技能 web-development
📦
web-development
v2.23.8 內容修訂 r1 高風險 ⚙️ 外部命令🔑 環境變數🌐 網路存取📁 檔案系統存取
建置可靠的 Web 前端
當框架慣例、瀏覽器驗證與部署規則混在一起時，前端工作經常會失敗。此技能為 React、Vue、Vite 與 CloudBase Web 工作提供代理可遵循的結構化路徑。
支援: Claude Codex Code(CC)
安裝前請停止並請求確認。
請審查安裝計畫，並在變更檔案前取得使用者明確同意。
使用我的智慧代理安裝
將此請求複製給你的智慧代理，其中包含權威 Skill 頁面和清單。
智能體請求
Review the Skillstore skill "web-development" from https://skillstore.io/skills/tencentcloudbase-web-development.md and its manifest at https://skillstore.io/api/skills/tencentcloudbase-web-development/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智慧代理仍應顯示其計畫，並依安全政策請求必要確認。
Agent 可讀資源
當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。
測試它
正在使用「web-development」。 修復 React app 中損壞的登入重新導向。
預期結果:
- 識別負責重新導向的路由守衛與登入處理器。
- 套用聚焦修復，不變更無關頁面。
- 回報 typecheck、build 與瀏覽器驗證結果。
正在使用「web-development」。 將 Vite SPA 部署到 CloudBase static hosting。
預期結果:
- 確認 build 輸出、資產路徑與路由模式。
- 指出 history routing 所需的 index error document。
- 列出部署檢查項目與任何未驗證的憑證。
正在使用「web-development」。 將 CloudBase 資料載入加入 Vue 頁面。
預期結果:
- 將 SDK 設定保留在既有前端結構中。
- 在瀏覽器中驗證 loading、empty、success 與 error 狀態。
- 將 Web SDK 工作與無關的後端變更分開。
安全審計
高風險v2 • 2026/7/9 開啟版本化報告
Most static findings are false positives caused by Markdown inline code, documentation URLs, and fixed sibling-skill paths. Confirmed risks involve unpinned remote instruction URLs and a public frontend access-key example. Semantic findings also identify unsafe token-cookie and credentialed CORS guidance.
3
已掃描檔案
471
分析行數
8
複核項目
0
已忽略的誤報
已確認的安全問題 (4)
高
Environment file access
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The sample places CLOUDBASE_ACCESS_KEY in a NEXT_PUBLIC variable, which Next.js exposes to browser bundles. If the value is a secret key, users following the sample leak credentials.
高
Client-Side Token Cookie Guidance
The Next.js example writes a session access token with document.cookie and later reads it from a request cookie. A JavaScript-readable token cookie is exposed to XSS and omits Secure, HttpOnly, and SameSite protections.
The example directly stores data.session.access_token in document.cookie and then reads cloudbase_token from request cookies. The security weakness follows from the documented flow.
中
Permissive Credentialed CORS Example
The NestJS sample allows an origin fallback of * while credentials are enabled. This can teach deployments to combine credentialed requests with overly broad origins.
The CORS example shows a wildcard origin fallback and credentials enabled in the same configuration block. This is a clear unsafe deployment pattern.
中
Mutable Remote Instruction Dependency
The standalone instructions tell agents to use raw main-branch URLs for protocols and sibling skills. Unpinned remote instructions can change after marketplace review and alter agent behavior.
The URLs are explicit raw references to main-branch skill and protocol content. The risk is mutable remote instruction loading, not a generic hardcoded URL.
能力複核項目 (8)
這些是真實的本機能力，對此技能而言可能是預期行為，因此需要複核，但不會按已確認的惡意行為計分。
高
Environment variable access (dot notation)
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.
高
Environment variable object
accessKey: process.env.NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY!,
The example reads a variable named NEXT_PUBLIC_CLOUDBASE_ACCESS_KEY in browser initialization. NEXT_PUBLIC values are exposed to the client, so a secret access key would leak.
低
Hardcoded URL
- CloudBase main entry: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/sk
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Current skill raw source: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/mai
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Change Safety Protocol: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Deployment Gate: `https://cnb.cool/tencent/cloud/cloudbase/cloudbase-skills/-/git/raw/main/skills/
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Login flow -> `../auth-tool/SKILL.md` (standalone fallback: `https://cnb.cool/tencent/cloud/cloudb
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
低
Hardcoded URL
- Official Account JSAPI Pay, Native QR-code Pay, or WeChat OAuth on CloudBase -> `../cloudbase-wech
The skill points agents to raw remote instruction content on an unpinned main-branch URL. This is legitimate documentation, but it creates a mutable external dependency after audit.
風險因素
⚙️ 外部命令 (48)
frameworks.md:46-56 SKILL.md:10 SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:18 SKILL.md:19 SKILL.md:34 SKILL.md:35 SKILL.md:39 SKILL.md:40 SKILL.md:41 SKILL.md:42 SKILL.md:49 SKILL.md:57 SKILL.md:66 SKILL.md:68 SKILL.md:69 SKILL.md:70 SKILL.md:71 SKILL.md:72 SKILL.md:73 SKILL.md:74 SKILL.md:78 SKILL.md:79 SKILL.md:85 SKILL.md:86 SKILL.md:87 SKILL.md:92 SKILL.md:100 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:129 SKILL.md:130 SKILL.md:133 SKILL.md:138 SKILL.md:158 SKILL.md:159 SKILL.md:171 SKILL.md:172 SKILL.md:178 SKILL.md:186 SKILL.md:189-191 SKILL.md:191-194 SKILL.md:194-196 SKILL.md:196-200 SKILL.md:200-209
🔑 環境變數 (10)
📁 檔案系統存取 (2)
審計單位: codex 檢視審計紀錄 →
分享與引用此報告
分享版本化評估報告、中性徽章、嵌入卡片與引用。Skillstore 只報告證據，不判斷該 Skill 是否安全。
複製報告連結
https://skillstore.io/skills/tencentcloudbase-web-development/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/tencentcloudbase-web-development?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/tencentcloudbase-web-development?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/tencentcloudbase-web-development/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/tencentcloudbase-web-development.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>學術引用 (APA · BibTeX · CFF)
APA 引用
tencentcloudbase. (2026). web-development security audit report (audit version 2) [Author version 2.23.8]. Skillstore. https://skillstore.io/skills/tencentcloudbase-web-development/audits/2BibTeX 引用
@techreport{tencentcloudbase-tencentcloudbase-web-development-2026,
author = {tencentcloudbase},
title = {web-development security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/tencentcloudbase-web-development/audits/2},
note = {Author version 2.23.8}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "web-development security audit report (audit version 2)"
version: "2.23.8"
type: report
authors:
- name: "tencentcloudbase"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/tencentcloudbase-web-development/audits/2"
identifiers:
- type: other
value: "skillstore:tencentcloudbase-web-development:audit:2"
description: "Skillstore immutable audit report identifier"
Skillstore 評分
評分依據 證據置信度: 中 55
架構
100
可維護性
87
內容
65
社群
100
規範符合度
你可以打造什麼
修復 Web 流程錯誤
找出負責的路由、元件或處理器，然後在瀏覽器中驗證使用者可見的流程。
整合 CloudBase Web
加入 CloudBase Web SDK 用法，同時保持瀏覽器與伺服器邊界清楚。
驗證發布就緒狀態
部署前檢查 build 輸出、SPA 路由、靜態託管設定與瀏覽器行為。
試試這些提示
驗證路由變更
Use the web-development skill to inspect the existing app, identify the affected route, make the smallest fix, and report build and browser checks.
新增 Vite 頁面
Use the web-development skill to add a new Vite page within existing routing and component conventions. Include validation steps and remaining gaps.
整合 CloudBase Auth
Use the web-development skill to review the current auth surface, keep browser SDK usage client-side, and route provider details to auth skills.
準備 SPA 託管
Use the web-development skill to prepare a React or Vue SPA for CloudBase static hosting. Verify routing mode, build output, and browser refresh behavior.
最佳實務
- 變更程式碼前先閱讀既有的路由、服務與 build 慣例。
- 執行符合受影響使用者流程的專案檢查與瀏覽器流程。
- 將 CloudBase 整合與無關的 UI 或後端重構分開。
避免
- 使用者要求實作或除錯時，卻開始重新設計。
- 沒有 build、lint、test 或瀏覽器證據就宣稱完成。
- 透過公開的前端環境變數暴露敏感憑證。
常見問題
此技能會建立視覺設計嗎？
不會。它會指示代理在視覺系統工作前使用設計技能。
它支援哪些框架？
它聚焦於 React、Vue、Vite、Next.js 邊界與相關瀏覽器工作流程。
它可以部署 CloudBase static sites 嗎？
它提供部署門檻與靜態託管指引，但仍需要憑證與專案設定。
它會自動執行瀏覽器測試嗎？
它會告訴代理何時使用瀏覽器驗證工具，以及要收集哪些證據。
它只適用於新 app 嗎？
不會。它偏好既有專案模式，以及在既有應用程式中進行目標明確的修復。
它如何處理 authentication？
它提供 Web 邊界指引，並將詳細的 provider 工作路由至配套 auth 技能。
開發者詳細資訊
授權
MIT
作者版本
v2.23.8
Skillstore 修訂
r1
引用
24b2fe42a456262f3fd0fb3df72e12d9ed2c32ec
維護新鮮度
2026/7/18
使用量
0 次下載 · 0 次瀏覽
檔案結構