CF enterprise-skills-studio
企业技能工程台（通用、跨平台）。面向企业管理者、业务与技术人员，覆盖企业级技能的"学习理解 / 构建设计 / 个人→企业升级 / 治理管理 / 安全审查 / 持续进化 / 跨平台适配 / 体系规划 / 流程技能生成 / 生命周期 Ops / ROI 筛选 / 进化维护 / 技能发现复用 / 培训推广 / Agentic 治理 / 选题透镜 / 技能编排 / 评测套件 / 统一 CLI / 成本计量 / 门户生成"。基于 Agent Skills 开放标准（agentskills.io），产出的技能可在 WorkBuddy、Codex、Claude Code、Cursor、龙虾、Hermes 等支持该标准的桌面 Agent 间移植。遵循"厚技能+薄 harness"原则。当用户要"懂企业技能 / 做一个企业技能 / 把个人技能转企业级 / 治理审查技能 / 跨平台适配技能 / 规划企业技能体系 / 把 ERP·CRM·HRM·OA 等系统型业务流或 Agentic Workflow 做成技能 / 评估技能值不值得做(ROI) / 治理技能生命周期与弃用 / 维护技能 Evolution Log / 新造技能前查重避免重复 / 生成业务培训推广包 / 做跨平台适配合规检查 / 治理一支 Agent 队伍(评估护栏可观测责任归属) / 用 PEST·波特五力·价值链找高杠杆流程做技能选题 / 把多个技能编排成工作流 / 生成技能的评测测试用例 / 加固技能防 PII 泄露与 prompt 注入 / 用一个统一命令(studio)调度所有技能工程脚本 / 追踪技能运行成本与调用计量来佐证 ROI / 把技能库生成可发现的门户目录或网页 / 在发布或移植某技能前同时跑安全体检与移植体检做卡点(gate) / 让本技能自我更新(说"检查/更新本技能"，默认仅检查、需确认才应用) / 审计扫描某技能的安全性(SkillSec 16 类，借鉴 NVIDIA SkillSpector 方法论)"时使用。
企业技能工程台（通用、跨平台）。面向企业管理者、业务与技术人员，覆盖企业级技能的"学习理解 / 构建设计 / 个人→企业升级 / 治理管理 / 安全审查 / 持续进化 / 跨平台适配 / 体系规划 / 流程技能生成 / 生命周期 Ops / ROI 筛选 / 进化维护 / 技能发现复用 / 培训推广 /…
As a process F 37/100 · Will not run — References files that are not bundled: assets/SKILL.md.template
What is at stake
Medium-severity findings: the skill is probably honest, but read what alarmed the scanner.
Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.
The skill contains commands that delete files, rewrite disks or execute code fetched from the network. The agent may run them without asking if it believes the instructions require it.
Replace destructive commands with safe equivalents that ask for confirmation, scope them to one folder, and stop piping curl into a shell: pin a version and a checksum.
How to improve
- Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
- The text references files that are not there: add them or drop the references.
- Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
- A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.
Guard findings · 11
✓ No critical or high findings
Medium and low: 11
-
medium Dangerous commands
cmd-pipe-to-shellREADME.md:75Downloads and executes remote code from an unrecognised host (pipe to shell) (quoted — discussed, not commanded)7. 安全语义层（编码绕过 base64·ROT13·零宽字符 / 敏感路径 ssh·aws·.env·记忆文件 / 裸 IP 外联 / 提权 / 未声明装包 / 声明-能力一致性 / 供应链投毒 `curl|sh`）
quoted -
medium Dangerous commands
cmd-pipe-to-shellscripts/review_checklist.py:432Downloads and executes remote code from an unrecognised host (pipe to shell) (code comment)# 供应链投毒：下载即执行（curl|sh / wget|sh 等管道给 shell）
comment -
medium Dangerous commands
cmd-pipe-to-shellscripts/review_checklist.py:434Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed)add("语义层", "SUPPLY1", "供应链投毒（下载即执行 curl|sh 等）",code literal -
medium Dangerous commands
cmd-pipe-to-shellscripts/review_checklist.py:436Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed)f"疑似下载即执行: {m.group(0)!r}" if m else "未检出 curl|sh / wget|sh 等管道执行远程脚本")code literal -
low Dangerous commands
cmd-pipe-to-shellREADME.md:30Downloads and executes remote code from an unrecognised host (pipe to shell) (security demo / example; quoted — discussed, not commanded)- 安全风险（密钥外泄、提权、`curl|sh` 投毒、prompt 注入）
demoquoted -
low Instruction override
en-ignore-previousreferences/skill-spector-method.md:23Instruction-override phrase ("ignore previous instructions") (detector / deny-list definition; documentation table row; security demo / example; test fixture / example file)| C07 | 提示注入 Prompt injection | 指令覆盖/隐藏指令类表述 | "ignore previous instructions" |
detectortabledemofixture -
low Risky intent
intent-offensive-securityreferences/skill-spector-method.md:25Offensive-security / dual-use content (legitimate for authorised testing; review intended use) (test fixture / example file)| C09 | 特权升级 Privilege escalation | 提权执行；硬编码凭据 | `sudo`；`ghp_...` |
fixture -
low Dangerous commands
cmd-pipe-to-shellreferences/skill-spector-method.md:26Downloads and executes remote code from an unrecognised host (pipe to shell) (documentation table row; test fixture / example file)| C10 | 供应链 Supply chain | 下载即执行；远端获取后执行；编码绕过；未钉置依赖 | `curl|sh`；`b64decode` |
tablefixture -
low Dangerous commands
cmd-pipe-to-shellreferences/skill-spector-method.md:51Downloads and executes remote code from an unrecognised host (pipe to shell) (detector / deny-list definition; test fixture / example file)- **高（HIGH）**：明确危险信号（如 `curl|sh`、硬编码凭据、零宽字符、exec/eval 流入外部输入）。CI 应阻断。
detectorfixture -
low Dangerous commands
cmd-pipe-to-shellscripts/review_checklist.py:156Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed; code comment)# 供应链投毒：下载即执行（curl|sh / wget|sh / 管道给 shell）
code literalcomment -
low Dangerous commands
cmd-pipe-to-shellscripts/skillsec_audit.py:399Downloads and executes remote code from an unrecognised host (pipe to shell) (string literal in code, not executed; documentation of a security skill)"存在下载即执行（curl|sh / wget|sh 管道给 shell），典型供应链投毒向量。"))
code literalsecurity skill
Files scanned: 42. Evidence is masked. Grey chips explain why severity was lowered.
Against the Agent Skills spec
- warning
description-no-whendescription does not say WHEN to use the skill (no "use when") - warning
missing-refreference to a missing file: assets/SKILL.md.template - note
frontmatter-keyunknown frontmatter key "agent_created" - note
frontmatter-keyunknown frontmatter key "capabilities"
Process rating: all ten parameters 37/100
- 0Tools and files. 1 referenced file(s) missing: assets/SKILL.md.template
- 0Result and completion. Does not say what the result is
- 0Inputs and preconditions. Does not say what the process needs to start
- 0Failures and branches. Linear process with no failure handling
- 20When it triggers. No condition that starts the skill
- 100Steps. 102 steps
- 100Consistency. Name and required fields are in place
- 100Execution cost. Instruction body is 3130 tokens
- 100Running it twice. No mutating operations
- 100Progress reporting. Reports progress
- low The response is described with custom markup (3 tags): a typed call is more reliable
Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.
Quality signals
- +4Description does not say when NOT to use the skill (false activations)
- +3Description length 857: 120–800 characters recommended
- +3Output format is not stated: the model decides each time
- +4No input/output examples
- -233 emoji in the instructions: noise for the model
- +2Single-language instructions
- +5Description quotes 2 example trigger phrases
- +4Structure: 10 headings
- +3Step-by-step instructions: 102 items
- +4Reference files are cited in the instructions (20 of 20)
- +3All 16 scripts are documented
- +1License stated
Quality base 70; lint remarks subtract, signals add up to 100. Result: 68.