技能 github-multi-repo
📦

github-multi-repo

内容修订 r2 高风险 ⚙️ 外部命令🌐 网络访问📁 文件系统访问🔑 环境变量

大规模协调 GitHub 仓库

管理多个仓库中的变更可能导致漂移并遗漏测试。此技能引导 Claude、Codex 或 Claude Code 完成协调式发现、同步、依赖更新、架构检查和 PR 工作流。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "github-multi-repo" from https://skillstore.io/skills/ruvnet-github-multi-repo.md and its manifest at https://skillstore.io/api/skills/ruvnet-github-multi-repo/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/ruvnet-github-multi-repo.md 已签名 manifest GET /api/skills/ruvnet-github-multi-repo/manifest 已签名 lockfile GET /api/skills/ruvnet-github-multi-repo/lockfile

测试它

正在使用“github-multi-repo”。 查找需要依赖更新的 TypeScript 服务。

预期结果:

按包使用情况、更新优先级、测试覆盖率和拉取请求就绪情况分组的仓库列表。

正在使用“github-multi-repo”。 在多个仓库中标准化集成工作流。

预期结果:

描述目标工作流文件、分支名称、审查负责人和验证步骤的变更计划。

正在使用“github-multi-repo”。 协调一次跨仓库功能发布。

预期结果:

包含受影响仓库、分配角色、测试状态和合并顺序的发布协调摘要。

安全审计

高风险
v8 • 2026/7/23 打开版本化报告

Most static alerts are false positives from Markdown fences, template delimiters, documentation links, and expected webhook secret access. Confirmed risks involve predictable shared temporary paths and unisolated npm execution. Broad multi-repository writes also lack explicit approval gates.

1
已扫描文件
863
分析行数
18
复核项
0
已忽略误报

已确认安全问题 (2)

高
SKILL.md:102-118SKILL.md:367-389SKILL.md:419-440
Unisolated execution of repository scripts
Bulk workflows run npm update, install, audit fixes, and tests from cloned repositories. Package lifecycle or test scripts receive the agent environment and credentials.
The cited workflows explicitly clone repositories and invoke npm commands without a sandbox, restricted environment, or disabled lifecycle scripts.
中
SKILL.md:110-117SKILL.md:148-157SKILL.md:367-389SKILL.md:427-440
Broad repository mutations lack approval gates
Examples create branches, upload files, install dependencies, push commits, and open pull requests across repository sets without an explicit review or confirmation step.
The documented flows perform write operations immediately after tests or scans. No dry run, change preview, or user approval gate is shown.
能力复核项 (18)

这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。

高
SKILL.md:429
Shell command substitution
cd /tmp/$(basename $repo .json | sed 's/audit-//')
The working directory is derived from an untrusted shared /tmp filename without validation. Directory planting can redirect later npm and git operations.
高
SKILL.md:102-118
Template literal with command substitution
Bash(`cat /tmp/repos.txt | while read -r repo; do
The Bash block clones repositories and runs npm update and npm test without isolation. Repository lifecycle and test scripts execute with the agent's credentials.
高
SKILL.md:427-440
Template literal with command substitution
Bash(`for repo in /tmp/audit-*.json; do
The Bash loop trusts shared /tmp audit files, then runs npm audit fix and npm test in derived directories. Planted files can redirect code execution.
高
SKILL.md:104
Temp directory access
cd /tmp/$repo
The script enters a predictable /tmp directory without checking clone success, then runs npm commands. Directory planting can cause arbitrary local script execution.
高
SKILL.md:369
Temp directory access
cd /tmp/$repo
The workflow enters a predictable /tmp directory without checking clone success, then runs npm install and tests. A planted directory can execute scripts.
高
SKILL.md:422
Temp directory access
cd /tmp/$repo
The workflow enters a predictable /tmp directory without verifying the clone, then invokes npm. A planted directory can redirect subsequent execution.
高
SKILL.md:427
Temp directory access
Bash(`for repo in /tmp/audit-*.json; do
The patch loop trusts every file matching a shared /tmp glob. An attacker can plant an audit file and corresponding directory to trigger npm execution.
高
SKILL.md:429
Temp directory access
cd /tmp/$(basename $repo .json | sed 's/audit-//')
The patch directory is derived from a shared temporary filename without validation. Directory planting can redirect npm and git mutations.
中
SKILL.md:428
Shell command substitution
if [ $(jq '.vulnerabilities | length' $repo) -gt 0 ]; then
The jq substitution consumes an unquoted filename selected from a shared /tmp glob. A planted filename can alter audit processing and patch decisions.
中
SKILL.md:180-184
Template literal with command substitution
Bash(`gh api repos/:owner/:repo/contents/claude-code-flow/CLAUDE.md \
The helper uploads content read from a predictable shared temporary file. Another local process can replace that content before publication.
中
SKILL.md:99
Temp directory access
--jq '.[] | select(.name | test("-service$")) | .name' > /tmp/repos.txt`)
The command overwrites the predictable shared path /tmp/repos.txt. A symlink or concurrent run can redirect or corrupt the repository list.
中
SKILL.md:102
Temp directory access
Bash(`cat /tmp/repos.txt | while read -r repo; do
The workflow trusts repository names read from predictable /tmp/repos.txt. Another process can alter the list before cloning and mutation.
中
SKILL.md:103
Temp directory access
gh repo clone org/$repo /tmp/$repo -- --depth=1
Repositories are cloned into predictable shared /tmp directories without exclusive creation. Existing directories or concurrent runs can alter workflow behavior.
中
SKILL.md:177
Temp directory access
--jq '.content' | base64 -d > /tmp/claude-source.md`)
Redirection writes to predictable /tmp/claude-source.md. A symlink can redirect the write, and another process can replace the synchronized content.
中
SKILL.md:184
Temp directory access
-f content="$(cat /tmp/claude-source.md | base64)"`)
The GitHub update reads from predictable /tmp/claude-source.md. Local tampering can publish unauthorized documentation content.
中
SKILL.md:368
Temp directory access
gh repo clone org/$repo /tmp/$repo -- --depth=1
Repositories are cloned into predictable shared /tmp directories without collision handling. A concurrent or planted directory can affect the update workflow.
中
SKILL.md:421
Temp directory access
gh repo clone org/$repo /tmp/$repo -- --depth=1
Security scans clone repositories into predictable shared /tmp directories. The workflow does not prevent collisions or planted directories.
中
SKILL.md:423
Temp directory access
npm audit --json > /tmp/audit-$repo.json
Audit output is written to a predictable shared /tmp filename. Symlinks, stale files, or concurrent runs can corrupt later patch decisions.

风险因素

⚙️ 外部命令 (50)
SKILL.md:30-42 SKILL.md:42-45 SKILL.md:45-51 SKILL.md:51-54 SKILL.md:54-60 SKILL.md:60-67 SKILL.md:67-69 SKILL.md:71-74 SKILL.md:78-86 SKILL.md:86-89 SKILL.md:89-98 SKILL.md:99-102 SKILL.md:118-127 SKILL.md:127-132 SKILL.md:132-148 SKILL.md:150-153 SKILL.md:157-169 SKILL.md:169-172 SKILL.md:172-176 SKILL.md:177-180 SKILL.md:184-192 SKILL.md:192-195 SKILL.md:195-215 SKILL.md:227-228 SKILL.md:228-233 SKILL.md:233-250 SKILL.md:254-266 SKILL.md:266-269 SKILL.md:269-315 SKILL.md:315-318 SKILL.md:318-327 SKILL.md:327-328 SKILL.md:337-342 SKILL.md:342-347 SKILL.md:347-351 SKILL.md:355-358 SKILL.md:364-367 SKILL.md:389-390 SKILL.md:390-393 SKILL.md:393-412 SKILL.md:412-415 SKILL.md:415-419 SKILL.md:424-427 SKILL.md:440-441 SKILL.md:441-446 SKILL.md:446-477 SKILL.md:477-480 SKILL.md:480-497 SKILL.md:497-502 SKILL.md:502-518
🌐 网络访问 (3)
SKILL.md:507 SKILL.md:854 SKILL.md:855
📁 文件系统访问 (17)
SKILL.md:203 SKILL.md:327 SKILL.md:77 SKILL.md:360 SKILL.md:99 SKILL.md:102 SKILL.md:103 SKILL.md:104 SKILL.md:177 SKILL.md:184 SKILL.md:368 SKILL.md:369 SKILL.md:421 SKILL.md:422 SKILL.md:423 SKILL.md:427 SKILL.md:429
🔑 环境变量 (2)
SKILL.md:508 SKILL.md:508
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/ruvnet-github-multi-repo/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/ruvnet-github-multi-repo/security.svg)](https://skillstore.io/skills/ruvnet-github-multi-repo?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/ruvnet-github-multi-repo?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/ruvnet-github-multi-repo/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/ruvnet-github-multi-repo.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

ruvnet. (2026). github-multi-repo security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/ruvnet-github-multi-repo/audits/8

BibTeX 引用

@techreport{ruvnet-ruvnet-github-multi-repo-2026, author = {ruvnet}, title = {github-multi-repo security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/ruvnet-github-multi-repo/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "github-multi-repo security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "ruvnet" date-released: "2026-07-23" url: "https://skillstore.io/skills/ruvnet-github-multi-repo/audits/8" identifiers: - type: other value: "skillstore:ruvnet-github-multi-repo:audit:8" description: "Skillstore immutable audit report identifier"

比较变体

2 个可安装变体

每位作者的技能都保持为独立的可安装项。推荐变体按 Skillstore 证据排序。

为什么此变体排名第一

Skillstore 使用量更高
ruvnet 推荐 当前

ruvnet-github-multi-repo

Skillstore 评分 38
证据置信度 中
Skillstore 使用量 11
已更新

2026-09-09

Claude Flow Team

dnyoussef-github-multi-repo

Skillstore 评分 38
证据置信度 中
Skillstore 使用量 9
已更新

2026-09-09

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
72
社区
74
规范符合性

你能构建什么

同步服务依赖

在多个服务仓库中更新共享包、运行测试，并准备协调一致的拉取请求。

标准化仓库架构

在 GitHub 组织内创建共享模板、工作流文件和配置约定。

协调跨团队发布

跟踪多仓库变更、分配 specialist agents，并报告前端、后端和共享库的就绪情况。

试试这些提示

映射相关仓库 
使用 github-multi-repo 技能为我的组织识别相关仓库。总结语言、包文件和可能的依赖项。
规划依赖同步 
使用 github-multi-repo 技能规划这些仓库之间的依赖同步。包括测试、分支、拉取请求和回滚检查。
标准化项目结构 
使用 github-multi-repo 技能比较仓库结构，并为工作流、文档和包设置提出标准模板。
编排安全补丁 
使用 github-multi-repo 技能在所有受影响仓库中协调安全补丁。写入前需要批准，并列出验证步骤。

最佳实践

  • 在克隆、编辑或推送变更之前，先从只读发现开始。
  • 对组织范围的操作使用 allowlists、小批次和分支保护。
  • 在打开拉取请求之前，审查生成的工作流和配置变更。

避免

  • 不要在没有 allowlist 的情况下对每个仓库运行大范围更新命令。
  • 不要在未经安全和所有权审查的情况下推送生成的工作流变更。
  • 不要在日志或报告中暴露 webhook secrets、tokens 或仓库数据。

常见问题

此技能需要哪些工具？
它需要 GitHub CLI、git、npm、jq、claude-flow，以及兼容的 AI 工具，例如 Claude、Codex 或 Claude Code。
它可以进行仓库变更吗？
可以。多个工作流描述了克隆仓库、编辑文件、创建分支、推送提交和打开拉取请求。
它是否仅限于一个仓库？
不是。它设计用于在许多相关 GitHub 仓库之间进行协调工作。
它是否处理包同步？
可以。它包括依赖对齐、文档同步、包更新、测试和拉取请求的模式。
应该使用哪些权限？
对所选仓库和操作使用所需权限最低的 GitHub token 或账户。
变更是否应该经过审查？
应该。在合并或部署之前审查生成的提交、工作流和配置文件。

开发者详情

作者

ruvnet

许可证

MIT

Skillstore 修订

r2

版本提示

作者未声明版本。

仓库

https://github.com/ruvnet/claude-flow/tree/main/.claude/skills/github-multi-repo

引用

ebdfe608f5de2b66ff37ab4af12af8ac4f5e8006

维护新鲜度

2026/7/27

使用量

7 次下载 · 337 次浏览

文件结构

📄 SKILL.md

ruvnet 的更多技能

查看全部

相关技能

查看全部