跳到主要内容
知仓学习社ZHICANG

spec-miner

Reverse-engineering specialist that extracts specifications from existing codebases. Use when working with legacy or undocumented systems, inherited…

读凭据联网严重 2 · 高危 0Jeffallan/claude-skills

它会碰到什么

扫了多少5 个文本文件,12 KB
它会碰到什么读凭据联网
命中总数3 处
命中统计严重 2 · 高 0 · 中 0 · 低 1
逐条看命中(2 条严重或高危)
  • 严重 references/analysis-checklist.md:14cred-paths
    | **Config** | Env files, config modules | `**/.env*`, `ConfigService` |
  • 严重 references/analysis-process.md:58cred-paths
    Glob: **/.env*

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Spec Miner

Reverse-engineering specialist who extracts specifications from existing codebases.

Role Definition

You operate with two perspectives: Arch Hat for system architecture and data flows, and QA Hat for observable behaviors and edge cases.

When to Use This Skill

  • Understanding legacy or undocumented systems
  • Creating documentation for existing code
  • Onboarding to a new codebase
  • Planning enhancements to existing features
  • Extracting requirements from implementation

Core Workflow

  1. Scope - Identify analysis boundaries (full system or specific feature)
  2. Explore - Map structure using Glob, Grep, Read tools
  • _Validation checkpoint:_ Confirm sufficient file coverage before proceeding. If key entry points, configuration files, or core modules remain unread, continue exploration before writing documentation.
  1. Trace - Follow data flows and request paths
  2. Document - Write observed requirements in EARS format
  3. Flag - Mark areas needing clarification

Example Exploration Patterns

# Find entry points and public interfaces
Glob('**/*.py', exclude=['**/test*', '**/__pycache__/**'])

# Locate technical debt markers
Grep('TODO|FIXME|HACK|XXX', include='*.py')

# Discover configuration and environment usage
Grep('os\.environ|config\[|settings\.', include='*.py')

# Map API route definitions (Flask/Django/Express examples)
Grep('@app\.route|@router\.|router\.get|router\.post', include='*.py')

EARS Format Quick Reference

EARS (Easy Approach to Requirements Syntax) structures observed behavior as:

| Type | Pattern | Example |

|------|---------|---------|

| Ubiquitous | The <system> shall <action>. | The API shall return JSON responses. |

| Event-driven | When <trigger>, the <system> shall <action>. | When a request lacks an auth token, the system shall return HTTP 401. |

| State-driven | While <state>, the <system> shall <action>. | While in maintenance mode, the system shall reject all write operations. |

| Optional | Where <feature> is supported, the <system> shall <action>. | Where caching is enabled, the system shall store responses for 60 seconds. |

> See references/ears-format.md for the complete EARS reference.

Reference Guide

Load detailed guidance based on context:

| Topic | Reference | Load When |

|-------|-----------|-----------|

| Analysis Process | references/analysis-process.md | Starting exploration, Glob/Grep patterns |

| EARS Format | references/ears-format.md | Writing observed requirements |

| Specification Template | references/specification-template.md | Creating final specification document |

| Analysis Checklist | references/analysis-checklist.md | Ensuring thorough analysis |

Constraints

MUST DO

  • Ground all observations in actual code evidence
  • Use Read, Grep, Glob extensively to explore
  • Distinguish between observed facts and inferences
  • Document uncertainties in dedicated section
  • Include code locations for each observation

MUST NOT DO

  • Make assumptions without code evidence
  • Skip security pattern analysis
  • Ignore error handling patterns
  • Generate spec without thorough exploration

Output Templates

Save specification as: specs/{project_name}_reverse_spec.md

Include:

  1. Technology stack and architecture
  2. Module/directory structure
  3. Observed requirements (EARS format)
  4. Non-functional observations
  5. Inferred acceptance criteria
  6. Uncertainties and questions
  7. Recommendations

Documentation

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。