技能 business-conflict-analyzer
📦
business-conflict-analyzer
內容修訂 r1 高風險 ⚙️ 外部命令📁 檔案系統存取🔑 環境變數⚡ 包含腳本🌐 網路存取
在提交前分析破壞性變更
合約與結構描述的變更可能會破壞下游服務、用戶端及資料流程。此技能會找出受影響的參照，並在提交前產生業務影響報告。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "business-conflict-analyzer" from https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer.md and its manifest at https://skillstore.io/api/skills/gobeyondyang-business-conflict-analyzer/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「business-conflict-analyzer」。 將 UserDTO.mobile 重新命名為 phone，並評估下游影響。
預期結果:
- 風險：高，因為現有取用端仍參照已移除的欄位。
- 受影響範圍：服務對應、前端個人資料檢視、測試及已儲存資料的遷移。
- 建議：保留相容性欄位、更新取用端、遷移資料，並在移除前驗證合約。
正在使用「business-conflict-analyzer」。 將 orders 端點從版本一變更為版本二。
預期結果:
- 風險：若遷移期間仍保留舊路由，則風險為中等。
- 受影響範圍：API 用戶端、路由測試、文件、監控及部署設定。
- 建議：新增路由、棄用舊路由、通知負責人，並監控採用情況。
正在使用「business-conflict-analyzer」。 刪除事件產生器使用的資料庫欄位。
預期結果:
- 風險：高，因為歷史資料與訊息取用端可能遺失必要值。
- 必要措施：盤點參照、回填或封存資料、為事件結構描述建立版本，並協調部署順序。
安全審計
高風險v4 • 2026/7/19 開啟版本化報告
Most static alerts are false positives from Markdown, test fixtures, locale handling, fixed argv subprocess calls, and readable multilingual files. Confirmed risks include mutable remote fetches, out-of-repository scanning, persistent agent configuration changes, and a destructive repository-wide rollback directive. The skill also claims blanket authority for broad consumer edits, which is a high-confidence prompt injection risk.
22
已掃描檔案
5,440
分析行數
12
複核項目
0
已忽略的誤報
已確認的安全問題 (1)
高
Prompt Injection Attempt Detected
SKILL.md states, "AI knows it's authorized to fix all consumers" and says, "Do not ask the user per-consumer." This converts one acceptance into blanket authority for broad edits.
The text explicitly claims expanded authorization and suppresses per-consumer confirmation. The directive is clear and directly affects agent edit scope.
能力複核項目 (12)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Path traversal sequence
for rel in ("../frontend", "../web", "../../frontend",
The analyzer deliberately searches ../frontend, ../web, and ../../frontend, crossing the selected repository boundary. This can read source from sibling directories without separate scope approval.
高
Ruby/shell backtick execution
| **→ 2** ❌ | 1. `git checkout -- .` to discard changes. 2. Confirm rollback complete. |
The skill explicitly directs the agent to run git checkout -- . when the user rejects a proposal. That command discards all tracked working-tree changes, including unrelated work.
中
Python environment access
env_roots = os.environ.get("FRONTEND_ROOT", "")
FRONTEND_ROOT accepts path lists, including absolute paths, and those locations are recursively searched. A configured value can expand file access beyond the audited project.
中
Hidden file access
CONFIG_DIR="$PROJECT_DIR/.claude"
The installer targets .claude/settings.local.json, a hidden agent configuration file, to register a persistent executable hook. The behavior is disclosed but remains security-sensitive.
中
Python file write/append
with open(config_file, 'w', encoding='utf-8') as f:
The installer rewrites an existing agent settings file after adding a PreToolUse command. This persistent configuration change can affect later tool execution.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/dif
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/imp
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/rep
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/lan
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/com
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/scripts/ins
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
中
Hardcoded URL
- url: https://github.com/GoBeyondYang/skills/raw/main/skills/business-conflict-analyzer/references/
The fetch metadata automatically retrieves a companion file from the mutable main branch without a commit pin or integrity hash. Upstream changes therefore enter the skill trust boundary.
風險因素
⚙️ 外部命令 (50)
analyze.sh:4 analyze.sh:10 scripts/commit_guard.py:38 scripts/commit_guard.py:59 scripts/commit_guard.py:67 scripts/commit_guard.py:5 scripts/diff_analyzer.py:64 scripts/diff_analyzer.py:75 scripts/impact_mapper.py:194 scripts/impact_mapper.py:266 scripts/impact_mapper.py:274 scripts/impact_mapper.py:177 scripts/impact_mapper.py:216 scripts/install_hook.sh:9 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/report_generator.py:183-199 scripts/report_generator.py:199-314 SKILL.md:21 SKILL.md:24 SKILL.md:27 SKILL.md:30 SKILL.md:53 SKILL.md:55 SKILL.md:56 SKILL.md:58 SKILL.md:66 SKILL.md:74 SKILL.md:75 SKILL.md:80 SKILL.md:82 SKILL.md:87 SKILL.md:100 SKILL.md:108-131 SKILL.md:131-154 SKILL.md:154-155 SKILL.md:155-156 SKILL.md:156-157 SKILL.md:157-165 SKILL.md:165 SKILL.md:168-170 SKILL.md:170-172 SKILL.md:172 SKILL.md:174 SKILL.md:176-178 SKILL.md:178-180 SKILL.md:180 SKILL.md:188-189 SKILL.md:189-193 SKILL.md:193-194
📁 檔案系統存取 (21)
README.md:1 scripts/impact_mapper.py:232 scripts/impact_mapper.py:392 scripts/install_hook.sh:29 scripts/install_hook.sh:18 scripts/install_hook.sh:28 scripts/install_hook.sh:66 tests/test_commit_guard.py:9 tests/test_commit_guard.py:31 tests/test_commit_guard.py:62 tests/test_commit_guard.py:64 tests/test_commit_guard.py:74 tests/test_impact_mapper.py:247 tests/test_impact_mapper.py:248 tests/test_impact_mapper.py:264 tests/test_impact_mapper.py:265 tests/test_impact_mapper.py:251 tests/test_impact_mapper.py:253 tests/test_impact_mapper.py:267 tests/test_impact_mapper.py:250 tests/test_impact_mapper.py:266
🔑 環境變數 (14)
scripts/impact_mapper.py:382 scripts/install_hook.sh:48 scripts/install_hook.sh:49 scripts/install_hook.sh:50 scripts/lang.py:420 tests/run_all.py:23 tests/test_lang.py:34 tests/test_lang.py:35 tests/test_lang.py:41 tests/test_lang.py:43 tests/test_lang.py:49 tests/test_lang.py:50 tests/test_lang.py:56 tests/test_lang.py:58
⚡ 包含腳本 (3)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/gobeyondyang-business-conflict-analyzer/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/gobeyondyang-business-conflict-analyzer.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
gobeyondyang. (2026). business-conflict-analyzer security audit report (audit version 4) [Author version unspecified]. Skillstore. https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4BibTeX 引用
@techreport{gobeyondyang-gobeyondyang-business-conflict-analyzer-2026,
author = {gobeyondyang},
title = {business-conflict-analyzer security audit report (audit version 4)},
institution = {Skillstore},
year = {2026},
number = {4},
url = {https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "business-conflict-analyzer security audit report (audit version 4)"
version: "unspecified"
type: report
authors:
- name: "gobeyondyang"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/gobeyondyang-business-conflict-analyzer/audits/4"
identifiers:
- type: other
value: "skillstore:gobeyondyang-business-conflict-analyzer:audit:4"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 77
架構
85
可維護性
87
內容
65
社群
83
規範符合度
你可以打造什麼
審查 API 合約變更
追蹤 DTO、端點及回應變更對後端用戶端、前端取用端與相容性需求的影響。
規劃資料庫遷移
評估 DDL 變更、現有資料風險、服務相依性及必要的發布順序。
協調跨技術堆疊發布
在核准前，為服務、網頁用戶端、測試及業務負責人產生共用的影響報告。
試試這些提示
分析目前的變更
分析我目前的 Git 變更。列出破壞性變更、受影響的取用端、遷移需求及建議的後續步驟。請勿修改檔案。
審查欄位重新命名
審查 [contract] 中將 [old field] 重新命名為 [new field] 的變更。找出後端與前端取用端，並提出向後相容的遷移步驟。
評估結構描述發布
分析自 [revision] 以來的 DDL 與 API 變更。找出對資料、服務、訊息及用戶端的影響，並產生分階段發布與復原計畫。
稽核已暫存的提交變更
僅分析已暫存的變更。識別 P0 與 P1 風險、說明佐證，並提供決策選項。請勿安裝掛鉤或捨棄變更。
最佳實務
- 從預定的儲存庫根目錄執行分析，並在執行前審查每個外部掃描路徑。
- 核准變更前，請透過編譯、測試、結構描述檢查及服務負責人的確認來核對分析結果。
- 使用已固定版本的技能資源，並在套用相容性修正或安裝提交防護前審查報告。
避免
- 請勿將無異常的報告視為不支援的語言、產生的程式碼或動態取用端未受影響的證明。
- 請勿在未審查完整檔案清單及預定範圍的情況下，核准涵蓋整個儲存庫的自動修正。
- 當工作目錄中可能存在不相關的變更時，請勿使用範圍過大的復原命令。
常見問題
支援哪些語言與框架？
包含 Java、Kotlin、Python、TypeScript、JavaScript、Go、Vue、React、JSP、SQL、YAML、XML 及常見網頁框架的規則。
它會修改我的程式碼嗎？
分析指令碼會產生報告。技能文件也會提出選用的修正、復原操作及掛鉤安裝方案，這些操作都需要審慎核准。
它可以封鎖 Git 提交嗎？
可以。選用的 Claude Code 掛鉤會在 git commit 前執行分析器，並封鎖分類為 P0 的變更。
它可以取代測試或編譯嗎？
不會。它使用啟發式方法與參照搜尋。請透過建置、測試、合約驗證及負責人審查來確認重要的分析結果。
報告會儲存在哪裡？
命令列管線會將 conflict-report.md 寫入目前的專案目錄，並可能覆寫同名的現有檔案。
它需要網路存取嗎？
隨附的指令碼位於本機，但技能的 frontmatter 會在載入時自動從 GitHub 擷取配套檔案。
開發者詳細資訊
作者
gobeyondyang授權
MIT
Skillstore 修訂
r1
版本提示
作者未聲明版本。
引用
536932510ff0a3e976ac88662d9e038a7faa088b
維護新鮮度
2026/7/18
使用量
0 次下載 · 0 次瀏覽