360 Secure SkillHub
360 安全技能中心

Release Preflight

核心功能:针对技能、代码仓库或导出包,依次检查导出安全风险(私有目录、本地 artifacts、冗余发布范围)、类型就绪基础,扫描文本文件的本地身份泄露,最终输出「ready/需修复后就绪/未就绪」的决策。典型使用场景为技能、仓库或导出包发布/分享前的合规检查,通过指定目标路径和类型运行脚本,输出文本报告,遵循保守隐私判断、不自动修复等规则,聚焦关键风险检查。

lethehades
lethehades
热度 51.85
最近更新 2026-05-11 17:30:11
分类:安全依赖:代码执行 / 读写文件应用场景:DevOps / 报告撰写

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add release-preflight
Metadata
name
release-preflight
description
Pre-release safety and scope checker for skills, repos, and export bundles. Use before publishing or sharing a skill folder, repository, or release bundle when you need to detect private artifacts, overscoped publish surfaces, local identity leakage, missing release basics, and export-safety risks before something becomes public.

Release Preflight

Check whether a skill, repo, or export bundle is clean enough to publish.

Core workflow

  1. Identify the target path and target type (skill, repo, or bundle).
  2. Check export-safety risks first: private directories, local-only artifacts, and unnecessary publish surface.
  3. Check readiness basics for the chosen target type.
  4. Scan text files for obvious local identity leakage.
  5. Produce a decision: ready, ready_after_fixes, or not_ready.

Read references as needed

  • Read references/rules.md for the rule set and severity model.
  • Read references/report-format.md for the report structure and decision meanings.
  • Read references/target-types.md for type-specific expectations and minimal publish surfaces.
  • Read references/export-safety.md for the default private-path and local-artifact patterns.
  • Read references/release-minimal.md before packaging or publishing so the first public surface stays minimal.

Use scripts as needed

  • Use scripts/release_preflight.py <target-path> [--type ...] [--publish-target ...] to run the preflight check.

Operating rules

  • Prefer blocking obvious private artifacts over guessing intent.
  • Prefer suggesting a smaller public surface instead of trying to auto-fix files.
  • Treat identity leakage conservatively when absolute local paths or local usernames appear in public-facing text files.
  • Keep the first version focused on text reports and P0 checks; do not expand into full secret scanning or automated publishing.