技能 when-analyzing-user-intent-use-intent-analyzer
📦
when-analyzing-user-intent-use-intent-analyzer
v1.0.0 內容修訂 r1 高風險 📁 檔案系統存取⚙️ 外部命令🔑 環境變數
執行前釐清使用者意圖
模糊的請求可能導致錯誤計畫、浪費工時，以及遺漏限制條件。此技能會分析意圖、提出聚焦問題，並產出清楚的執行簡報。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "when-analyzing-user-intent-use-intent-analyzer" from https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「when-analyzing-user-intent-use-intent-analyzer」。 Create an API with security.
預期結果:
- 可能意圖：建立具備驗證與授權的 REST API。
- 釐清問題：應使用哪一種驗證方法？
- 下一步：在開始實作前確認範圍。
正在使用「when-analyzing-user-intent-use-intent-analyzer」。 Make the app faster and cleaner.
預期結果:
- 可能意圖：改善效能並簡化可見的介面問題。
- 模糊點：faster 可能指載入時間、執行階段回應，或建置速度。
- 下一步：詢問哪個效能指標最重要。
正在使用「when-analyzing-user-intent-use-intent-analyzer」。 Set up deployment for this project.
預期結果:
- 可能意圖：建立可重複的正式環境部署工作流程。
- 關鍵假設：託管目標、機密資訊處理與回復流程尚未決定。
- 下一步：確認平台與發布需求。
安全審計
高風險v8 • 2026/7/6 開啟版本化報告
The audit confirmed real risks around full environment capture, mutable npx-based external tooling, shell script examples, and predictable /tmp output paths. Most static backtick findings were false positives caused by markdown fences or JavaScript template literals, and no prompt injection text was found.
4
已掃描檔案
1,270
分析行數
11
複核項目
0
已忽略的誤報
已確認的安全問題 (3)
高
Environment file access
environment: process.env,
The same process.env capture is later stored in memory as part of raw intent input. Persisting full environment data creates a clear secret disclosure risk.
高
Overbroad Environment and Project Context Capture
The workflow instructs agents to collect process.env, current working directory, filesystem clues, and recent edits for intent analysis. This can collect secrets and sensitive project metadata beyond what intent clarification requires.
The documented userInput and contextClues objects explicitly include process.env, cwd, filesystem analysis, recent edits, and memory storage. This confirms broad data collection, not just a naming false positive.
高
Mutable External Tool Execution
The skill declares claude-flow@alpha and repeatedly instructs npx execution. A mutable alpha dependency can change without review and execute third-party code during a clarification workflow.
The dependency and quick start examples explicitly name claude-flow@alpha and npx commands. The supply-chain risk is clear even though many backtick pattern matches were markdown fences.
能力複核項目 (11)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Environment variable object
environment: process.env,
The skill captures the entire process.env object as context for intent analysis. Environment variables commonly contain tokens, keys, and service credentials.
中
Temp directory access
--output "/tmp/intent-brief.json"
The quick start writes an intent brief to a predictable /tmp path. This is a real data exposure and overwrite risk in shared environments, although it is documented as an example output.
中
Shell command substitution
USER_REQUEST=$(cat "$INPUT_FILE")
The script reads an arbitrary input file through command substitution and later passes that content to npx claude-flow. This can expose local file contents to external tooling if the script is used as written.
中
Shell command substitution
QUESTIONS=$(npx claude-flow@alpha agent-spawn \
The script captures output from an npx claude-flow agent-spawn command and builds the task from file contents. This is real external command execution with user-controlled analysis data.
中
Unix shell invocation
#!/bin/bash
This is a runnable shell script template, and the same block invokes npx claude-flow with file-derived input. The risk is external command execution in a workflow users may copy directly.
中
Unix shell invocation
#!/bin/bash
This shell script template invokes npx claude-flow, reads user responses, and writes local files. It is real executable workflow guidance, not just inert prose.
中
Node.js fs operations
await fs.writeFile(
The documented JavaScript writes the execution brief to disk using fs.writeFile. This is legitimate output behavior, but it can persist sensitive intent details without user path control.
中
Temp directory access
'/tmp/intent-analysis-result.json',
The execution brief is written to a fixed /tmp file path. Predictable temporary paths can leak sensitive task context or collide with other local files.
中
Temp directory access
--output "/tmp/intent-analysis-result.json"
The workflow exports final results to a fixed /tmp path. The output can contain interpreted user intent and execution details, so predictable temp storage is a real risk.
中
Temp directory access
--output "/tmp/intent-brief.json"
The integration example writes an intent brief to /tmp. Even as documentation, this directs users toward predictable temporary storage for potentially sensitive planning data.
中
Temp directory access
--context "/tmp/intent-brief.json"
The SPARC example reads the /tmp intent brief as workflow context. Reusing a predictable temporary path can expose or mix sensitive context between runs.
風險因素
📁 檔案系統存取 (7)
⚙️ 外部命令 (86)
SKILL.md:70-80 SKILL.md:80-85 SKILL.md:85-98 SKILL.md:98-101 SKILL.md:101-111 SKILL.md:111-114 SKILL.md:114-123 SKILL.md:123-132 SKILL.md:132-137 SKILL.md:137-147 SKILL.md:147-162 SKILL.md:162-165 SKILL.md:165-179 SKILL.md:179-182 SKILL.md:182-195 SKILL.md:195-204 SKILL.md:204-224 SKILL.md:224-234 SKILL.md:234-260 SKILL.md:260-263 SKILL.md:263-276 SKILL.md:276-279 SKILL.md:279-290 SKILL.md:290-299 SKILL.md:299-304 SKILL.md:304-314 SKILL.md:314-334 SKILL.md:334-337 SKILL.md:337-351 SKILL.md:351-354 SKILL.md:354-356 SKILL.md:356-361 SKILL.md:361-363 SKILL.md:363-368 SKILL.md:368-371 SKILL.md:371-398 SKILL.md:398-407 SKILL.md:407-441 SKILL.md:441-451 SKILL.md:451-468 SKILL.md:468-471 SKILL.md:471-473 SKILL.md:473-479 SKILL.md:479-480 SKILL.md:480-485 SKILL.md:485-488 SKILL.md:488-517 SKILL.md:517-520 SKILL.md:520-528 SKILL.md:528-542 SKILL.md:542-551 SKILL.md:551-562 SKILL.md:562-581 SKILL.md:581-592 SKILL.md:592-595 SKILL.md:595-607 SKILL.md:607-610 SKILL.md:610-621 SKILL.md:621-627 SKILL.md:627-633 SKILL.md:633-637 SKILL.md:637-640 SKILL.md:640-644 SKILL.md:644-648 SKILL.md:648-651 SKILL.md:651-652 SKILL.md:652-655 SKILL.md:655-660 SKILL.md:660-669 SKILL.md:669-672 SKILL.md:672-688 SKILL.md:688-691 SKILL.md:691-700 SKILL.md:700-704 SKILL.md:704-722 SKILL.md:722-727 SKILL.md:727-742 SKILL.md:742-745 SKILL.md:745-755 SKILL.md:212 SKILL.md:414-416 SKILL.md:434 SKILL.md:204-224 SKILL.md:407-441 SKILL.md:205 SKILL.md:408
🔑 環境變數 (1)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
DNYoussef. (2026). when-analyzing-user-intent-use-intent-analyzer security audit report (audit version 8) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer/audits/8BibTeX 引用
@techreport{dnyoussef-dnyoussef-when-analyzing-user-intent-use-intent-analyzer-2026,
author = {DNYoussef},
title = {when-analyzing-user-intent-use-intent-analyzer security audit report (audit version 8)},
institution = {Skillstore},
year = {2026},
number = {8},
url = {https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer/audits/8},
note = {Author version 1.0.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-analyzing-user-intent-use-intent-analyzer security audit report (audit version 8)"
version: "1.0.0"
type: report
authors:
- name: "DNYoussef"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/dnyoussef-when-analyzing-user-intent-use-intent-analyzer/audits/8"
identifiers:
- type: other
value: "skillstore:dnyoussef-when-analyzing-user-intent-use-intent-analyzer:audit:8"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
100
可維護性
87
內容
71
社群
83
規範符合度
你可以打造什麼
釐清模糊的功能請求
將簡短或不清楚的功能請求轉換為有範圍界定的工作，並附上假設與下一步。
準備利害關係人簡報
在規劃開始前，將粗略的利害關係人輸入轉換為清楚的執行簡報。
降低營運模糊性
在處理不清楚的支援、DevOps 或工作流程請求前，先提出聚焦問題。
試試這些提示
釐清簡單請求
分析此請求的意圖。識別可能的目標、缺少的細節，以及一個釐清問題：[paste request].
排序可能的解讀
列出此請求的三種可能解讀。依可能性排序，並說明每一種解讀的依據：[paste request].
建立執行簡報
根據此請求建立執行簡報。包含解讀後的意圖、假設、限制條件、風險與確認問題：[paste request].
分析高風險請求
對此高風險請求進行審慎的意圖分析。將脈絡限制在非機密資料、排序各種解讀，並在行動前要求確認：[paste request].
最佳實務
- 將此技能用於模糊、複雜或高影響力的請求。
- 在分析開始前限制脈絡蒐集並遮蔽機密資訊。
- 在將工作交給另一個工作流程前，先確認最終解讀。
避免
- 不要在未審查相依性與檔案路徑的情況下執行命令範例。
- 不要將機率分數視為使用者同意。
- 不要提出超過決策所需數量的釐清問題。
常見問題
我應該何時使用此技能？
當請求模糊、多部分、高影響力，或可能有多種解讀時使用。
它可以取代使用者確認嗎？
不會。它有助於形成可能的解讀，但不確定的決策仍應由使用者確認。
它可以建立行動計畫嗎？
可以。它能產出精簡的執行簡報，包含範圍、假設、風險與下一步。
它需要存取環境變數嗎？
不需要。除非使用者明確核准，否則應停用或遮蔽環境擷取。
我可以將它用於 Claude、Codex 和 Claude Code 嗎？
可以。此技能內容是為 Claude、Codex 與 Claude Code 風格的工作流程撰寫。
主要安全疑慮是什麼？
審查外部命令範例、避免完整擷取環境，並將輸出儲存在核准的路徑中。
開發者詳細資訊
作者
DNYoussef授權
MIT
作者版本
v1.0.0
Skillstore 修訂
r1
引用
72d5025b022c77f7a51bdf5c1637c689c80e89d1
維護新鮮度
2026/7/26
使用量
5 次下載 · 271 次瀏覽
檔案結構