技能 decision-records

📦

decision-records

Name: decision-records
Author: skymavis

内容修订 r1 高风险 📁 文件系统访问⚙️ 外部命令🌐 网络访问

Manage Decision Records Consistently

Decision records become stale when identifiers, links, and lifecycle states drift. This skill manages drafts, promotions, indexes, validation, and cross-references.

支持: Claude Codex Code(CC)

⚠️ 38 差

安装前请停下并请求确认。

请审查安装计划，并在更改文件前获得用户明确同意。

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求

Review the Skillstore skill "decision-records" from https://skillstore.io/skills/skymavis-decision-records.md and its manifest at https://skillstore.io/api/skills/skymavis-decision-records/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/skymavis-decision-records.md 已签名 manifest GET /api/skills/skymavis-decision-records/manifest 已签名 lockfile GET /api/skills/skymavis-decision-records/lockfile

测试它

正在使用“decision-records”。 Draft a decision to standardize PostgreSQL for transactional services.

预期结果:

A draft decision with context, PostgreSQL as the proposed choice, evaluated alternatives, consequences, risks, and a four-letter draft identifier.

正在使用“decision-records”。 Check the decision registry before merge.

预期结果:

A concise validation result listing stale indexes, invalid metadata, broken references, or a successful check when no issues remain.

正在使用“decision-records”。 Promote the approved authentication draft.

预期结果:

A numbered accepted record, refreshed inbound links, an updated index, and a final validation result after explicit approval.

安全审计

高风险

v1 • 2026/8/25 打开版本化报告

All 288 static alerts are false positives caused by Markdown backticks, draft mnemonics, relative links, placeholder URLs, or argument-array Git subprocesses. Manual review found a high-severity persistent agent-instruction pattern and a medium-severity installer overwrite risk.

已扫描文件

3,006

分析行数

复核项

已忽略误报

已确认安全问题 (2)

高

templates/AGENTS.md:3-9 scripts/decisions.py:1356-1363

Prompt Injection Attempt Detected

The scaffold says "The skill is authoritative" and "when this file and the skill disagree, the skill wins." This persistent priority claim can override repository instructions and steer future agents toward installing or obeying the skill.

The template explicitly claims instruction precedence, and the installer writes a binding agent directive into a root AGENTS.md when none exists.

中

scripts/decisions.py:1322-1324

Installer Deletes an Existing Project Script

Installation unlinks an existing scripts/decisions.py before creating the skill symlink. This can destroy an unrelated tracked or untracked project script without backup or confirmation.

The code unconditionally calls unlink when the destination exists, including regular files, despite nearby documentation claiming installation never overwrites files.

风险因素

📁 文件系统访问 (26)

⚙️ 外部命令 (50)

🌐 网络访问 (3)

scripts/decisions.py:1217 tests/test_decisions.py:514 tests/test_decisions.py:524

审计者: codex

分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告

复制报告链接

https://skillstore.io/skills/skymavis-decision-records/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/skymavis-decision-records/security.svg)](https://skillstore.io/skills/skymavis-decision-records?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/skymavis-decision-records?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/skymavis-decision-records/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/skymavis-decision-records.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学术引用 (APA · BibTeX · CFF)

APA 引用

skymavis. (2026). decision-records security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/skymavis-decision-records/audits/1

BibTeX 引用

@techreport{skymavis-skymavis-decision-records-2026,
  author = {skymavis},
  title = {decision-records security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/skymavis-decision-records/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "decision-records security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "skymavis"
date-released: "2026-08-25"
url: "https://skillstore.io/skills/skymavis-decision-records/audits/1"
identifiers:
  - type: other
    value: "skillstore:skymavis-decision-records:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据证据置信度: 中

架构

可维护性

内容

社区

规范符合性

你能构建什么

Capture Architecture Decisions

Create structured drafts for technical choices, alternatives, consequences, and related records.

Maintain Governance Records

Track policy, legal, security, or operational decisions through accepted and retired states.

Validate Documentation in CI

Detect stale indexes, broken links, invalid metadata, duplicate identifiers, and lifecycle inconsistencies before merge.

试试这些提示

Create a Decision Draft

Create a decision draft about [topic]. Include context, the proposed decision, rationale, alternatives, consequences, risks, and relevant record references.

Review a Draft

Review draft [ID] for complete front matter, clear rationale, realistic alternatives, consequences, unresolved risks, and valid decision references. Suggest focused edits.

Prepare an Approved Promotion

I approve promoting draft [ID]. Check dependencies and replacement effects, show the planned changes, then promote it and validate the decision registry.

Supersede a Decision Safely

Draft a replacement for decision [ID] using these changes: [changes]. Map affected references, explain consequences, and wait for approval before promotion.

最佳实践

Keep each record focused on one decision with explicit context, alternatives, consequences, and deciders.
Reference records by identifier and regenerate links and the index after lifecycle changes.
Review promotion plans and obtain explicit approval before accepting or superseding records.

避免

Do not edit generated indexes or generated record links by hand.
Do not rewrite an accepted decision to change direction; create a superseding record.
Do not promote drafts with unresolved references, incomplete metadata, or missing human approval.