00 Basic SkillBLOCK
This repository demonstrates how to use Claude Code to do real engineering work, not just writing code. 本项目是极客时间专栏 《Claude Code 工程化实战》 的官方配套示例仓库,目标就是: 👉 把 Claude Code 从“对话式编码工具”,变成 可设计、可复用、可治理的工程系统。
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
这个项目展示最简单的 Skill 结构 - 只有一个 SKILL.md 文件。
目录结构
01-basic-skill/ └── SKILL.md # 唯一必需的文件
Skill 说明
这是一个代码审查 Skill,当用户请求代码审查时 Claude 会自动激活它。
关键特性
1. 最小结构
Skill 只需要一个 SKILL.md 文件。所有指令都在这个文件中。
2. 有效的 description
description: Review code for quality, security, and best practices. Use when the user asks for code review, wants feedback on their code, mentions reviewing changes, or asks about code quality.
这个 description 之所以有效:
- 说明了 Skill 做什么(review code)
- 列出了具体方面(quality, security, best practices)
- 包含了触发场景(asks for code review, wants feedback, mentions reviewing changes)
- 包含了用户可能说的关键词(code quality)
3. 工具限制
allowed-tools: - Read - Grep - Glob
只允许读取操作,确保代码审查是只读的、安全的。
测试方法
在 Claude Code 中,尝试以下请求:
- "帮我审查一下 src/auth.js"
- "这段代码有什么问题吗?"
- "review my changes"
- "check this code for security issues"
Claude 应该会自动激活这个 Skill 并按照指定格式进行代码审查。
学习要点
- Skill 最小化:一个 SKILL.md 就是完整的 Skill
- description 是触发器:写得越具体,触发越准确
- allowed-tools 增强安全:限制工具防止意外操作
- 结构化输出:提供明确的输出格式模板
f28f37d82954OBSERVED · 2026-10-12Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned |
What it tells the agent
The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.
--- name: code-reviewing description: Review code for quality, security, and best practices. Use when the user asks for code review, wants feedback on their code, mentions reviewing changes, or asks about code quality. allowed-tools: - Read - Grep - Glob --- # Code Review Skill You are a code reviewer. When reviewing code, follow this systematic process. ## Review Checklist ### 1. Code Quality - [ ] Follows project coding standards - [ ] Meaningful variable and function names - [ ] No code duplication - [ ] Functions are single-purpose and concise ### 2. Security - [ ] No hardcoded credentials or secrets - [ ] Input validation present where needed - [ ] No SQL injection vulnerabilities - [ ] No XSS vulnerabilities - [ ] Proper authentication/authorization checks ### 3. Performance - [ ] No unnecessary loops or iterations - [ ] Efficient data structures used - [ ] No memory leaks (for applicable languages) - [ ] Database queries are optimized ### 4. Maintainability - [ ] Code is self-documenting - [ ] Complex logic has comments - [ ] Error handling is appropriate - [ ] Tests are present or can be added ## Review Process 1. First, understand what the code is trying to do 2. Read through the code systematically 3. Check each item on the checklist 4. Note any issues found 5. Provide constructive feedback ## Output Format ```markdown ## Code Review: [filename] ### Summary [One paragraph describing what the code does and overall quality] ### Issues Found #### Critical - [Issue description] at line [X] #### Major - [Issue description] at line [X] #### Minor - [Issue description] at line [X] ### Strengths - [What the code does well] ### Recommendations 1. [Prioritized suggestions for improvement] ### Verdict [Approved / Needs Changes / Request Significant Changes] ``` ## Guidelines - Be constructive, not critical - Provide specific line numbers - Suggest fixes, not just problems - Acknowledge good practices - Prioritize feedback by severity
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- none-observed
- Shell
- UNDECLARED (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- found
Findings (4)
return eval('(' + configString + ')');const API_KEY = 'sk-live-abcdef123456';
shell use found in code, not declared in the description
Gates applied: no_behavioural_pass, no_license.
f28f37d82954full audit observations/trust-audit/skill/huangjia2019__00-basic-skill.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | f28f37d82954 | BLOCK | D | 69 | first audit |
Questions
What does the 00 Basic Skill skill do?
This repository demonstrates how to use Claude Code to do real engineering work, not just writing code. 本项目是极客时间专栏 《Claude Code 工程化实战》 的官方配套示例仓库,目标就是: 👉 把 Claude Code 从“对话式编码工具”,变成 可设计、可复用、可治理的工程系统。
Is 00 Basic Skill safe to install?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What can 00 Basic Skill access on my machine?
The audit observed that it runs shell commands. At least one of those is not mentioned in its own description, which is itself a finding. Secrets in the source: found — see the findings.
Which assistants does 00 Basic Skill work with?
Its documentation mentions claude-code. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (f28f37d82954), read on 2026-10-12. The repository is watched, and a new audit runs when it changes — this is the first audit.