技能 investigating-codebases
📦

investigating-codebases

v1.0.0 內容修訂 r2 高風險 📁 檔案系統存取⚙️ 外部命令

調查不熟悉的程式碼庫

不熟悉的儲存庫會拖慢功能開發與事件回應。此技能為 Claude、Codex 和 Claude Code 提供結構化的程式碼庫探索流程。

支援: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 差

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求
Review the Skillstore skill "investigating-codebases" from https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases.md and its manifest at https://skillstore.io/api/skills/c0ntr0lledcha0s-investigating-codebases/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/c0ntr0lledcha0s-investigating-codebases.md 已簽名 manifest GET /api/skills/c0ntr0lledcha0s-investigating-codebases/manifest 已簽名 lockfile GET /api/skills/c0ntr0lledcha0s-investigating-codebases/lockfile

測試它

正在使用「investigating-codebases」。 Where is user login implemented?

預期結果:

回答會指出驗證路由、中介軟體、token service 與 session storage。它會說明從提交到回應的請求流程。

正在使用「investigating-codebases」。 Explain the build process.

預期結果:

結果會列出建置設定、指令碼、編譯步驟、產生的輸出，以及開發與正式環境的差異。

正在使用「investigating-codebases」。 What kind of architecture is this?

預期結果:

報告會識別分層服務與儲存庫模式，接著指出例外情況與相關測試。

安全審計

高風險
v9 • 2026/7/23 開啟版本化報告

Most alerts are false positives caused by Markdown backticks, documentation examples, file discovery, quoted metadata commands, and `/dev/null` redirection. Five `find` substitutions are confirmed because an option-like project argument can be interpreted as `-delete` and remove files. The same flaw affects four earlier `find` pipelines; no prompt injection, network activity, credential access, or exfiltration was found.

9
已掃描檔案
1,543
分析行數
5
複核項目
0
已忽略的誤報

已確認的安全問題 (1)

高
scripts/map-structure.sh:20scripts/map-structure.sh:29-37scripts/map-structure.sh:41-48scripts/map-structure.sh:52-58
Project Directory Option Injection
Four direct `find` pipelines accept an option-like project argument. A value such as `-delete` can remove files from the working directory.
Each pipeline places the unnormalized positional argument where `find` accepts expressions. The documented `-delete` action provides a direct destructive path.
能力複核項目 (5)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高
scripts/map-structure.sh:62
Shell command substitution
echo "TypeScript: $(find "$PROJECT_DIR" -type f -name "*.ts" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
高
scripts/map-structure.sh:63
Shell command substitution
echo "JavaScript: $(find "$PROJECT_DIR" -type f -name "*.js" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
高
scripts/map-structure.sh:64
Shell command substitution
echo "Python: $(find "$PROJECT_DIR" -type f -name "*.py" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
高
scripts/map-structure.sh:65
Shell command substitution
echo "Go: $(find "$PROJECT_DIR" -type f -name "*.go" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.
高
scripts/map-structure.sh:66
Shell command substitution
echo "Rust: $(find "$PROJECT_DIR" -type f -name "*.rs" 2>/dev/null | wc -l)"
The substitution executes `find` with the user-supplied project argument as its first operand. An argument such as `-delete` is parsed as a find action and can remove files.

風險因素

📁 檔案系統存取 (12)
references/framework-clues.md:8 scripts/map-structure.sh:15 scripts/map-structure.sh:17 scripts/map-structure.sh:20 scripts/map-structure.sh:37 scripts/map-structure.sh:48 scripts/map-structure.sh:58 scripts/map-structure.sh:62 scripts/map-structure.sh:63 scripts/map-structure.sh:64 scripts/map-structure.sh:65 scripts/map-structure.sh:66
⚙️ 外部命令 (50)
scripts/find-entry-points.py:87 scripts/find-entry-points.py:101 scripts/map-structure.sh:10 scripts/map-structure.sh:11 scripts/map-structure.sh:62 scripts/map-structure.sh:63 scripts/map-structure.sh:64 scripts/map-structure.sh:65 scripts/map-structure.sh:66 SKILL.md:34-51 SKILL.md:51-54 SKILL.md:54-70 SKILL.md:70-73 SKILL.md:73-91 SKILL.md:91-96 SKILL.md:96-108 SKILL.md:108-111 SKILL.md:111-127 SKILL.md:127-130 SKILL.md:130-146 SKILL.md:146-151 SKILL.md:151-157 SKILL.md:157-160 SKILL.md:160-163 SKILL.md:163-169 SKILL.md:169-179 SKILL.md:179-182 SKILL.md:182-206 SKILL.md:206-210 SKILL.md:210-224 SKILL.md:224-225 SKILL.md:225-287 SKILL.md:287-294 SKILL.md:294-297 SKILL.md:297-304 SKILL.md:304-307 SKILL.md:307-313 SKILL.md:313-316 SKILL.md:316-322 SKILL.md:322-327 SKILL.md:327-336 SKILL.md:336-339 SKILL.md:339-348 SKILL.md:348-351 SKILL.md:351-360 SKILL.md:360-377 SKILL.md:377-381 SKILL.md:381-382 SKILL.md:382 SKILL.md:393-394
審計單位: codex 檢視審計紀錄 →
分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告
安全評估

複製報告連結

https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/c0ntr0lledcha0s-investigating-codebases/security.svg)](https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/c0ntr0lledcha0s-investigating-codebases/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/c0ntr0lledcha0s-investigating-codebases.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
學術引用 (APA · BibTeX · CFF)

APA 引用

C0ntr0lledCha0s. (2026). investigating-codebases security audit report (audit version 9) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9

BibTeX 引用

@techreport{c0ntr0lledcha0s-c0ntr0lledcha0s-investigating-codebases-2026, author = {C0ntr0lledCha0s}, title = {investigating-codebases security audit report (audit version 9)}, institution = {Skillstore}, year = {2026}, number = {9}, url = {https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9}, note = {Author version 1.0.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "investigating-codebases security audit report (audit version 9)" version: "1.0.0" type: report authors: - name: "C0ntr0lledCha0s" date-released: "2026-07-23" url: "https://skillstore.io/skills/c0ntr0lledcha0s-investigating-codebases/audits/9" identifiers: - type: other value: "skillstore:c0ntr0lledcha0s-investigating-codebases:audit:9" description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據 證據置信度: 中
82
架構
100
可維護性
87
內容
71
社群
83
規範符合度

你可以打造什麼

熟悉新的儲存庫

開發人員可以在進行變更前，先繪製資料夾、進入點與關鍵檔案。

回答實作問題

審查者可以定位某個功能、路由或工作流程的實作位置，並說明相關檔案。

記錄舊有系統

文件負責人可以將分散的程式碼路徑整理成精簡的架構說明。

試試這些提示

繪製此儲存庫 
從高層次調查此儲存庫。識別專案類型、主要目錄、可能的進入點與重要設定檔。不要讀取機密檔案。
尋找功能 
Find where [feature] is implemented. Search names and related concepts, then summarize primary files, related files, and the execution flow.
追蹤請求流程 
Trace how [request or command] moves through this codebase. Start from the entry point, follow handlers and services, and note validation and data access.
比較架構模式 
分析此儲存庫的架構。識別主要模式、相依性邊界、測試策略與高風險耦合。以檔案參考支援每個結論。

最佳實務

  • 先從結構與文件開始，再閱讀深層實作檔案。
  • 使用精準搜尋，然後透過閱讀相關檔案來驗證發現。
  • 包含檔案參考，並說明元件如何連接。

避免

  • 在沒有問題或假設的情況下隨機閱讀檔案。
  • 只回報檔案位置，卻未說明其角色。
  • 在範例設定已足夠時檢查機密檔案。

常見問題

我什麼時候應該使用這個技能？
當你需要了解程式碼位於何處、功能如何運作，或儲存庫如何組織時使用它。
這個技能會修改程式碼嗎？
不會。它是為調查、說明與文件撰寫而設計，不是用於實作變更。
它依賴哪些工具？
它使用 Read、Grep、Glob 和 Task。它也包含可選的本機指令碼，用於繪製結構與探索進入點。
它可以分析任何程式語言嗎？
它與語言無關，並提供常見 Web、API、frontend、backend 與 package 模式的參考資料。
結果應如何引用證據？
結果應包含檔案路徑、可用時的行號參考，以及每個檔案角色的簡短說明。
它對私人儲存庫安全嗎？
它會讀取本機程式碼，本身不會傳送資料。避免讀取機密檔案，並先審查指令碼用途。

開發者詳細資訊

授權

MIT

作者版本

v1.0.0

Skillstore 修訂

r2

儲存庫

https://github.com/C0ntr0lledCha0s/claude-code-plugin-automations/tree/main/research-agent/skills/investigating-codebases

引用

a39a91716eadede5f4cdefd78178fed4e837a128

維護新鮮度

2026/7/27

使用量

39 次下載 · 256 次瀏覽

檔案結構

📁 assets/

📄 flow-diagram-syntax.md

📄 investigation-template.md

📁 references/

📄 common-patterns.md

📄 framework-clues.md

📄 investigation-checklist.md

📁 scripts/

📄 find-entry-points.py

📄 map-structure.sh

📄 trace-imports.py

📄 SKILL.md

C0ntr0lledCha0s 的更多技能

查看全部

相關技能

查看全部