跳到主要内容
知仓学习社ZHICANG

vc-docs-seeker

Search library/framework documentation via llms.txt (context7.com). Use for API docs, GitHub repository analysis, technical documentation lookup, la…

读凭据执行命令读文件联网严重 18 · 高危 1withkynam/vibecode-pro-max-kit

它会碰到什么

扫了多少17 个文本文件,45 KB
它会碰到什么读凭据执行命令读文件联网
命中总数27 处
命中统计严重 18 · 高 1 · 中 3 · 低 5
逐条看命中(19 条严重或高危)
  • 严重 references/advanced.md:76cred-paths
    - Use CONTEXT7_API_KEY from .env
  • 严重 scripts/utils/env-loader.js:5cred-paths
    * Respects order: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/utils/env-loader.js:5cred-paths
    * Respects order: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/utils/env-loader.js:5cred-paths
    * Respects order: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/utils/env-loader.js:12cred-paths
    * Parse .env file content into key-value pairs
  • 严重 scripts/utils/env-loader.js:13cred-paths
    * @param {string} content - .env file content
  • 严重 scripts/utils/env-loader.js:43cred-paths
    * Load environment variables from .env files in priority order
  • 严重 scripts/utils/env-loader.js:44cred-paths
    * Priority: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/utils/env-loader.js:44cred-paths
    * Priority: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/utils/env-loader.js:44cred-paths
    * Priority: process.env > skill/.env > skills/.env > .claude/.env
  • 严重 scripts/utils/env-loader.js:53cred-paths
    path.join(claudeDir, '.env'),      // Lowest priority
  • 严重 scripts/utils/env-loader.js:54cred-paths
    path.join(skillsDir, '.env'),
  • 严重 scripts/utils/env-loader.js:55cred-paths
    path.join(skillDir, '.env'),       // Highest priority (file)
  • 严重 scripts/utils/env-loader.js:60cred-paths
    // Load .env files in order (lowest to highest priority)
  • 严重 SKILL.md:106cred-paths
    Scripts load `.env`: `process.env` > `.claude/skills/vc-docs-seeker/.env` > `.claude/skills/.env` > `.claude/.env`
  • 严重 SKILL.md:106cred-paths
    Scripts load `.env`: `process.env` > `.claude/skills/vc-docs-seeker/.env` > `.claude/skills/.env` > `.claude/.env`
  • 严重 SKILL.md:106cred-paths
    Scripts load `.env`: `process.env` > `.claude/skills/vc-docs-seeker/.env` > `.claude/skills/.env` > `.claude/.env`
  • 严重 SKILL.md:106cred-paths
    Scripts load `.env`: `process.env` > `.claude/skills/vc-docs-seeker/.env` > `.claude/skills/.env` > `.claude/.env`
  • scripts/tests/run-tests.js:7exec-spawn
    const { spawn } = require('child_process');

这一栏是扫描器报的事实,不是结论。命中多不等于有毒(安全工具、规则库、示例脚本本来就会包含危险写法),命中少也不等于干净。它和你手上的凭据、文件、网络有什么关系,需要你自己看。

技能内容

Documentation Discovery

> Output style: Follow process/development-protocols/communication-standards.md — answer-first, plain language, no unexplained jargon, TL;DR on long responses.

Overview

Use Context7 MCP as the default path for documentation lookup. The local scripts in this skill are fallback helpers for llms.txt-based discovery when Context7 does not cover the target cleanly.

Primary Workflow

Default workflow: Context7 first

  1. Resolve the library with Context7.
  2. Query the exact API/config/setup question with Context7.
  3. Only fall back to the scripts below when Context7 coverage is missing, incomplete, or the user explicitly wants llms.txt/repository-oriented discovery.

Fallback script workflow:

# 1. DETECT query type (topic-specific vs general)
node scripts/detect-topic.js "<user query>"

# 2. FETCH documentation using script output
node scripts/fetch-docs.js "<user query>"

# 3. ANALYZE results (if multiple URLs returned)
cat llms.txt | node scripts/analyze-llms-txt.js -

Scripts handle URL construction, fallback chains, and error handling automatically.

Scripts

detect-topic.js - Classify query type

  • Identifies topic-specific vs general queries
  • Extracts library name + topic keyword
  • Returns JSON: {topic, library, isTopicSpecific}
  • Zero-token execution

fetch-docs.js - Retrieve documentation

  • Constructs context7.com URLs automatically
  • Handles fallback: topic → general → error
  • Outputs llms.txt content or error message
  • Zero-token execution

analyze-llms-txt.js - Process llms.txt

  • Categorizes URLs (critical/important/supplementary)
  • Recommends agent distribution (1 agent, 3 agents, 7 agents, phased)
  • Returns JSON with strategy
  • Zero-token execution

Workflow References

[Topic-Specific Search](./workflows/topic-search.md) - Fastest path (10-15s)

[General Library Search](./workflows/library-search.md) - Comprehensive coverage (30-60s)

[Repository Analysis](./workflows/repo-analysis.md) - Fallback strategy

References

[context7-patterns.md](./references/context7-patterns.md) - URL patterns, known repositories

[errors.md](./references/errors.md) - Error handling, fallback strategies

[advanced.md](./references/advanced.md) - Edge cases, versioning, multi-language

Execution Principles

  1. Context7 first - Use Context7 MCP before any local script fallback
  2. Zero-token overhead - Scripts run without context loading
  3. Automatic fallback - Scripts handle topic → general → error chains
  4. Progressive disclosure - Load workflows/references only when needed
  5. Scripts are fallback helpers - Use them only when Context7 coverage is missing or the user wants llms.txt-style discovery

Quick Start

Topic query: "How do I use date picker in shadcn?"

node scripts/detect-topic.js "<query>"  # → {topic, library, isTopicSpecific}
node scripts/fetch-docs.js "<query>"    # → 2-3 URLs
# Use Context7 results first; only use script-discovered URLs when you intentionally fall back

General query: "Documentation for Next.js"

node scripts/detect-topic.js "<query>"         # → {isTopicSpecific: false}
node scripts/fetch-docs.js "<query>"           # → 8+ URLs
cat llms.txt | node scripts/analyze-llms-txt.js -  # → {totalUrls, distribution}
# Use Context7 results first; only use script-discovered URLs when fallback discovery is required

Environment

Scripts load .env: process.env > .claude/skills/vc-docs-seeker/.env > .claude/skills/.env > .claude/.env

Optional env vars: CONTEXT7_API_KEY (Bearer token for Context7 API), DEBUG=true (verbose logging).

想直接用这个技能?

本站把开放许可(MIT / Apache 等)的技能按仓库打包整理到网盘,点一下转存到你自己的网盘,不用一个个从 GitHub 拉。许可未声明的技能只给原始仓库链接,不打包。