claude-win11-speckit-update-skill
claude-win11-speckit-update-skill,来自 Microck/ordinary-claude-skills 的 agent 技能。
它会碰到什么
这个仓库里自带 24 个测试样本文件(有些技能仓会放故意的恶意样本做演示),它们不计入上面的能力与命中。
逐条看命中(30 条严重或高危)
- 严重
.claude/commands/speckit.implement.md:66cred-paths- Check if .npmrc or package.json exists → create/verify .npmignore (if publishing)
- 严重
.claude/commands/speckit.implement.md:74cred-paths- **Node.js/JavaScript**: `node_modules/`, `dist/`, `build/`, `*.log`, `.env*`
- 严重
.claude/commands/speckit.implement.md:81cred-paths- **Rust**: `target/`, `debug/`, `release/`, `*.rs.bk`, `*.rlib`, `*.prof*`, `.idea/`, `*.log`, `.env*`
- 严重
.claude/commands/speckit.implement.md:82cred-paths- **Kotlin**: `build/`, `out/`, `.gradle/`, `.idea/`, `*.class`, `*.jar`, `*.iml`, `*.log`, `.env*`
- 严重
.claude/commands/speckit.implement.md:83cred-paths- **C++**: `build/`, `bin/`, `obj/`, `out/`, `*.o`, `*.so`, `*.a`, `*.exe`, `*.dll`, `.idea/`, `*.log`, `.env*`
- 严重
.claude/commands/speckit.implement.md:84cred-paths- **C**: `build/`, `bin/`, `obj/`, `out/`, `*.o`, `*.a`, `*.so`, `*.exe`, `Makefile`, `config.log`, `.idea/`, `*.log`, `.env*`
- 严重
.claude/commands/speckit.implement.md:88cred-paths- **Docker**: `node_modules/`, `.git/`, `Dockerfile*`, `.dockerignore`, `*.log*`, `.env*`, `coverage/`
- 严重
docs/PRDs/007-PR-Validation-Workflow-Enhancement.md:30cred-paths3. Accidentally commits `.env` file with test token
- 严重
skills/speckit-updater/specs/014-pr-validation-enhancement/data-model.md:309cred-paths"file": ".env.example",
- 高
.github/scripts/check-spec-compliance.ps1:208identity-writeremediation = "Remove Import-Module from module. Add to orchestrator instead. See CLAUDE.md Module Import Rules."
- 高
.github/workflows/claude.yml:37exec-shell-trueshell: bash
- 高
.github/workflows/pr-validation.yml:33exec-shell-trueshell: bash
- 高
.github/workflows/pr-validation.yml:258cred-envread$comment | Out-File -FilePath $env:GITHUB_STEP_SUMMARY
- 高
.github/workflows/pr-validation.yml:413identity-writeremediation = "Review test failures. See CLAUDE.md for known issues."
- 高
.github/workflows/pr-validation.yml:442cred-envread$comment | Out-File -FilePath $env:GITHUB_STEP_SUMMARY
- 高
.github/workflows/pr-validation.yml:685cred-envread$comment | Out-File -FilePath $env:GITHUB_STEP_SUMMARY
- 高
.github/workflows/pr-validation.yml:794cred-envread$comment | Out-File -FilePath $env:GITHUB_STEP_SUMMARY
- 高
.github/workflows/update-fingerprints.yml:54cred-envread'Authorization' = "Bearer $env:GITHUB_TOKEN"
- 高
.github/workflows/update-fingerprints.yml:73cred-envread"has_updates=true" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:74cred-envread"new_version=$latestVersion" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:78cred-envread"has_updates=true" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:79cred-envread"new_version=$latestVersion" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:83cred-envread"has_updates=false" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:114cred-envread"has_changes=true" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:118cred-envread"total_versions=$($db.total_versions)" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:119cred-envread"latest_version=$($db.latest_version)" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:120cred-envread"file_size=$([math]::Round((Get-Item skills/speckit-updater/data/speckit-fingerprints.json).Length / 1KB, 1))" >> $env:GITHUB_OUTPUT
- 高
.github/workflows/update-fingerprints.yml:124cred-envread"has_changes=false" >> $env:GITHUB_OUTPUT
- 高
.specify/scripts/powershell/common.ps1:20cred-envreadif ($env:SPECIFY_FEATURE) { - 高
.specify/scripts/powershell/common.ps1:21cred-envreadreturn $env:SPECIFY_FEATURE
这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。
技能内容
SpecKit Safe Update
This skill provides safe update capabilities for GitHub SpecKit installations, preserving customizations while applying template updates.
Installation: Available via plugin (/plugin marketplace add NotMyself/claude-plugins then /plugin install speckit-updater) or manual Git clone. See [README.md](../../README.md#installation) for details.
What to do when this skill is invoked
When the user invokes /speckit-updater, you should:
- Run the update orchestrator script without any flags (conversational mode):
pwsh -NoProfile -Command "& 'C:\Users\bobby\.claude\skills\speckit-updater\scripts\update-wrapper.ps1'"
- Parse the output for markers:
[PROMPT_FOR_APPROVAL]- Update scenario (existing SpecKit installation)[PROMPT_FOR_INSTALL]- Fresh installation scenario (no .specify/ directory)
- For Updates (
[PROMPT_FOR_APPROVAL]marker found):
- Present the Markdown summary showing:
- Current version vs. available version
- Files to update/add/remove
- Conflicts detected (if any)
- Files preserved (customized)
- Backup location
- Custom commands
- Ask the user for approval to proceed with the update
- If approved, re-run with
-Proceedflag - If declined, inform the user the update was cancelled
- For Fresh Installations (
[PROMPT_FOR_INSTALL]marker found):
- Present a natural installation offer to the user, such as:
- "SpecKit is not currently installed in this project. Would you like me to install it?"
- "I can install the latest SpecKit templates for you. This will create the .specify/ directory structure and download the templates from GitHub."
- Do NOT mention the
-Proceedflag to the user (this is an implementation detail) - If user approves (says "yes", "proceed", "install it", etc.), re-run with
-Proceedflag - If user declines, inform them the installation was cancelled
- Execute approved action by re-running with
-Proceedflag:
pwsh -NoProfile -Command "& 'C:\Users\bobby\.claude\skills\speckit-updater\scripts\update-wrapper.ps1' -Proceed"
Special cases:
- If user requests
-CheckOnly: run with that flag and show the report - If user requests
-Rollback: run with that flag and confirm restoration - If user requests specific
-Version: include that parameter
Commands
/speckit-updater
Updates SpecKit templates, commands, and scripts while preserving customizations.
Usage:
/speckit-updater- Interactive update/install with conversational approval workflow (recommended for Claude Code)/speckit-updater -Proceed- Proceed with update/install after approval (used by Claude after user confirms)/speckit-updater -CheckOnly- Check for updates without applying/speckit-updater -Version v0.0.72- Update to specific version/speckit-updater -Force- Force overwrite SpecKit files (preserves custom commands)/speckit-updater -Rollback- Restore from previous backup/speckit-updater -Auto- DEPRECATED: Use conversational workflow instead (shows warning, maps to -Proceed)
Fresh Installation (No .specify/ directory):
- First invocation shows installation offer with
[PROMPT_FOR_INSTALL]marker - Claude Code presents natural question to user (e.g., "Would you like me to install SpecKit?")
- User approves via conversational response (e.g., "yes", "proceed", "install it")
- Claude re-invokes with
-Proceedflag automatically (implementation detail hidden from user) - Script creates
.specify/structure, downloads templates, creates manifest - Exit code 0 throughout (awaiting approval is not an error)
- Consistent with update flow: both use conversational approval workflow
Process:
- Validates prerequisites (Git installed, clean Git state, write permissions)
- Loads or creates manifest (.specify/manifest.json)
- Fetches target version from GitHub Releases API
- Compares file hashes to identify customizations
- Creates timestamped backup
- Applies selective updates preserving customized files
- Opens VSCode merge editor for conflicts (Flow A: one at a time)
- Automatically invokes /speckit.constitution for constitution updates
- Updates manifest with new version
- Manages backup retention (keeps last 5)
When you invoke this command, I will:
- Execute the update-orchestrator.ps1 script
- Parse output for markers (
[PROMPT_FOR_APPROVAL]for updates,[PROMPT_FOR_INSTALL]for fresh installations) - For updates: Present Markdown summary of proposed changes
- For installations: Ask naturally if you want to install SpecKit (without mentioning
-Proceedflag) - Wait for your approval via chat conversation
- After approval: automatically re-invoke with
-Proceedflag to execute - Guide you through conflict resolution one file at a time (updates only)
- Open VSCode diff/merge tools as needed (updates only)
- Report results with detailed summary
Conversational Workflow: The skill uses a two-step approval process:
- Step 1: Outputs summary → script exits → waits for approval
- Step 2: After approval, Claude re-invokes with
-Proceed→ applies updates
Requirements:
- Git installed and in PATH
- Internet connection for fetching updates from GitHub
- Write permissions to .specify/ and .claude/ directories
- Clean or staged Git working directory
The script is located at: {skill_path}/scripts/update-wrapper.ps1 (entry point) and {skill_path}/scripts/update-orchestrator.ps1 (main logic)
Entry point command:
pwsh -NoProfile -Command "& '{skill_path}/scripts/update-wrapper.ps1' [parameters]"
Note: Both PowerShell-style (-CheckOnly) and Linux-style (--check-only) flags are supported via the wrapper script.
Features
- Customization Preservation: Automatically detects and preserves user customizations using normalized file hashing
- Intelligent Conflict Resolution: Guides through conflicts one-at-a-time with 4 options: merge editor, keep mine, use new, skip
- Version Tracking: Maintains
.specify/manifest.jsonwith file hashes, version info, and backup history - Automatic Backups: Creates timestamped backups in
.specify/backups/with automatic retention management - Fail-Fast with Rollback: Automatically rolls back on any error, restoring pre-update state
- Dry-Run Mode:
--check-onlyshows exactly what would change without applying updates - Constitution Integration: Notifies when constitution template has updates (run
/speckit.constitution) - Custom Command Safety: User-created commands never overwritten, even with
--force
Architecture
Modules
- HashUtils: Normalized hashing (handles line endings, trailing whitespace, BOM)
- VSCodeIntegration: Context detection, Quick Pick, diff/merge editor integration
- GitHubApiClient: GitHub Releases API interaction (unauthenticated, 60 req/hour)
- ManifestManager: Manifest CRUD operations with caching
- BackupManager: Backup creation, restoration, and retention management
- ConflictDetector: File state analysis and conflict detection
Workflow
- Prerequisites validation (critical checks must pass, warnings allow continuation)
- Manifest loading/creation (safe default: assume all files customized if no manifest)
- GitHub API query for target version
- File state analysis (6 actions: add/remove/merge/preserve/update/skip)
- User confirmation with change preview
- Backup creation (timestamped, excludes backups directory)
- Selective file updates (fail-fast with automatic rollback)
- Conflict resolution (Flow A: one-at-a-time, VSCode merge editor)
- Manifest update (version, file hashes, customization flags)
- Backup cleanup (keep 5 most recent, requires confirmation)
- Detailed summary display
Exit Codes
| Code | Meaning |
|------|---------|
| 0 | Success |
| 1 | General error |
| 2 | Prerequisites not met |
| 3 | Network/API error |
| 4 | Git error |
| 5 | User cancelled |
| 6 | Rollback required (automatic) |
想直接用这个技能?
本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。
它属于哪个仓库
skills_all/claude-win11-speckit-update-skill/SKILL.md同一个仓库里的其他技能
同名技能的其他版本
有 2 个不同仓库或目录里都有叫 claude-win11-speckit-update-skill 的技能。它们内容并不相同,别混用: