技能 spawn
📦
spawn
內容修訂 r2 高風險 🔑 環境變數⚙️ 外部命令📁 檔案系統存取
產生 Agent 與終端機指令
開發者經常需要互動式 agent 或長時間執行的 CLI 任務，同時不阻塞主要工作階段。此技能會為程式設計 agent 和一般指令開啟終端機工作階段，並記錄輸出擷取方式。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "spawn" from https://skillstore.io/skills/consiliency-spawn.md and its manifest at https://skillstore.io/api/skills/consiliency-spawn/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「spawn」。 為長時間的影片轉換產生一個終端機。
預期結果:
新的終端機會為該指令開啟。助理會回報是否已擷取除錯輸出，以及可在哪裡找到它。
正在使用「spawn」。 啟動 Codex 來審查失敗的測試套件。
預期結果:
此技能會選擇 Codex cookbook、建立 CLI 指令、開啟終端機，並回傳已擷取輸出的路徑。
正在使用「spawn」。 為 Cursor Agent 開啟登入流程。
預期結果:
終端機會為 Cursor 驗證指令開啟。呼叫端會等待登入流程完成或逾時。
安全審計
高風險v12 • 2026/10/13 開啟版本化報告
The 86 findings include real shell quoting and temporary-file risks, alongside false positives from documentation, platform detection, and dictionary operations. Provider instructions also recommend disabling approval safeguards and, for Codex, the sandbox. No evidence found of credential theft, concealed malware, or instructions to manipulate this audit.
12
已掃描檔案
1,587
分析行數
23
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
高
agent/cookbook/codex-cli.md:44-46agent/cookbook/codex-cli.md:69-83agent/cookbook/cursor-cli.md:40-43
Approval and sandbox safeguards disabled by default
The Codex cookbook says: "Always run with `--dangerously-bypass-approvals-and-sandbox` for full auto mode". Cursor similarly recommends force-allowing commands, increasing exposure to destructive actions and injected repository instructions.
These are explicit operational instructions to remove approval controls, not merely flag descriptions. Codex examples also disable sandboxing.
能力複核項目 (23)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Python subprocess.run
subprocess.run(
The AppleScript contains unescaped shell_cmd text, including unquoted cwd. Quotes or metacharacters in directory names can change the executed script.
高
Python subprocess.run
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
The fallback interpolates command into nested Unix and Windows shell text with shell=True. Embedded quotes can cross parser boundaries and execute unintended commands.
高
Python subprocess.Popen
subprocess.Popen(wt_cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
The argument list launches PowerShell with generated script text. POSIX shlex.quote does not safely escape PowerShell cwd values, allowing directory text to become code.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
Caller-supplied command text is executed with shell=True and no restricted argument mode. Legitimate shell use is intended, but untrusted interpolated data can execute commands.
高
Python subprocess.Popen
subprocess.Popen(wrapped_cmd, shell=True, cwd=cwd)
The debug path executes arbitrary command text with shell=True. The caller trust boundary is unspecified, so unsafe interpolation remains a risk.
高
Python subprocess.Popen
subprocess.Popen(command, shell=True, cwd=cwd)
The fallback passes caller-supplied command directly to shell=True without validation. Requested shell execution is legitimate, but untrusted command construction is not protected.
高
PowerShell invocation
"wt.exe", "-w", "new", "powershell.exe",
PowerShell receives generated script text using POSIX quoting for cwd. That mismatch can interpret directory-name characters as PowerShell syntax.
高
Windows cmd.exe
subprocess.run(f"cmd.exe /c 'start cmd /k wsl -- {command}'", shell=True)
Command text is embedded in a cmd.exe command passed through another shell. Missing parser-specific escaping permits unintended interpretation of embedded quotes and metacharacters.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Agent output is written by tee into shared /tmp without private permissions or exclusive creation. Sensitive responses may be readable under common umasks.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
Debug logs collect terminal output in shared /tmp without permission hardening. Logs may expose sensitive output to other local users.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The completion marker is not securely created or checked for ownership. Another local user who discovers the filename can spoof completion.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The WSL script writes agent output into shared /tmp through tee. No private directory, restrictive permissions, or exclusive creation protects the response.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The WSL debug log stores full terminal output in shared /tmp. Its creation does not enforce privacy or resist existing symlinks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The WSL completion marker uses a shared temporary path without exclusive creation or ownership verification. A local attacker can spoof its existence.
中
Temp directory access
script_file = f"/tmp/fork-script-{output_id}.sh"
A shell script containing caller commands is placed directly in shared /tmp. Later nonexclusive creation and permissions 0755 expose its contents and permit symlink attacks.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
The tmux branch saves agent output in shared /tmp using tee. It does not ensure private permissions or exclusive file creation.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The tmux debug path stores terminal output in a shared temporary file. Sensitive output can remain readable under common umasks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The tmux completion marker has no secure creation or ownership checks. Its existence can be spoofed by another local user.
中
Temp directory access
agent_output_file = f"/tmp/fork-agent-{output_id}.json" if log_agent_output else None
Background execution writes responses into shared /tmp without permission hardening. Sensitive agent output can be exposed to other local users.
中
Temp directory access
debug_output_file = f"/tmp/fork-debug-{output_id}.txt" if log_to_file else None
The background debug file collects stdout and stderr without private permissions or exclusive creation. This creates disclosure and symlink risks.
中
Temp directory access
done_file = f"/tmp/fork-output-{output_id}.done"
The background completion marker is placed in shared /tmp and checked only for existence. Local users can forge completion after discovering its path.
中
Python file write/append
with open(script_file, 'w') as f:
open(script_file, 'w') follows existing symlinks and truncates their targets. The script is created in shared /tmp without exclusive or no-follow flags.
中
Python os file operations
os.chmod(script_file, 0o755)
chmod sets command-bearing scripts to 0755, exposing prompts to other local users. It also follows a substituted symlink when changing target permissions.
風險因素
🔑 環境變數 (3)
⚙️ 外部命令 (49)
agent/fork_terminal.py:58 agent/fork_terminal.py:176 agent/fork_terminal.py:93 agent/fork_terminal.py:161 agent/fork_terminal.py:196 agent/fork_terminal.py:216 agent/fork_terminal.py:222 agent/fork_terminal.py:227 agent/fork_terminal.py:281 agent/fork_terminal.py:76 agent/fork_terminal.py:90 agent/fork_terminal.py:173 agent/fork_terminal.py:176 agent/fork_terminal.py:140 agent/fork_terminal.py:146 agent/fork_terminal.py:152 agent/SKILL.md:52 agent/SKILL.md:60 agent/SKILL.md:134 agent/SKILL.md:138 agent/SKILL.md:139 agent/SKILL.md:140 agent/SKILL.md:144 agent/SKILL.md:146 agent/SKILL.md:147 agent/SKILL.md:148 agent/SKILL.md:149 agent/SKILL.md:150 agent/SKILL.md:154 agent/SKILL.md:156-163 agent/SKILL.md:163-167 agent/SKILL.md:167-169 agent/SKILL.md:169-172 SKILL.md:17 SKILL.md:47 SKILL.md:49-58 SKILL.md:58-62 SKILL.md:62-79 SKILL.md:79-89 SKILL.md:89-90 terminal/SKILL.md:8 terminal/SKILL.md:22 terminal/SKILL.md:23 terminal/SKILL.md:31 terminal/SKILL.md:33 terminal/SKILL.md:43 terminal/SKILL.md:59 terminal/SKILL.md:61-72 terminal/SKILL.md:72-76
📁 檔案系統存取 (23)
agent/fork_terminal.py:107 agent/fork_terminal.py:108 agent/fork_terminal.py:41 agent/fork_terminal.py:42 agent/fork_terminal.py:43 agent/fork_terminal.py:134 agent/fork_terminal.py:135 agent/fork_terminal.py:136 agent/fork_terminal.py:137 agent/fork_terminal.py:183 agent/fork_terminal.py:184 agent/fork_terminal.py:185 agent/fork_terminal.py:210 agent/fork_terminal.py:211 agent/fork_terminal.py:212 agent/fork_terminal.py:157 agent/fork_terminal.py:159 agent/fork_terminal.py:126 agent/prompts/fork-summary-user-prompt.md:13 agent/SKILL.md:138 agent/SKILL.md:139 terminal/SKILL.md:41 terminal/SKILL.md:59
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/consiliency-spawn/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/consiliency-spawn?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/consiliency-spawn?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/consiliency-spawn/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/consiliency-spawn.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
Consiliency. (2026). spawn security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/consiliency-spawn/audits/12BibTeX 引用
@techreport{consiliency-consiliency-spawn-2026,
author = {Consiliency},
title = {spawn security audit report (audit version 12)},
institution = {Skillstore},
year = {2026},
number = {12},
url = {https://skillstore.io/skills/consiliency-spawn/audits/12},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "spawn security audit report (audit version 12)"
version: "unspecified"
type: report
authors:
- name: "Consiliency"
date-released: "2026-10-13"
url: "https://skillstore.io/skills/consiliency-spawn/audits/12"
identifiers:
- type: other
value: "skillstore:consiliency-spawn:audit:12"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
85
可維護性
87
內容
70
社群
83
規範符合度
你可以打造什麼
執行長時間 CLI 作業
為建置、媒體或套件指令開啟獨立終端機，同時讓主要助理繼續工作。
啟動互動式程式設計 Agent
使用提示、模型選擇和選用的輸出擷取，啟動所選的 AI 程式設計 CLI。
處理提供者登入流程
當程式設計 CLI 需要瀏覽器或互動式登入時，開啟終端機進行提供者驗證。
試試這些提示
開啟建置終端機
Use spawn-terminal to open a new terminal and run npm run build. Check the command help or package script first.
啟動 Claude Code Agent
Use spawn-agent with Claude Code to review the current bug report. Keep permissions conservative and return the output path.
使用摘要執行 Codex
Use spawn-agent with Codex. Include a concise summary of our current task, then ask it to inspect the failing tests.
比較 Agent 結果
Spawn separate agents for Codex and Cursor to investigate the performance regression. Capture clean outputs and summarize disagreements.
最佳實務
- 在終端機中產生任何指令之前，先審查每個指令。
- 對於不受信任的提示，優先使用沙盒化或需要確認的 agent 模式。
- 當擷取的輸出檔案可能包含敏感資料時，請刪除這些檔案。
避免
- 不要使用核准繞過或完整系統存取權來執行不受信任的提示。
- 不要在提示、指令引數或擷取的輸出檔案中傳遞秘密資訊。
- 不要將此技能用於可在目前工作階段安全執行的簡單指令。
常見問題
此技能的用途是什麼？
它會為 AI 程式設計 agent 或一般 CLI 指令開啟新的終端機工作階段。
記錄了哪些 agent？
此技能記錄了 Claude Code、Codex、Gemini、Cursor、OpenCode 和 Copilot 的指令模式。
它可以擷取輸出嗎？
可以。它可以將乾淨的 agent 輸出或除錯終端機輸出寫入暫存檔案。
它會安裝 CLI 工具嗎？
不會。所需的 CLI 工具和憑證必須已存在於使用者系統上。
為什麼此技能具有安全敏感性？
它會啟動外部程序，而且某些 cookbook 會建議使用功能強大的自動核准模式。
使用者應如何降低風險？
使用者應優先使用沙盒化模式、驗證指令、避免秘密資訊，並移除暫存輸出檔案。
開發者詳細資訊
作者
Consiliency授權
MIT
Skillstore 修訂
r2
版本提示
作者未聲明版本。
引用
18789a6c1a8a9ebc818b76ac8686bbd38eb802a8
維護新鮮度
2026/10/13
使用量
12 次下載 · 222 次瀏覽
檔案結構