盖率和回归结果。
调试失败的测试 
使用此技能按根因对失败进行分类，提出最小修复，逐步应用修复，并重新运行受影响的测试。
准备发布证据 
使用此技能运行完整的功能审计，验证就绪标准，识别剩余风险，并生成简洁的发布报告。

最佳实践

  • 在一次性工作区中运行审计，并且只包含验证所需的文件。
  • 记录命令、退出码、日志和覆盖率，以便结果可以复现。
  • 每次修复后重新运行之前通过的测试，以尽早发现回归。

避免

  • 在没有隔离或确认的情况下，在主机上运行不受信任的项目。
  • 接受只断言占位成功的生成测试。
  • 在修复后未重新运行测试就报告就绪状态。

常见问题

此技能解决什么问题？
它有助于验证代码在运行时是否正常工作，而不是仅依赖静态审查或视觉检查。
它会写入或运行文件吗？
是。该工作流包括创建测试产物、安装依赖项，并在临时工作区中运行测试。
它能验证第三方代码吗？
可以，但第三方代码应在更强的隔离环境中运行，因为测试和包脚本可能执行任意命令。
哪些技术栈覆盖得最好？
示例重点覆盖 Node.js、Jest、TypeScript 和 pytest，并可适配其他测试框架。
它会取代 CI 管道吗？
不能。它通过指导本地或代理辅助审计，并为后续自动化生成证据来补充 CI。
用户在运行它之前应审查什么？
用户应审查依赖项安装、测试命令、Docker 挂载，以及任何存储在沙盒之外的日志。

开发者详情

作者

DNYoussef

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/testing-quality/when-validating-code-works-use-functionality-audit

引用

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

维护新鲜度

2026/7/18

使用量

4 次下载 · 200 次浏览

文件结构

📄 process-diagram.gv

📄 PROCESS.md

📄 README.md

📄 SKILL.md

DNYoussef 的更多技能

查看全部

相关技能

查看全部