技能 web-development
📦
web-development
v2.23.8 内容修订 r1 高风险 ⚙️ 外部命令🔑 环境变量🌐 网络访问📁 文件系统访问
构建可靠的 Web 前端
当前端工作把框架约定、浏览器验证和部署规则混在一起时，往往容易失败。此技能为 React、Vue、Vite 和 CloudBase Web 工作提供结构化路径。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "web-development" from https://skillstore.io/skills/tencentcloudbase-web-development.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-web-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“web-development”。 修复 React 应用中损坏的登录重定向。
预期结果:
- 识别负责该重定向的路由守卫和登录处理器。
- 应用聚焦修复，不更改无关页面。
- 报告类型检查、构建和浏览器验证结果。
正在使用“web-development”。 将 Vite SPA 部署到 CloudBase 静态托管。
预期结果:
- 确认构建输出、资源路径和路由模式。
- 指出 history 路由所需的 index 错误文档。
- 列出部署检查以及任何未验证的凭据。
正在使用“web-development”。 向 Vue 页面添加 CloudBase 数据加载。
预期结果:
- 将 SDK 设置保持在现有前端结构内。
- 在浏览器中验证加载、空、成功和错误状态。
- 将 Web SDK 工作与无关的后端更改分离。
安全审计
高风险v2 • 2026/7/9 打开版本化报告
Most static findings are false positives caused by Markdown inline code, documentation URLs, and fixed sibling-skill paths. Confirmed risks involve unpinned remote instruction URLs and a public frontend access-key example. Semantic findings also identify unsafe token-cookie and credentialed CORS guidance.
3
已扫描文件
471
分析行数
8
复核项
0
已忽略误报
已确认安全问题 (4)
高
Environment file access
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The sample places CLOUDBASE_ACCESS_KEY in a NEXT_PUBLIC variable, which Next.js exposes to browser bundles. If the value is a secret key, users following the sample leak credentials.
高
Client-Side Token Cookie Guidance
The Next.js example writes a session access token with document.cookie and later reads it from a request cookie. A JavaScript-readable token cookie is exposed to XSS and omits Secure, HttpOnly, and SameSite protections.
The example directly stores data.session.access_token in document.cookie and then reads cloudbase_token from request cookies. The security weakness follows from the documented flow.
中
Permissive Credentialed CORS Example
The NestJS sample allows an origin fallback of * while credentials are enabled. This can teach deployments to combine credentialed requests with overly broad origins.
The CORS example shows a wildcard origin fallback and credentials enabled in the same configuration block. This is a clear unsafe deployment pattern.
中
Mutable Remote Instruction Dependency
The standalone instructions tell agents to use raw main-branch URLs for protocols and sibling skills. Unpinned remote instructions can change after marketplace review and alter agent behavior.
The URLs are explicit raw references to main-branch skill and protocol content. The risk is mutable remote instruction loading, not a generic hardcoded URL.
能力复核项 (8)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Environment variable access (dot notation)
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.
高
Environment variable object
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.
低
Hardcoded URL
- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
风险因素
⚙️ 外部命令 (48)
frameworks.md:46-56 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:18 SKILL.md:19 SKILL.md:34 SKILL.md:35 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:49 SKILL.md:57 SKILL.md:66 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:78 SKILL.md:79 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:92 SKILL.md:100 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:129 SKILL.md:130 SKILL.md:133 SKILL.md:138 SKILL.md:158 SKILL.md:159 SKILL.md:171 SKILL.md:172 SKILL.md:178 SKILL.md:186 SKILL.md:189-191 SKILL.md:191-194 SKILL.md:194-196 SKILL.md:196-200 SKILL.md:200-209
🔑 环境变量 (10)
📁 文件系统访问 (2)
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/tencentcloudbase-web-development/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/tencentcloudbase-web-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/tencentcloudbase-web-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-web-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-web-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
tencentcloudbase. (2026). web-development security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-web-development/audits/2BibTeX 引用
@techreport{tencentcloudbase-tencentcloudbase-web-development-2026,
author = {tencentcloudbase},
title = {web-development security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/tencentcloudbase-web-development/audits/2},
note = {Author version 2.23.8}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-development security audit report (audit version 2)"
version: "2.23.8"
type: report
authors:
- name: "tencentcloudbase"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/tencentcloudbase-web-development/audits/2"
identifiers:
- type: other
value: "skillstore:tencentcloudbase-web-development:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
100
可维护性
87
内容
65
社区
100
规范符合性
你能构建什么
修复 Web 流程 Bug
找到负责的路由、组件或处理器，然后在浏览器中验证用户可见流程。
集成 CloudBase Web
添加 CloudBase Web SDK 用法，同时保持浏览器和服务器边界清晰。
验证发布就绪状态
部署前检查构建输出、SPA 路由、静态托管设置和浏览器行为。
试试这些提示
验证路由变更
使用 web-development 技能检查现有应用，识别受影响的路由，进行最小修复，并报告构建和浏览器检查。
添加 Vite 页面
使用 web-development 技能在现有路由和组件约定内添加新的 Vite 页面。包括验证步骤和剩余缺口。
集成 CloudBase Auth
使用 web-development 技能审查当前认证表面，将浏览器 SDK 用法保留在客户端，并将提供商细节路由到认证技能。
准备 SPA 托管
使用 web-development 技能为 CloudBase 静态托管准备 React 或 Vue SPA。验证路由模式、构建输出和浏览器刷新行为。
最佳实践
- 更改代码前先阅读现有路由、服务和构建约定。
- 运行与受影响用户旅程匹配的项目检查和浏览器流程。
- 将 CloudBase 集成与无关的 UI 或后端重构分开。
避免
- 当用户要求实现或调试时，却开始重新设计。
- 没有构建、lint、测试或浏览器证据就声称完成。
- 通过公共前端环境变量暴露敏感凭据。
常见问题
此技能会创建视觉设计吗？
否。它会指示代理在视觉系统工作前使用设计技能。
它支持哪些框架？
它专注于 React、Vue、Vite、Next.js 边界以及相关浏览器工作流。
它能部署 CloudBase 静态站点吗？
它提供部署门禁和静态托管指导，但仍然需要凭据和项目设置。
它会自动运行浏览器测试吗？
它会告诉代理何时使用浏览器验证工具以及要收集哪些证据。
它只适用于新应用吗？
否。它偏向既有项目模式，并在已建立的应用中进行定向修复。
它如何处理身份认证？
它提供 Web 边界指导，并将详细的提供商工作路由到配套认证技能。
开发者详情
许可证
MIT
作者版本
v2.23.8
Skillstore 修订
r1
引用
24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec
维护新鲜度
2026/7/18
使用量
0 次下载 · 0 次浏览
文件结构