跳到主要内容
知仓学习社ZHICANG

domain

Clarify domain terms, bounded contexts and repository conventions. Use when: naming, rule ownership or Go and other language standards are unclear; …

读凭据执行命令严重 3 · 高危 0hashgraph-online/awesome-codex-plugins

它会碰到什么

扫了多少21 个文本文件,85 KB
它会碰到什么读凭据执行命令
命中总数10 处
命中统计严重 3 · 高 0 · 中 7 · 低 0
逐条看命中(3 条严重或高危)
  • 严重 references/standards/common-standards.md:189cred-paths
    | Use `.env` files locally (gitignored) | Commit `.env` or credential files |
  • 严重 references/standards/common-standards.md:189cred-paths
    | Use `.env` files locally (gitignored) | Commit `.env` or credential files |
  • 严重 references/standards/yaml.md:23yaml-unsafe
    - Never use `yaml.load()` (Python) — always `yaml.safe_load()`

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Domain — ubiquitous language

Make the caller's domain language precise enough to use consistently in

acceptance examples, code and conversation. A bounded context is the area in

which a term has one agreed meaning and an owner for its rules. Different

contexts may legitimately use the same word differently.

Procedure

  1. Locate the caller repository's existing vocabulary owner from its instructions,

domain docs or contracts. Read only the terms and context boundaries relevant

to the task. Cite the source when returning a definition; a lookup is read-only.

If no definition exists, distinguish an observed code name from a proposed term.

  1. For an ambiguous term, identify the actor, state, operation and observable

result it denotes. Compare the intended meaning with relevant callers, types

and tests. Report a disagreement between code and accepted intent explicitly;

neither silently rewriting intent to match code nor renaming a bug fixes it.

  1. Use a concrete example to distinguish competing meanings. For branching

behavior, express the consequential boundary as Given/When/Then. Reuse the

accepted example in implementation and validation. Ask only when an unresolved

distinction would change behavior or ownership; do not interview for a lookup.

  1. Use the settled term in scenario names, operations, types and documentation.

When a word crosses contexts, name each meaning and the translation between

them instead of imposing one global definition. Keep naming changes within

authorized scope; exported names, serialized fields and stored values may

require compatibility work, not a cosmetic replacement.

  1. When vocabulary refinement is authorized, update its existing source owner

with the meaning, relevant context and distinguishing example. Preserve useful

aliases as explicit translations. Without an owner, return the proposal in

the caller's existing intent or conversation; create no glossary by default.

Return unresolved distinctions and stop when the next change can be named

and judged consistently.

AgentOps terms

When AgentOps is the subject, its owners remain

docs/contracts/ubiquitous-language.md and, for responsibilities and ports,

docs/contracts/bounded-contexts.yaml. Return their exact definitions and

source paths. Do not apply AgentOps vocabulary to an unrelated caller domain.

The synonym smuggling failure substitutes a word that changes a term's authority:

calling a verdict a closure quietly assigns a tracker transition to judgment.

The operations layer, federated integration graph, semantic work-and-proof

protocol and RPI traversal retain their distinct meanings in the live contract.

Queue, claim, lease, close, land, release and delivery remain caller-system

responsibilities. Vocabulary edits do not authorize those transitions.

References

Applicable engineering standards

Load only the language or risk guidance needed for the current change from

[standards references](references/standards/common-standards.md). Repository

contracts and the actual toolchain take precedence. A vocabulary lookup does

not require a coding-standards survey, and these references do not create a

second approval or validation lane.

Choose just the applicable reference:

  • Languages: [Go](references/standards/go.md), [Python](references/standards/python.md), [Rust](references/standards/rust.md), [JavaScript](references/standards/javascript.md), [TypeScript](references/standards/typescript.md), [shell](references/standards/shell.md).
  • Data and prose: [JSON](references/standards/json.md), [YAML](references/standards/yaml.md), [Markdown](references/standards/markdown.md).
  • Relevant risk: [concurrency](references/standards/race-condition-checklist.md), [SQL](references/standards/sql-safety-checklist.md), [LLM trust](references/standards/llm-trust-boundary-checklist.md).
  • Test design: [test pyramid](references/standards/test-pyramid.md); package form: [skill structure](references/standards/skill-structure.md).

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。