mirror of https://github.com/catlog22/Claude-Code-Workflow.git synced 2026-02-05 01:50:27 +08:00

Files

catlog22 502c8a09a1 fix(security): Apply 3 critical security fixes

- sec-001: Add validateAllowedPath to /api/file endpoint (path traversal)
- sec-002: Enable CSRF by default with CCW_DISABLE_CSRF opt-out
- sec-003: Add validateAllowedPath to /api/dialog/browse and /api/dialog/open-file (path traversal)

Ref: fix-1738072800000

2026-01-28 22:04:18 +08:00

1.4 KiB

Raw Blame History

name, description, allowed-tools

name

description

allowed-tools

SKILL_NAME

SKILL_DESCRIPTION

ALLOWED_TOOLS

Architecture

┌─────────────────────────────────────────────────┐
│               {{SKILL_TITLE}}                    │
│                                                 │
│  Input → {{PHASE_1}} → {{PHASE_2}} → Output    │
└─────────────────────────────────────────────────┘

Execution Flow

async function {{SKILL_FUNCTION}}(input) {
  // Phase 1: {{PHASE_1}}
  const prepared = await phase1(input);

  // Phase 2: {{PHASE_2}}
  const result = await phase2(prepared);

  return result;
}

Phase 1: {{PHASE_1}}

async function phase1(input) {
  // TODO: Implement {{PHASE_1_LOWER}} logic
  return output;
}

Phase 2: {{PHASE_2}}

async function phase2(input) {
  // TODO: Implement {{PHASE_2_LOWER}} logic
  return output;
}

Usage

/skill:{{SKILL_NAME}} "input description"

Examples

Basic Usage:

User: "{{EXAMPLE_INPUT}}"
{{SKILL_NAME}}:
  → Phase 1: {{PHASE_1_ACTION}}
  → Phase 2: {{PHASE_2_ACTION}}
  → Output: {{EXAMPLE_OUTPUT}}

1.4 KiB Raw Blame History

{{SKILL_TITLE}}