技能 open-skills

📦

open-skills

Name: open-skills
Author: lumacoder

v2.0.0 内容修订 r1 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量⚡ 包含脚本

跨编辑器管理 AI 技能

AI 编码团队通常会为每个编辑器维护单独的技能文件。open-skills 提供一个 CLI，用于发现、安装、同步和管理共享技能内容。

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "open-skills" from https://skillstore.io/skills/lumacoder-open-skills.md and its manifest at https://skillstore.io/api/skills/lumacoder-open-skills/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/lumacoder-open-skills.md 已签名 manifest GET /api/skills/lumacoder-open-skills/manifest 已签名 lockfile GET /api/skills/lumacoder-open-skills/lockfile

测试它

正在使用“open-skills”。为当前项目将两个 frontend 技能安装到 Claude Code 中。

预期结果:

助手打开编辑器、范围、类别和技能选择流程。
它将所选技能写入所选范围的 Claude Code 技能目录下。
它报告哪些技能成功以及哪些失败。

正在使用“open-skills”。导出我当前的 AI 技能设置。

预期结果:

助手检测受支持编辑器中已安装的目录模式技能。
它写入一个之后可导入的 stack 文件。
它解释任何无法自动检测的编辑器目标。

正在使用“open-skills”。创建并验证一个新的技能脚手架。

预期结果:

助手创建一个包含入门技能文件的本地包。
它在注册表中注册技能元数据。
它运行注册表验证并报告任何缺失字段。

安全审计

高风险

v4 • 2026/7/6 打开版本化报告

Most static findings are false positives from Markdown examples, TypeScript import paths, template literals, lockfile metadata, and Unicode text. Confirmed issues are limited to trust-sensitive external network lookups, developer-panel innerHTML rendering, remote skill installation into AI editor targets, and unauthenticated local registry mutation in dev mode. No prompt injection attempt was found in the reviewed files.

已扫描文件

7,200

分析行数

复核项

已忽略误报

已确认安全问题 (4)

高

src/cli.ts:19-20 src/dev-server/api.ts:7-15 src/dev-server/api.ts:46-51 src/dev-server/server.ts:55-56

Unauthenticated Developer Registry Write API

The developer server exposes state-changing registry APIs without authentication and allows all origins. If the server is reachable by untrusted browser content or network clients, registry data can be replaced.

The code directly shows dev-mode startup, wildcard CORS headers, and POST /api/registry writing parsed JSON. Exploitability depends on the dev server running and being reachable.

高

src/core/engine.ts:37-48 src/core/engine.ts:53-76 src/commands/sync.ts:39-67 src/core/adapters/claude-adapter.ts:31-43

Remote Skill Content Installed Into AI Editor Targets

The install and sync flows clone registry-controlled git sources and write transformed skill text into AI editor skill or rule locations. This is expected behavior, but unreviewed remote skill text can influence assistant behavior after installation.

The implementation clones remote origins, reads SKILL.md content, transforms it, and writes it into editor targets. Malicious impact depends on registry content and user selection.

中

src/core/engine.ts:24-31 src/core/adapters/claude-adapter.ts:31-37 src/core/adapters/base-adapter.ts:1-37

Managed Directory Cleanup Before Install

Directory-mode installs call cleanup on the computed editor target before generating output. This can remove files inside managed skill directories when users keep manual files there.

The engine calls cleanDirectory for directory adapters before writing outputs, and adapter code writes into computed target paths. The precise removal logic is in a helper not included in static findings, so confidence is moderate.

中

src/commands/create.ts:15-16 src/commands/create.ts:68-77 src/commands/create.ts:95-100

Create Command Allows Positional Path Traversal

The interactive create flow validates prompted names, but a positional CLI name is accepted before path construction. A local user can pass traversal segments and create files outside the intended bundles directory.

The code validates only the prompted name path and then joins the resulting name into bundles/skills. The issue requires local CLI input, which limits severity.

能力复核项 (21)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

中

src/dev-server/web/index.html:245

innerHTML assignment (XSS risk)

div.innerHTML = `<span class="cat-name">${cat.displayName}</span><span class="cat-count">${count}</s

The developer panel builds HTML from registry-controlled category, skill, or tag values without escaping. A malicious registry entry could execute script in the local panel.

中

src/dev-server/web/index.html:275

innerHTML assignment (XSS risk)

content.innerHTML = `<table><thead><tr><th>名称</th><th>描述</th><th>源</th><th>Tags</th><th>操作</th></tr>

The developer panel builds HTML from registry-controlled category, skill, or tag values without escaping. A malicious registry entry could execute script in the local panel.

中

src/dev-server/web/index.html:358

innerHTML assignment (XSS risk)

document.getElementById('skillCategory').innerHTML = this.data.categories.map((c) => `<option value=

The developer panel builds HTML from registry-controlled category, skill, or tag values without escaping. A malicious registry entry could execute script in the local panel.

低

registry/skills.json:89

Hardcoded URL

"url": "https://github.com/forrestchang/andrej-karpathy-skills.git"

This URL is used as a remote skill or git origin that can be fetched by the CLI. It is expected behavior, but users should review remote content before install.

低

src/commands/sync.ts:40

Hardcoded URL

? `https://github.com/${skill.origin.ref}.git`

This URL is used as a remote skill or git origin that can be fetched by the CLI. It is expected behavior, but users should review remote content before install.

低

src/core/github-utils.ts:35

Fetch API call

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/github-utils.ts:53

Fetch API call

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/github-utils.ts:82

Fetch API call

const res = await fetch(url.toString(), {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/github-utils.ts:106

Fetch API call

const res = await fetch(`https://api.github.com/search/repositories?q=${q}&per_page=${perPage}`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/github-utils.ts:35

Hardcoded URL

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/github-utils.ts:53

Hardcoded URL

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/github-utils.ts:80

Hardcoded URL

const url = new URL(`https://api.github.com/repos/${owner}/${repo}/contents/${path}`);

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/github-utils.ts:106

Hardcoded URL

const res = await fetch(`https://api.github.com/search/repositories?q=${q}&per_page=${perPage}`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/registry-v3.ts:51

Hardcoded URL

url: `https://github.com/${skill.origin.ref}.git`,

This URL is used as a remote skill or git origin that can be fetched by the CLI. It is expected behavior, but users should review remote content before install.

低

src/core/resolvers/github-resolver.ts:14

Fetch API call

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/resolvers/github-resolver.ts:33

Fetch API call

const tagsRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/resolvers/github-resolver.ts:14

Hardcoded URL

const res = await fetch(`https://api.github.com/repos/${owner}/${repo}`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/resolvers/github-resolver.ts:33

Hardcoded URL

const tagsRes = await fetch(`https://api.github.com/repos/${owner}/${repo}/tags?per_page=1`, {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/resolvers/skillstore-resolver.ts:80

Fetch API call

const res = await fetch(skillStoreUrl, { headers: { 'User-Agent': 'open-skills' } });

This code performs an external HTTP request to GitHub or SkillStore metadata endpoints. It is intended functionality, but it expands the trust boundary.

低

src/core/resolvers/skillstore-resolver.ts:71

Hardcoded URL

return `https://skillstore.io/skills/${slug}`;

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

低

src/core/resolvers/skillstore-resolver.ts:114

Hardcoded URL

if (ref.startsWith('https://github.com/')) {

The hardcoded endpoint supports external GitHub or SkillStore lookups. This is not exfiltration, but it is a real network dependency.

风险因素

⚙️ 外部命令 (157)

🌐 网络访问 (42)

docs/PRD-V1.md:185 docs/PRD-V2.md:252 docs/PRD-V3.md:85 package.json:29 package.json:32 package.json:34 README.md:54 README.md:161 README.md:305 registry/_v2_backup/docker-basics.yaml:8 registry/_v2_backup/node-api-design.yaml:8 registry/_v2_backup/react-best-practices.yaml:8 registry/_v2_backup/typescript-patterns.yaml:8 registry/_v2_backup/web-security.yaml:8 registry/skills.json:64 registry/skills.json:89 registry/skills.json:107 src/commands/sync.ts:40 src/core/github-utils.ts:35 src/core/github-utils.ts:53 src/core/github-utils.ts:82 src/core/github-utils.ts:106 src/core/github-utils.ts:35 src/core/github-utils.ts:53 src/core/github-utils.ts:80 src/core/github-utils.ts:106 src/core/registry-v3.ts:51 src/core/resolvers/github-resolver.ts:14 src/core/resolvers/github-resolver.ts:33 src/core/resolvers/github-resolver.ts:14 src/core/resolvers/github-resolver.ts:33 src/core/resolvers/skillstore-resolver.ts:80 src/core/resolvers/skillstore-resolver.ts:71 src/core/resolvers/skillstore-resolver.ts:114 src/dev-server/api.ts:31 src/dev-server/server.ts:19 src/dev-server/server.ts:56 src/dev-server/web/index.html:204 src/dev-server/web/index.html:386 src/dev-server/web/index.html:444 src/dev-server/web/index.html:460 src/dev-server/web/index.html:128

📁 文件系统访问 (151)

🔑 环境变量 (2)

src/cli.ts:19 src/cli.ts:19

⚡ 包含脚本 (7)

src/core/marker-system.ts:27 src/dev-server/web/index.html:239 src/dev-server/web/index.html:245 src/dev-server/web/index.html:256 src/dev-server/web/index.html:261 src/dev-server/web/index.html:275 src/dev-server/web/index.html:358

审计者: codex 查看审计历史 →

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/lumacoder-open-skills/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/lumacoder-open-skills/security.svg)](https://skillstore.io/skills/lumacoder-open-skills?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/lumacoder-open-skills?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/lumacoder-open-skills/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/lumacoder-open-skills.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

lumacoder. (2026). open-skills security audit report (audit version 4) [Author version 2.0.0]. Skillstore. https://skillstore.io/skills/lumacoder-open-skills/audits/4

BibTeX 引用

@techreport{lumacoder-lumacoder-open-skills-2026,
  author = {lumacoder},
  title = {open-skills security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/lumacoder-open-skills/audits/4},
  note = {Author version 2.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "open-skills security audit report (audit version 4)"
version: "2.0.0"
type: report
authors:
  - name: "lumacoder"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/lumacoder-open-skills/audits/4"
identifiers:
  - type: other
    value: "skillstore:lumacoder-open-skills:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

100

可维护性

内容

社区

规范符合性

你能构建什么

标准化团队 AI 编辑器

将相同的已批准技能安装到多个 AI 编码编辑器中，使贡献者共享一致的助手行为。

维护技能注册表

创建、验证、导出、导入和同步一个精选的可复用技能注册表，用于内部工作流。

测试跨编辑器输出

从一个技能源为 Claude Code、Cursor、Cline、Windsurf 及相关工具生成特定编辑器的输出。

试试这些提示

安装所选技能

使用 open-skills 为此工作区将 frontend 和 devops 技能安装到 Claude Code 和 Cursor 中。继续之前解释每个提示选项。

查找相关技能

在 open-skills 注册表中搜索与测试和 API 设计相关的技能。总结最匹配的技能以及它们可以面向的编辑器。

创建本地技能

在 backend 类别中创建一个名为 api-review-checklist 的新本地技能脚手架。解释创建了哪些文件以及如何验证它。

审计并同步来源

检查注册表中的远程 git 或 GitHub 来源。识别哪些技能可以同步，然后为一个所选技能运行最安全的同步计划。

最佳实践

在将远程技能内容安装到全局编辑器目录之前先进行审查。
测试新技能或注册表变更时，优先使用本地范围。
在执行 install、update、sync 或 import 命令之前，备份现有编辑器规则文件和技能目录。

避免

不要在共享或暴露的网络接口上运行开发者 Web 面板。
不要将未经审查的远程技能直接安装到全局 AI 编辑器目录中。
不要在托管的编辑器技能目录中存储个人文件。

常见问题

open-skills 支持哪些编辑器？

它面向 Claude Code、Hermes、Cursor、Windsurf、Cline、Cursor Skills、Roo-Cline、Antigravity 和 GitHub Copilot。

它会下载远程内容吗？

是。搜索、解析器、同步和安装路径可以获取 GitHub、SkillStore 或 git 支持的技能来源。

它会覆盖现有编辑器文件吗？

它会拒绝某些适配器的未托管规则文件，但目录安装会清理预期托管集合之外的文件。

开发者 Web 面板适合生产使用吗？

否。它是一个本地开发工具，启动后会暴露未经身份验证的注册表 API。

它可以创建新技能吗？

是。create 命令和开发者面板会生成入门技能文件和注册表条目。

它能与 Codex 配合使用吗？

元数据标记了 Codex 支持，并且 CLI 可以为 Codex 工作流管理共享 AI agent 技能内容。

开发者详情

作者

lumacoder

许可证

MIT

作者版本

v2.0.0

Skillstore 修订

仓库

https://github.com/lumacoder/open-skills/tree/main/

引用

b8ca75d2c0a7e7102978993058777d82b8ab2610

维护新鲜度

2026/7/18

使用量

6 次下载 · 157 次浏览

文件结构

📁 docs/

📄 ide-engine.md

📄 PRD-V1.md

📄 PRD-V2.md

📄 PRD-V3.md

📁 registry/

📁 _v2_backup/

📄 _index.yaml

📄 docker-basics.yaml

📄 node-api-design.yaml

📄 react-best-practices.yaml

📄 test.yaml

📄 typescript-patterns.yaml

📄 web-security.yaml

📄 skills.json

📁 scripts/

📄 validate-registry.ts

📁 src/

📁 commands/

📄 create.ts

📄 dev-panel.ts

📄 export.ts

📄 import.ts

📄 install.ts

📄 list.ts

📄 migrate.ts

📄 search.ts

📄 sync.ts

📄 update.ts

📄 validate.ts

📁 core/

📁 adapters/

📄 antigravity-adapter.ts

📄 base-adapter.ts

📄 claude-adapter.ts

📄 cline-adapter.ts

📄 cursor-adapter.ts

📄 cursor-skills-adapter.ts

📄 hermes-adapter.ts

📄 index.ts

📄 roo-cline-adapter.ts

📄 windsurf-adapter.ts

📁 dev/

📄 scaffold.ts

📁 presets/

📄 editors.ts

📁 resolvers/

📄 clawhub-resolver.ts

📄 github-resolver.ts

📄 remote-resolver.ts

📄 skillstore-resolver.ts

📄 cleaner.ts

📄 engine.ts

📄 fs-utils.ts

📄 github-utils.ts

📄 marker-system.ts

📄 registry-v3.ts

📄 registry.ts

📄 transformer.ts

📄 validator.ts

📁 dev-server/

📁 web/

📄 index.html

📄 api.ts

📄 server.ts

📁 types/

📄 index.ts

📁 ui/

📄 category-select.ts

📄 confirm-panel.ts

📄 editor-select.ts

📄 scope-select.ts

📄 skill-select.ts

📄 cli.ts

📄 package.json

📄 pnpm-lock.yaml

📄 README.md

📄 SKILL.md

📄 tsconfig.json

📄 tsup.config.ts