make-skill
用于把当前会话沉淀为可复用的 workspace skill。当用户希望把当前对话、工作流或排错路径写成 SKILL.md 时触发。触发表达包括「把这个变成 skill」「记住我是怎么做 X 的」「保存这个工作流」「make a skill from this」以及任何 /make-skill <focus> 调用。
64
79%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Fix and improve this skill with Tessl
tessl review fix ./src/qwenpaw/agents/skills/make-skill-zh/SKILL.mdLow
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
本技能的运行流程会在“步骤2-由用户 approve 后撰写 SKILL.md 正文”阶段直接基于当前会话上下文生成文本（用户在会话中提供的自由文本会被读取/写入），但流程本身没有描述读取外部第三方任意自由文本源（如邮件/工单/社区内容）；因此主要风险来自用户对话内容被摄取而非强制的外部投递。
- Repository
- agentscope-ai/QwenPaw
- Commit
2094e07
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.