跳到主要内容
知仓学习社ZHICANG

pr-workflow

|

读凭据写文件执行命令改身份文件读文件严重 27 · 高危 24notque/vexjoy-agent

它会碰到什么

扫了多少37 个文本文件,283 KB
它会碰到什么读凭据写文件执行命令改身份文件读文件
命中总数68 处
命中统计严重 27 · 高 24 · 中 9 · 低 0
逐条看命中(30 条严重或高危)
  • 严重 references/commit-conventional.md:80cred-paths
    - `chore: add .env to .gitignore`
  • 严重 references/commit-examples.md:22cred-paths
    block `.env`, `*credentials*`, `*secret*`, `*.pem`, `*.key`, `.npmrc`, or `.pypirc` into a commit because credentials in git history are permanent -- removing t
  • 严重 references/commit-examples.md:22cred-paths
    block `.env`, `*credentials*`, `*secret*`, `*.pem`, `*.key`, `.npmrc`, or `.pypirc` into a commit because credentials in git history are permanent -- removing t
  • 严重 references/commit-examples.md:22cred-paths
    block `.env`, `*credentials*`, `*secret*`, `*.pem`, `*.key`, `.npmrc`, or `.pypirc` into a commit because credentials in git history are permanent -- removing t
  • 严重 references/commit-examples.md:27cred-paths
    git diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'
  • 严重 references/commit-examples.md:27cred-paths
    git diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'
  • 严重 references/commit-examples.md:35cred-paths
    This scan applies to every commit, including documentation-only changes, because doc commits can accidentally include `.env` files staged alongside them.
  • 严重 references/commit-examples.md:172cred-paths
    **Cause**: Files matching sensitive patterns (`.env`, `*credentials*`, `*.key`) found in changes.
  • 严重 references/commit-examples.md:174cred-paths
    1. Add to `.gitignore`: `echo ".env" >> .gitignore`
  • 严重 references/commit-examples.md:175cred-paths
    2. Unstage if already staged: `git reset HEAD .env`
  • 严重 references/commit-examples.md:176cred-paths
    3. If already tracked: `git rm --cached .env`
  • 严重 references/commit-workflow-examples.md:77cred-paths
    if git diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'; then
  • 严重 references/commit-workflow-examples.md:77cred-paths
    if git diff --cached --name-only | grep -iE '\.(env|pem|key)$|credentials|secret|\.npmrc|\.pypirc'; then
  • 严重 references/pipeline.md:63cred-paths
    - `.env`, `.env.*`
  • 严重 references/pipeline.md:63cred-paths
    - `.env`, `.env.*`
  • 严重 references/pipeline.md:64cred-paths
    - `credentials.json`, `secrets.*`
  • 严重 references/pipeline.md:321cred-paths
    Cause: User's changes include .env, credentials, keys, or other secrets
  • 严重 references/sync.md:79cred-paths
    Stage files selectively by name rather than using `git add -A`, because blind staging catches unintended files -- build artifacts, `.env` files, editor configs,
  • 严重 scripts/validate_state.py:23cred-paths
    (r"\.env$", "Environment file", "critical"),
  • 严重 scripts/validate_state.py:24cred-paths
    (r"\.env\..*", "Environment file pattern (.env.*)", "critical"),
  • 严重 scripts/validate_state.py:24cred-paths
    (r"\.env\..*", "Environment file pattern (.env.*)", "critical"),
  • 严重 scripts/validate_state.py:25cred-paths
    (r".*\.env$", "Environment file pattern (*.env)", "critical"),
  • 严重 scripts/validate_state.py:38cred-paths
    (r"\.npmrc$", "NPM authentication config", "critical"),
  • 严重 scripts/validate_state.py:39cred-paths
    (r"\.pypirc$", "PyPI authentication config", "critical"),
  • 严重 scripts/validate_state.py:40cred-paths
    (r"\.netrc$", "Network authentication config", "critical"),
  • 严重 scripts/validate_state.py:46cred-paths
    (r"id_rsa$", "SSH private key", "critical"),
  • 严重 scripts/validate_state.py:48cred-paths
    (r"id_ed25519$", "SSH private key", "critical"),
  • references/pr-risk-policy.md:18identity-config-write
    | `.claude/settings.local.json` | Local permission overrides |
  • scripts/coordinator-validate.py:132exec-spawn
    result = subprocess.run(
  • scripts/miner.py:286cred-envread
    token = os.environ.get("GITHUB_TOKEN")

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

PR Workflow Skill

Umbrella skill for the entire pull request lifecycle. Routes to the correct reference based on the PR task requested.

Reference Loading Table

Detect the user's intent and load the appropriate reference file:

| Intent | Trigger phrases | Reference |

|--------|----------------|-----------|

| Sync (default) | "push", "create PR", "sync", "ship this" | ${CLAUDE_SKILL_DIR}/references/sync.md |

| Pipeline | "submit PR", "full PR", "end-to-end PR", "open PR" | ${CLAUDE_SKILL_DIR}/references/pipeline.md |

| Fix | "fix PR comments", "address review", "pr-fix", "resolve feedback" | ${CLAUDE_SKILL_DIR}/references/fix.md |

| Status | "pr status", "branch status", "is my PR ready", "check CI" | ${CLAUDE_SKILL_DIR}/references/status.md |

| Cleanup | "clean up branches", "delete merged branch", "prune" | ${CLAUDE_SKILL_DIR}/references/cleanup.md |

| Feedback | "process PR feedback", "address reviews", "what did reviewers say" | ${CLAUDE_SKILL_DIR}/references/feedback.md |

| Miner | "mine PRs", "extract review comments", "tribal knowledge", "reviewer patterns" | ${CLAUDE_SKILL_DIR}/references/miner.md |

| Branch name | "generate branch name", "validate branch name", "name branch", "branch convention", "git branch name" | ${CLAUDE_SKILL_DIR}/references/branch-name.md |

| CI check | "check CI", "CI status", "actions status", "did CI pass", "build status", "CI passed" | ${CLAUDE_SKILL_DIR}/references/ci-check.md |

| Commit | "commit changes", "stage and commit", "commit my changes", "commit my files", "commit these" | ${CLAUDE_SKILL_DIR}/references/commit.md |

| Codex review | "codex review", "second opinion", "code review codex", "gpt review", "cross-model review" | ${CLAUDE_SKILL_DIR}/references/codex-review.md |

| Land | "land PR", "land the PR", "merge contributor PR", "rebase and merge PR" | ${CLAUDE_SKILL_DIR}/references/land-pr.md |

| Body safety | any gh call writing or reading a PR/issue body | ${CLAUDE_SKILL_DIR}/references/gh-body-safety.md |

| Changelog | "update changelog", "release notes", "curate changelog" | ${CLAUDE_SKILL_DIR}/references/changelog-curation.md |

| Decision brief | "decision brief", "authorization tier", "ask the owner", "is it decision-ready" | ${CLAUDE_SKILL_DIR}/references/owner-decision-briefs.md |

| Risk classify | automatic pre-review step; also "classify PR risk", "pr risk", "risk check" | ${CLAUDE_SKILL_DIR}/references/pr-risk-policy.md |

| INDEX conflict | "INDEX.json conflict", "INDEX conflict on rebase", "two PRs regenerated INDEX", "regenerate INDEX after rebase" | ${CLAUDE_SKILL_DIR}/references/index-conflict-resolution.md |

Default action: When invoked with no arguments or ambiguous intent, load sync.md (the most common PR use case).

Review scope

Before dispatching reviewers, load references/pr-risk-policy.md. It owns risk classification, roster selection, and review reuse. Preserve explicit user and /do rosters and repository requirements; do not start a second review at each PR phase.

PR body

Use Summary → Changes → Notes, following .github/pull_request_template.md. Passing --body or --body-file supplies the body instead of loading that template.

  • Summary: State what changes and why in 1–3 plain sentences; name the relevant issue or ADR.
  • Changes: One fact per line: what changed and where. Summarize large lists by shape and count; let the diff enumerate them.
  • Notes: Include non-obvious decisions, deliberate omissions, follow-ups, gotchas, superseded PRs, and material plan deviations. Also include manual verification, gaps in CI coverage, migration/rollout ordering, and security-sensitive changes. Omit the section only when none apply.

Keep command dumps out of the body; GitHub Checks records CI results. Retain verification facts that CI does not establish, such as “Apply the column migration before deploying” or “Not covered by CI — Terraform plan checked manually.”

Use existing planning artifacts for intent and completed work; otherwise use the diff and commits. Describe the final change, not the conversation or abandoned approaches unless they explain a tradeoff.

Write the body to a temporary file with a quoted heredoc, then pass --body-file, following ${CLAUDE_SKILL_DIR}/references/gh-body-safety.md. Read the body back before submitting it.

Execution

Load the matching reference and execute within the user's existing authorization. Ask only for an uncovered action or an explicit applicable repository requirement; do not ask again for actions already authorized. Preserve repository branch protection and review requirements.

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。

它属于哪个仓库

星标★ 419
本站分层T2
该仓技能数122
原文件路径skills/process/pr-workflow/SKILL.md

同一个仓库里的其他技能

看这个仓库的全部 122 个技能