跳到主要内容
知仓学习社ZHICANG

add

Register a deferred decision in the debt registry. Trigger by judgment, not a marker scan, whenever a future reader would ask "why this way?": an un…

读凭据执行命令写文件严重 0 · 高危 2hashgraph-online/awesome-codex-plugins

它会碰到什么

扫了多少2 个文本文件,10 KB
它会碰到什么读凭据执行命令写文件
命中总数4 处
命中统计严重 0 · 高 2 · 中 2 · 低 0
逐条看命中(2 条严重或高危)
  • scripts/register.py:31cred-envread
    override = os.environ.get("DEBT_OPS_CACHE")
  • scripts/register.py:50exec-spawn
    out = subprocess.run(

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

add — register a tech-debt entry

Call the bundled register.py via Bash — it lives in this skill's scripts/ directory, so reference it with the relative path below (Codex resolves it against the skill root). The helper writes the entry under the repo's detected registry dir (default docs/debt/), assigns a short batch letter (A, B, C…), and prints exactly one line: +1 entry: <slug> (<letter>). That stdout IS the user-facing announcement — add no commentary before or after.

The call

python3 scripts/register.py \
  --slug <slug> \
  --principal <effort, e.g. 2d, 1w, unknown> \
  --interest <ongoing cost, e.g. "+30min/incident", unknown> \
  --hotspot <path or module, e.g. pricing/engine.ts, unknown> \
  --business-capability <e.g. checkout, billing, unknown> \
  --payoff-trigger <concrete trigger, or "unknown"> \
  --quadrant <reckless-inadvertent|reckless-deliberate|prudent-inadvertent|prudent-deliberate> \
  --category <migration|documentation|testing|code_quality|dead_code|code_rot|expertise|release|infrastructure|planning> \
  --ai-authored <true|false> <<'EOF'
<body: 2-5 sentences — what the debt is, why it exists, observed symptoms>
EOF

The helper:

  • Generates the timestamp id itself (no date call needed).
  • Resolves filename collisions when two registrations land in the same second.
  • Tracks the letter mapping in ~/.cache/debt-ops/cache/<repo-hash>/current-turn.txt (override the base with DEBT_OPS_CACHE) so the user can drop by letter.

Slug

1–4 word kebab-case label of what the debt is. Examples: cancelled-promotion-callback, legacy-auth-shim, unfinished-rate-limiter. Keep it short — the body carries the context.

Schema notes

  • Quadrant (Fowler): reckless-inadvertent (didn't know better), reckless-deliberate (knew, did it anyway), prudent-inadvertent (learned afterward), prudent-deliberate (deliberate, with a payoff plan).
  • Category (Google / Jaspan-Green): pick the closest match.
  • payoff_trigger: unknown is first-class. Don't manufacture a trigger to fill the field — unknown ages into stale review and that's the point.
  • ai_authored: true is the leading behavioral signal — be honest.

Drops

  • drop A, drop A,C, drop all — the user types this; a UserPromptSubmit hook deletes the matching entries and surfaces a one-line confirmation. You don't act on those.
  • drop it or drop <slug> — you delete it yourself: rm <registry-dir>/<id>-<slug>.md (the registry dir named in Discipline 3; default docs/debt/). Treat dropping as cheap — over-registering is the intended posture.

Don't

  • Don't ask the developer for confirmation before writing. Discipline 1 says "no permission prompt; just do it."
  • Don't write the file directly with an editor tool — letter assignment depends on going through register.py.
  • Don't echo or paraphrase the helper's output. The Bash tool result is already visible to the user.
  • Don't fill payoff_trigger with a guess to seem certain.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。