跳到主要内容
知仓学习社ZHICANG

skill-tester

Validate, test, and score the quality of skills within the claude-skills ecosystem. Comprehensive meta-skill: structure validation, Python script te…

执行命令读凭据读文件写文件严重 0 · 高危 35alirezarezvani/claude-skills

它会碰到什么

扫了多少17 个文本文件,246 KB
它会碰到什么执行命令读凭据读文件写文件
命中总数48 处
命中统计严重 0 · 高 35 · 中 7 · 低 0
逐条看命中(30 条严重或高危)
  • scripts/script_tester.py:390exec-spawn
    process = subprocess.run(
  • scripts/script_tester.py:422exec-spawn
    process = subprocess.run(
  • scripts/script_tester.py:483exec-spawn
    process = subprocess.run(
  • scripts/script_tester.py:543exec-spawn
    process = subprocess.run(
  • scripts/security_scorer.py:165exec-shell-true
    # Subprocess with shell=True (HIGH severity)
  • scripts/security_scorer.py:429exec-spawn
    - os.system(), os.popen() usage
  • scripts/security_scorer.py:429exec-spawn
    - os.system(), os.popen() usage
  • scripts/security_scorer.py:430exec-shell-true
    - subprocess with shell=True
  • scripts/security_scorer.py:431exec-spawn
    - eval(), exec() usage
  • scripts/security_scorer.py:447exec-spawn
    (PATTERN_OS_SYSTEM, 'os.system usage - potential command injection', CRITICAL_VULNERABILITY_PENALTY),
  • scripts/security_scorer.py:448exec-spawn
    (PATTERN_OS_POPEN, 'os.popen usage', HIGH_SEVERITY_PENALTY),
  • scripts/security_scorer.py:451exec-shell-true
    (PATTERN_SUBPROCESS_SHELL_TRUE, 'subprocess with shell=True', HIGH_SEVERITY_PENALTY),
  • scripts/security_scorer.py:571exec-shell-true
    suggestions.append("Avoid shell=True in subprocess, use shlex.quote for shell arguments")
  • tests/test_security_scorer.py:122exec-spawn
    """Test that os.system pattern is detected."""
  • tests/test_security_scorer.py:123exec-spawn
    code = 'os.system("ls -la")'
  • tests/test_security_scorer.py:128exec-spawn
    code = 'result = eval(user_input)'
  • tests/test_security_scorer.py:137exec-shell-true
    """Test that subprocess shell=True pattern is detected."""
  • tests/test_security_scorer.py:138exec-spawn
    code = 'subprocess.run(cmd, shell=True)'
  • tests/test_security_scorer.py:138exec-shell-true
    code = 'subprocess.run(cmd, shell=True)'
  • tests/test_security_scorer.py:148cred-envread
    code = 'password = os.getenv("DB_PASSWORD")'
  • tests/test_security_scorer.py:194cred-envread
    return os.getenv("DB_PASSWORD")
  • tests/test_security_scorer.py:296cred-envread
    password = os.getenv("DB_PASSWORD")
  • tests/test_security_scorer.py:297cred-envread
    api_key = os.environ.get("API_KEY")
  • tests/test_security_scorer.py:434exec-spawn
    """Test that os.system usage is detected."""
  • tests/test_security_scorer.py:441exec-spawn
    os.system("echo " + user_input)
  • tests/test_security_scorer.py:454exec-spawn
    self.assertTrue(any('os.system' in f.lower() for f in findings))
  • tests/test_security_scorer.py:457exec-shell-true
    """Test that subprocess with shell=True is detected."""
  • tests/test_security_scorer.py:464exec-spawn
    subprocess.run(cmd, shell=True)
  • tests/test_security_scorer.py:464exec-shell-true
    subprocess.run(cmd, shell=True)
  • tests/test_security_scorer.py:486exec-spawn
    return eval(user_input)

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Skill Tester

Tier: POWERFUL · Category: Engineering Quality Assurance · Dependencies: None (Python stdlib only)

Meta-skill that validates, tests, and scores skills in this repository. Four tools, run from the repo root with full paths:

  1. scripts/skill_validator.py — structure + documentation compliance
  2. scripts/script_tester.py — Python script syntax/imports/runtime/output testing
  3. scripts/quality_scorer.py — multi-dimensional scoring with letter grade
  4. scripts/security_scorer.py — security posture scoring (also available via quality_scorer.py --include-security)

> Scope note: this skill's tier line-count minimums measure legacy skills. For authoring new skills, engineering/write-a-skill (SKILL.md under ~100 lines, Matt Pocock doctrine) is the binding standard — do not pad a new skill to satisfy a tier minimum here.

Quick Start (exact, runnable from repo root)

# 1. Validate structure (exit non-zero on failure — usable as a gate)
python3 engineering/skills/skill-tester/scripts/skill_validator.py engineering/skills/self-eval --json

# 2. Test the skill's Python scripts (30s default timeout per script)
python3 engineering/skills/skill-tester/scripts/script_tester.py engineering/skills/self-eval --json

# 3. Score quality (fail CI below threshold with --minimum-score)
python3 engineering/skills/skill-tester/scripts/quality_scorer.py engineering/skills/self-eval --json --detailed --minimum-score 75

Consume the JSON: validator emits overall_score, compliance_level, per-check checks{}; scorer emits overall_score, letter_grade, tier_recommendation, dimensions, and an improvement_roadmap — work the roadmap top-down, then re-run until the target score is met.

For repo-wide auditing prefer scripts/audit_skills.py at the repo root (wraps the write-a-skill checklist runner across all skills).

What Each Tool Checks

skill_validator.py

  • SKILL.md frontmatter parsing, required sections, minimum line counts per tier (--tier BASIC|STANDARD|POWERFUL)
  • Required structure: SKILL.md, README.md, scripts/, references/, assets/, expected_outputs/
  • Python scripts: argparse present, stdlib-only imports

script_tester.py

  • AST-based syntax validation; import analysis (flags external dependencies)
  • Controlled execution with timeout protection (--timeout, default 30s)
  • --help functionality verification; sample-data runs compared against expected_outputs/

quality_scorer.py

Four dimensions, 25% each: Documentation (depth, examples, references), Code Quality (complexity, error handling, output consistency), Completeness (required dirs, sample data, expected outputs), Usability (help text, example clarity). Outputs 0-100 + A-F grade + tier recommendation.

Tier Classification

| Tier | SKILL.md | Scripts | CLI surface |

|---|---|---|---|

| BASIC | ≥ 100 lines | 1 (100-300 LOC) | basic argparse |

| STANDARD | ≥ 200 lines | 1-2 (300-500 LOC) | subcommands, JSON + text output |

| POWERFUL | ≥ 300 lines | 2-3 (500-800 LOC) | multiple modes, CI integration |

(Advisory for legacy skills; new skills follow write-a-skill — see scope note above.)

CI Integration

# GitHub Actions: gate changed skills
- name: "validate-changed-skills"
  run: |
    for skill in $changed_skills; do
      python3 engineering/skills/skill-tester/scripts/skill_validator.py "$skill" --json
      python3 engineering/skills/skill-tester/scripts/script_tester.py "$skill"
      python3 engineering/skills/skill-tester/scripts/quality_scorer.py "$skill" --minimum-score 75
    done

Pre-commit hook: run the validator on the staged skill directory and block the commit on non-zero exit.

Verification Loop

A skill "passes" when, in one run from repo root:

  1. skill_validator.py <skill> --json exits 0,
  2. script_tester.py <skill> reports all scripts passing, and
  3. quality_scorer.py <skill> --minimum-score <target> exits 0.

If any step fails, apply the top improvement_roadmap item and re-run all three — never report a partial pass.

Troubleshooting

  • Timeout errors → raise --timeout or optimize the script under test
  • Import failures → external deps detected; stdlib-only is the repo policy
  • Tier misclassification → check line counts/LOC against the tier table; remember the write-a-skill exception for new skills

References: references/ holds the structure specification, tier requirements matrix, and scoring rubric the tools implement.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

同名技能的其他版本

有 2 个不同仓库或目录里都有叫 skill-tester 的技能。它们内容并不相同,别混用: