跳到主要内容
知仓学习社ZHICANG

init-tauri-app

Scaffold a new Tauri v2 project with the cenno/cull house conventions — delegates boilerplate to `npm create tauri-app`, then layers an opinionated …

写文件读凭据改身份文件读文件执行命令联网严重 0 · 高危 12glebis/claude-skills

它会碰到什么

扫了多少28 个文本文件,30 KB
它会碰到什么写文件读凭据改身份文件读文件执行命令联网
命中总数18 处
命中统计严重 0 · 高 12 · 中 6 · 低 0

这个仓库里自带 2 个测试样本文件(有些技能仓会放故意的恶意样本做演示),它们不计入上面的能力与命中。

逐条看命中(12 条严重或高危)
  • assets/core/AGENTS.md:48identity-config-write
    - **Tauri MCP server** (`@hypothesi/tauri-mcp-server`, see `.mcp.json`) — screenshots, DOM
  • assets/modules/cli-mcp/INSERT.md:4identity-config-write
    2. Copy `capability.json` → `src-tauri/capabilities/mcp.json`.
  • assets/modules/release-preflight/release.sh:87cred-envread
    notes: process.env.N || 'See CHANGELOG.md.',
  • scripts/smoke-jtbd.sh:7identity-write
    printf '# proj\n\nA Tauri app.\n' > proj/AGENTS.md   # stand-in for the core AGENTS.md
  • scripts/smoke-jtbd.sh:7identity-write
    printf '# proj\n\nA Tauri app.\n' > proj/AGENTS.md   # stand-in for the core AGENTS.md
  • scripts/smoke-jtbd.sh:13identity-write
    awk 'NR==FNR{sec=sec $0 ORS; next} FNR==1{print; print ""; printf "%s", sec; next} {print}' proj/.jtbd-section.md proj/AGENTS.md > proj/AGENTS.md.new && mv proj
  • scripts/smoke-jtbd.sh:13identity-write
    awk 'NR==FNR{sec=sec $0 ORS; next} FNR==1{print; print ""; printf "%s", sec; next} {print}' proj/.jtbd-section.md proj/AGENTS.md > proj/AGENTS.md.new && mv proj
  • scripts/smoke-jtbd.sh:13identity-write
    awk 'NR==FNR{sec=sec $0 ORS; next} FNR==1{print; print ""; printf "%s", sec; next} {print}' proj/.jtbd-section.md proj/AGENTS.md > proj/AGENTS.md.new && mv proj
  • scripts/smoke-jtbd.sh:13identity-write
    awk 'NR==FNR{sec=sec $0 ORS; next} FNR==1{print; print ""; printf "%s", sec; next} {print}' proj/.jtbd-section.md proj/AGENTS.md > proj/AGENTS.md.new && mv proj
  • scripts/smoke-jtbd.sh:18identity-write
    grep -q "Must NOT do" proj/AGENTS.md
  • SKILL.md:68identity-config-write
    | `core/mcp.json` | `.mcp.json` |
  • SKILL.md:68identity-config-write
    | `core/mcp.json` | `.mcp.json` |

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

init-tauri-app

Scaffolds a new Tauri v2 project pre-loaded with conventions proven in two production apps

(cenno, cull). Delegates version-current boilerplate to the official scaffolder, then applies

a durable convention layer and any opt-in modules the user selects.

When to use

  • "Start a new Tauri app", "init a tauri project", "scaffold a tauri desktop app".

Prerequisites (verify before scaffolding)

  • node + npm on PATH (node --version)
  • cargo + rustc on PATH (cargo --version)
  • macOS + Xcode CLT only required if the Swift-sidecar module is selected

Procedure

1. Gather inputs (AskUserQuestion)

Ask, in one batch:

  • App name (kebab-case). Validate ^[a-z][a-z0-9-]*$.
  • Identifier (reverse-DNS, default com.glebkalinin.<name>).
  • Target directory (default ~/ai_projects/<name>). Abort if it exists and is non-empty.
  • Frontend framework: react-ts | svelte-kit | vanilla-ts.
  • Modules (multi-select): CLI+MCP · SQLite · Tray/Updater · Release/Preflight · Swift sidecar.
  • JTBD artifact (optional): a path to a jtbd.json. If not given, the skill auto-discovers

./jtbd.json then ~/jtbd/<name>/jtbd.json. See Step 1.5.

If Swift sidecar selected but host is non-macOS or xcrun --find swift fails: warn and drop it.

1.5 Ingest JTBD (optional, additive)

  1. Resolve the artifact, first hit wins: explicit path → ./jtbd.json~/jtbd/<name>/jtbd.json.

If none found, skip this whole step (the scaffold proceeds with empty product context — no error).

  1. Confirm: echo the artifact's hook and ask the user to confirm before using it. On decline, skip.
  2. Validate: the artifact must parse and have name, hook, jtbd. If not, warn and skip

ingestion (never abort the scaffold). render-jtbd.sh exits 3 on invalid input — treat that as "skip".

  1. Pre-fill: if valid, default the app name to name and identifier to com.glebkalinin.<name>

(still confirm with the user in Step 1 if not already chosen).

  1. The artifacts are written during Step 3 (core layer) — see the JTBD block there.

2. Scaffold base

cd <parent-of-target>
npm create tauri-app@latest <name> -- --template <framework> --manager npm --yes

Then cd <target> && npm install.

Known upstream fix (current rustc + Tauri 2.11.x): a bare scaffold's first cargo check

can fail with error[E0119] on cookie/time (transitive cookie 0.18.1 vs time 0.3.48).

This is not a skill bug — it hits any fresh create-tauri-app. If it occurs, run once in

src-tauri/: cargo update -p time --precise 0.3.47, then re-check.

3. Apply core layer

Copy every file from assets/core/ into the project, applying the renames in the table below,

then run a baseline gate. Substitute <name> (and <identifier> where the token appears) in

AGENTS.md and README.

| asset | destination |

|---|---|

| core/AGENTS.md | AGENTS.md |

| core/CLAUDE.md | .claude/CLAUDE.md |

| core/gitignore | .gitignore (merge: append only house lines not already present; skip lines — including comment headers — that already exist) |

| core/rust-toolchain.toml | src-tauri/rust-toolchain.toml |

| core/node-version | .node-version |

| core/mcp.json | .mcp.json |

| core/capabilities/default.json | src-tauri/capabilities/default.json (overwrite) |

| core/scripts/check-versions.sh | scripts/check-versions.sh (chmod +x) |

| core/README.md | README.md |

| core/CONTRIBUTING.md | CONTRIBUTING.md |

If a JTBD artifact was confirmed in Step 1.5, also:

  • Render assets/jtbd/PRODUCT.md.templatedocs/PRODUCT.md via

scripts/render-jtbd.sh <artifact> assets/jtbd/PRODUCT.md.template <artifact-path>.

  • Render assets/jtbd/guardrails-check.md.templatedocs/internal/guardrails-check.md.
  • Render assets/jtbd/agents-product-section.md.template and **insert it into AGENTS.md

immediately after the first heading** (so product context leads the file).

  • Copy the artifact verbatim to project-root jtbd.json (never modify the source).
  • Field→destination details: assets/jtbd/jtbd-map.md.

Create empty tracked dir docs/internal/.gitkeep and docs/.gitkeep.

Enable TS strict: ensure tsconfig.json has strict, noUnusedLocals, noUnusedParameters true.

Gate: cd src-tauri && cargo check and cd .. && npm run build. Both must pass before modules.

4. Compose selected modules

For each selected module, in this order — cli-mcp, sqlite, tray-updater, swift-sidecar,

release-preflight — open assets/modules/<m>/INSERT.md and follow it exactly: it lists files to

copy, Cargo deps to merge into src-tauri/Cargo.toml [dependencies], and insertion points in

src-tauri/src/lib.rs (tauri::generate_handler![...]) and src-tauri/src/main.rs.

After EACH module: cd src-tauri && cargo check. If it fails, fix the just-applied merge

before continuing (failures localize to the current module). For modules with a frontend/script

part, also run the relevant check named in that INSERT.md.

5. Final verification + handoff

  • cd src-tauri && cargo check → must pass
  • npm run build → must pass
  • bash scripts/check-versions.sh → must pass
  • Offer git init && git add -A && git commit -m "chore: scaffold via init-tauri-app".
  • Print a summary: framework, modules applied, modules skipped (with reason), next commands

(npm run tauri dev).

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。