技能 managing-workflow

📦

managing-workflow

Name: managing-workflow
Author: BrendanShields

內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取🔑 環境變數

指南規格工作流程

功能開發在長時間工作階段中可能會失去範圍、狀態與審查檢查點。此技能透過本機成品來引導規格撰寫、規劃、任務、驗證與封存。

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "managing-workflow" from https://skillstore.io/skills/brendanshields-managing-workflow.md and its manifest at https://skillstore.io/api/skills/brendanshields-managing-workflow/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/brendanshields-managing-workflow.md 已簽名 manifest GET /api/skills/brendanshields-managing-workflow/manifest 已簽名 lockfile GET /api/skills/brendanshields-managing-workflow/lockfile

測試它

正在使用「managing-workflow」。 Start a new feature for password reset emails.

預期結果:

建立有範圍界定的功能記錄、詢問缺少的需求、草擬使用者故事，並準備可供審查的規格成品。

正在使用「managing-workflow」。 Continue the active checkout redesign work.

預期結果:

載入目前功能狀態、識別下一個階段，並在實作前建議下一個必要動作。

正在使用「managing-workflow」。 This feature is done. Close it out.

預期結果:

檢查剩餘任務、更新完成狀態、記錄活動，並提出封存已完成功能的選項。

安全審計

高風險

v8 • 2026/7/5 開啟版本化報告

Most external-command alerts are false positives from Markdown backticks, Bash examples, or JavaScript template literals. The real risk is unvalidated path arguments in helper scripts. They can read, write, append to, or move workflow files; no network exfiltration or prompt injection was found.

已掃描檔案

917

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

高

scripts/archive-feature.js:8-17 scripts/archive-feature.js:63-75 scripts/update-status.js:7-19 scripts/log-activity.js:7-69 scripts/validate-phase.js:9-56

Unvalidated Workflow Paths Can Modify Files Outside .spec

Helper scripts accept CLI paths or feature identifiers and use them in read, write, and rename operations without normalizing or enforcing the project .spec boundary. A crafted path could update, append to, or move files outside the intended workflow artifacts.

The scripts take path-like values from process.argv and then call fs.readFile, fs.writeFile, or fs.rename without path normalization or containment checks. This is direct evidence of a path-boundary weakness, though exploitation depends on who controls script arguments.

能力複核項目 (11)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

scripts/archive-feature.js:75

Node.js fs operations

await fs.rename(featureDir, targetPath);

The script renames a feature directory derived from caller input into the archive. A traversal featureId could move a directory outside the intended workflow area.

高

scripts/log-activity.js:69

Node.js fs operations

await fs.writeFile(metricsPath, newContent);

metricsPath is taken directly from process.argv and written without path containment. A crafted path could append workflow text to an unintended file.

高

scripts/update-status.js:19

Node.js fs operations

await fs.writeFile(filePath, updatedContent);

filePath is taken directly from process.argv and written without path containment. This can modify unintended files if an unsafe path is supplied.

中

scripts/archive-feature.js:45

Node.js fs operations

let content = await fs.readFile(specPath, 'utf-8');

The script reads a spec path derived from the caller-controlled featureId. If featureId escapes the .spec/features boundary, this can read an unintended file.

中

scripts/archive-feature.js:63

Node.js fs operations

await fs.writeFile(specPath, content);

The script writes back to a spec path derived from the caller-controlled featureId. Missing path normalization makes unintended file modification possible.

中

scripts/log-activity.js:28

Node.js fs operations

const content = await fs.readFile(metricsPath, 'utf-8');

metricsPath is taken directly from process.argv and read without path containment. The intended use is metrics.md, but the script does not enforce that boundary.

中

scripts/update-status.js:15

Node.js fs operations

const content = await fs.readFile(filePath, 'utf-8');

filePath is taken directly from process.argv and read without path containment. The intended target is spec.md, but the script accepts any readable path.

中

scripts/validate-phase.js:39

Node.js fs operations

const content = await fs.readFile(specPath, 'utf-8');

The validation script reads a spec path derived from caller-supplied featureDir. It appears read-only, but no boundary check prevents validating files outside the workflow directory.

中

scripts/validate-phase.js:56

Node.js fs operations

const content = await fs.readFile(tasksPath, 'utf-8');

The validation script reads tasks.md under caller-supplied featureDir. It appears read-only, but no containment check restricts the path to .spec features.

低

scripts/archive-feature.js:21

Node.js fs stat operations

await fs.access(featureDir);

featureId comes from process.argv and is joined into a filesystem path before this access check. Without containment validation, a traversal value could probe paths outside the intended feature directory.

低

scripts/log-activity.js:20

Node.js fs stat operations

await fs.access(metricsPath);

metricsPath is taken directly from process.argv and checked without path containment. This can probe arbitrary local paths if a caller supplies an unsafe path.

風險因素

⚙️ 外部命令 (106)

scripts/archive-feature.js:37 scripts/archive-feature.js:60 scripts/archive-feature.js:65 scripts/archive-feature.js:76 scripts/archive-feature.js:78 scripts/log-activity.js:16 scripts/log-activity.js:24 scripts/log-activity.js:55 scripts/log-activity.js:58 scripts/log-activity.js:62 scripts/log-activity.js:66 scripts/log-activity.js:70 scripts/log-activity.js:73 scripts/update-status.js:16 scripts/update-status.js:17 scripts/update-status.js:20 scripts/update-status.js:22 scripts/validate-phase.js:50 SKILL.md:27-29 SKILL.md:29-32 SKILL.md:32-33 SKILL.md:33-34 SKILL.md:34-35 SKILL.md:35-36 SKILL.md:36-43 SKILL.md:43-47 SKILL.md:47-48 SKILL.md:48-49 SKILL.md:49-50 SKILL.md:50-51 SKILL.md:51 SKILL.md:52 SKILL.md:58-74 SKILL.md:74-80 SKILL.md:80-88 SKILL.md:88-96 SKILL.md:96-106 SKILL.md:106-116 SKILL.md:116-121 SKILL.md:121 SKILL.md:128-129 SKILL.md:129-138 SKILL.md:138-141 SKILL.md:141-143 SKILL.md:143-146 SKILL.md:146-147 SKILL.md:147-149 SKILL.md:149-153 SKILL.md:153-189 SKILL.md:189-193 SKILL.md:193-209 SKILL.md:209-211 SKILL.md:211-219 SKILL.md:219-220 SKILL.md:220-222 SKILL.md:222 SKILL.md:227-230 SKILL.md:230-232 SKILL.md:232-245 SKILL.md:245-247 SKILL.md:247-252 SKILL.md:252-283 SKILL.md:283-290 SKILL.md:290-297 SKILL.md:297-299 SKILL.md:299 SKILL.md:301-303 SKILL.md:303-304 SKILL.md:304-309 SKILL.md:309-330 SKILL.md:330-331 SKILL.md:331-332 SKILL.md:332-333 SKILL.md:333-334 SKILL.md:334-340 SKILL.md:340-351 SKILL.md:351-353 SKILL.md:353-355 SKILL.md:355-364 SKILL.md:364-367 SKILL.md:367-368 SKILL.md:368-372 SKILL.md:372-374 SKILL.md:374-383 SKILL.md:383-395 SKILL.md:395-397 SKILL.md:397-401 SKILL.md:401-408 SKILL.md:408-414 SKILL.md:414-422 SKILL.md:422-430 SKILL.md:430-431 SKILL.md:431-438 SKILL.md:438-447 SKILL.md:447-450 SKILL.md:450-461 SKILL.md:461-464 SKILL.md:464-473 SKILL.md:98-99 SKILL.md:102 SKILL.md:103 SKILL.md:342-343 SKILL.md:346 SKILL.md:347 SKILL.md:96-106 SKILL.md:340-351

📁 檔案系統存取 (21)

🔑 環境變數 (2)

scripts/context-loader.js:10 scripts/context-loader.js:10

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/brendanshields-managing-workflow/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/brendanshields-managing-workflow/security.svg)](https://skillstore.io/skills/brendanshields-managing-workflow?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/brendanshields-managing-workflow?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/brendanshields-managing-workflow/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/brendanshields-managing-workflow.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

BrendanShields. (2026). managing-workflow security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/brendanshields-managing-workflow/audits/8

BibTeX 引用

@techreport{brendanshields-brendanshields-managing-workflow-2026,
  author = {BrendanShields},
  title = {managing-workflow security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/brendanshields-managing-workflow/audits/8},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "managing-workflow security audit report (audit version 8)"
version: "unspecified"
type: report
authors:
  - name: "BrendanShields"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/brendanshields-managing-workflow/audits/8"
identifiers:
  - type: other
    value: "skillstore:brendanshields-managing-workflow:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

可維護性

內容

社群

規範符合度

你可以打造什麼

以清楚範圍啟動功能

在實作開始前建立功能規格、驗收標準與追蹤檔案。

協調審查關卡

透過明確的核准點，讓工作依序通過規格、規劃、任務與實作階段。

恢復長時間 AI 編碼工作階段

從成品載入目前狀態，並從正確的工作流程階段繼續。

試試這些提示

啟動新功能

Use the managing-workflow skill to start a new feature for: [short feature description]. Ask me for any missing scope details.

建立技術計畫

Use the managing-workflow skill to review the current spec, resolve any clarification tags, and create a technical plan.

準備實作任務

Use the managing-workflow skill to validate the plan and create implementation tasks with dependencies and priority labels.

驗證並封存工作

Use the managing-workflow skill to validate completion, update progress, identify repeatable tooling opportunities, and archive the feature if approved.