技能 when-creating-slash-commands-use-slash-command-encoder

📦

when-creating-slash-commands-use-slash-command-encoder

Name: when-creating-slash-commands-use-slash-command-encoder
Author: DNYoussef

v1.0.0 內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取

建立斜線指令工作流程

團隊需要一致的斜線指令，以便在不造成語法混淆的情況下路由微技能。此技能會指引指令設計、驗證、處理常式產生、測試、文件撰寫與部署步驟。

支援: Claude Codex Code(CC)

⚠️ 38 差

Maintain this Skill? Claim it ⚠️ 38 差

安裝前請停止並請求確認。

請審查安裝計畫，並在變更檔案前取得使用者明確同意。

使用我的智慧代理安裝

將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。

智能體請求

Review the Skillstore skill "when-creating-slash-commands-use-slash-command-encoder" from https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder.md and its manifest at https://skillstore.io/api/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder.md 已簽名 manifest GET /api/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/manifest 已簽名 lockfile GET /api/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/lockfile

測試它

正在使用「when-creating-slash-commands-use-slash-command-encoder」。建立用於程式碼分析的斜線指令。

預期結果:

一份指令規格，包含名稱、別名、參數、驗證規則、範例、處理常式職責與測試覆蓋範圍。

正在使用「when-creating-slash-commands-use-slash-command-encoder」。記錄產生的斜線指令。

預期結果:

一個使用頁面，說明語法、參數、範例、輸出預期與相關指令。

正在使用「when-creating-slash-commands-use-slash-command-encoder」。準備要部署的斜線指令。

預期結果:

一份部署檢查清單，涵蓋建置步驟、安裝驗證、登錄檔更新、completion 產生與復原檢查。

安全審計

高風險

v8 • 2026/7/5 開啟版本化報告

Most static backtick findings are Markdown fences, slash-command examples, or JavaScript template literals and are false positives. Real risk remains where the skill instructs agents to run npx claude-flow@alpha, install command bundles globally, and write shell completion files under the home directory. No evidence found for prompt injection or data exfiltration intent.

已掃描檔案

576

分析行數

複核項目

已忽略的誤報

已確認的安全問題 (1)

高

SKILL.md:61-64 SKILL.md:388-405 PROCESS.md:14-24

Unpinned Alpha CLI Execution and Global Installation

The workflow repeatedly asks users or agents to run npx claude-flow@alpha and install generated command bundles globally. This creates supply-chain and persistence risk because the alpha package is not pinned to an immutable version.

The cited lines explicitly use npx claude-flow@alpha, global installation, and shell completion output under the home directory. The risk is contextual supply-chain and persistence exposure, not merely the presence of a shell block.

能力複核項目 (12)

這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。

高

SKILL.md:382-406

Ruby/shell backtick execution

```bash

The deployment block invokes npx claude-flow, installs a generated bundle with --global, updates registries, and writes shell completions in the home directory. Those actions can modify the host environment and persist command behavior.

高

SKILL.md:405

Hidden file in home directory

--output ~/.bash_completion.d/claude-flow-commands

Line 405 writes generated shell completions under ~/.bash_completion.d. Modifying hidden files under the home directory can persist shell behavior and should require explicit consent.

高

SKILL.md:405

Hidden file access

--output ~/.bash_completion.d/claude-flow-commands

Line 405 targets a hidden home-directory path for generated shell completion output. This is a real filesystem modification outside the project workspace.

中

PROCESS.md:6

Unix shell invocation

#!/bin/bash

The shebang starts a documented shell workflow that later runs npx claude-flow commands and installs command artifacts. As a runnable script, it should be treated as external command execution requiring review.

中

SKILL.md:59-96

Ruby/shell backtick execution

```bash

This bash block runs npx claude-flow and writes command-schema.json with shell redirection. It can execute package code and create files if followed by an agent.

中

SKILL.md:123-128

Ruby/shell backtick execution

```bash

The memory block invokes npx claude-flow and reads command-schema.json through an external CLI. This is legitimate workflow guidance but still executes a package command.

中

SKILL.md:137-157

Ruby/shell backtick execution

```bash

The generation block invokes npx claude-flow multiple times to create handlers, validation, routing, and a registry. These commands can modify project files and execute external package code.

中

SKILL.md:238-257

Ruby/shell backtick execution

```bash

The testing block runs npx claude-flow test commands and executes command test suites. It is expected for the workflow but remains external command execution.

中

SKILL.md:298-319

Ruby/shell backtick execution

```bash

The documentation block runs npx claude-flow commands that write docs, help text, catalogs, and examples. These are project file writes through an external CLI.

中

SKILL.md:410-427

Ruby/shell backtick execution

```bash

The validation block executes npx claude-flow and uses shell control flow to decide success or failure. It is active external command execution if followed by an agent.

中

SKILL.md:420

Shell command substitution

RESULT=$(npx claude-flow@alpha analyze ./src)

Line 420 captures the output of npx claude-flow using shell command substitution. This directly executes an external package command in the host shell.

中

SKILL.md:410-427

Template literal with command substitution

```bash

The flagged range contains a bash validation block with command substitution and npx execution. The pattern name is imprecise, but the underlying external command behavior is real.

審計單位: codex 檢視審計紀錄 →

分享與引用此報告

分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。

開啟版本化報告

複製報告連結

https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/security.svg)](https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

學術引用 (APA · BibTeX · CFF)

APA 引用

DNYoussef. (2026). when-creating-slash-commands-use-slash-command-encoder security audit report (audit version 8) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/audits/8

BibTeX 引用

@techreport{dnyoussef-dnyoussef-when-creating-slash-commands-use-slash-command-encoder-2026,
  author = {DNYoussef},
  title = {when-creating-slash-commands-use-slash-command-encoder security audit report (audit version 8)},
  institution = {Skillstore},
  year = {2026},
  number = {8},
  url = {https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/audits/8},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "when-creating-slash-commands-use-slash-command-encoder security audit report (audit version 8)"
version: "1.0.0"
type: report
authors:
  - name: "DNYoussef"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/dnyoussef-when-creating-slash-commands-use-slash-command-encoder/audits/8"
identifiers:
  - type: other
    value: "skillstore:dnyoussef-when-creating-slash-commands-use-slash-command-encoder:audit:8"
    description: "Skillstore immutable audit report identifier"

Skillstore 評分

評分依據證據置信度: 中

架構

100

可維護性

內容

社群

規範符合度

你可以打造什麼

標準化專案指令

為程式碼分析、測試與文件工作建立可重複使用的斜線指令模式。

產生指令處理常式

在實作前規劃處理常式結構、驗證規則、路由目標與錯誤行為。

準備指令文件

產生指令說明文字、使用範例與指令目錄，以利團隊採用。

試試這些提示

定義基本指令

Use this skill to design a slash command for [task]. Include the command name, required parameters, optional flags, and two examples.

新增驗證規則

Use this skill to create validation rules for [command]. Check required inputs, allowed ranges, default values, and helpful error messages.

產生並測試處理常式

Use this skill to outline a handler for [command]. Include routing, parameter validation, test cases, and expected failure cases.

建立指令套件

Use this skill to plan a slash command suite for [workflow]. Include command chaining, registry updates, documentation, deployment steps, and review gates.

最佳實務

在實際專案中執行任何 shell command 前，先確認每個指令。
保持指令名稱簡短、明確，並與既有工作流程一致。
在部署前驗證必要輸入並記錄失敗訊息。

避免

在審查產生指令的內容前，就將其全域安裝。
使用過於寬泛的指令名稱，導致指令用途不清。
略過必要參數、無效路徑與預期錯誤的測試。

常見問題

此技能會自動建立指令嗎？

它提供工作流程步驟與範本。實際的指令產生仍取決於本機 Claude Flow tooling。

它能與 Codex 搭配使用嗎？

可以。marketplace metadata 支援 Codex、Claude 與 Claude Code 工作流程。

它需要 Claude Flow 嗎？

範例使用 Claude Flow commands。如果你的專案使用其他指令框架，請替換它們。

直接執行每個 script 都安全嗎？

不一定。執行前請審查 npx commands、全域安裝與寫入 home directory 的操作。

它聚焦於哪些指令？

它聚焦於用於微技能路由、驗證、測試、文件與登錄檔工作流程的斜線指令。

我可以調整範本嗎？

可以。請變更指令名稱、參數、路由目標、測試與文件，以符合你的專案。

開發者詳細資訊

作者

DNYoussef

授權

MIT

作者版本

v1.0.0

Skillstore 修訂

儲存庫

https://github.com/DNYoussef/ai-chrome-extension/tree/main/.claude/skills/workflow/when-creating-slash-commands-use-slash-command-encoder

引用

c579efd02184f1128d6741d16e6c8d951d7d4208

維護新鮮度

2026/7/18

使用量

4 次下載 · 176 次瀏覽

檔案結構

📄 process-diagram.gv

📄 PROCESS.md

📄 README.md

📄 SKILL.md

when-creating-slash-commands-use-slash-command-encoder

使用我的智慧代理安裝

Agent 可讀資源

測試它

安全審計

已確認的安全問題 (1)

風險因素

複製報告連結

Markdown 徽章

HTML 徽章

嵌入卡片

APA 引用

BibTeX 引用

CITATION.cff

Skillstore 評分

你可以打造什麼

標準化專案指令

產生指令處理常式

準備指令文件

試試這些提示

最佳實務

避免

常見問題

開發者詳細資訊