cloudcc-cli-dev

CloudCC CRM 二次开发 CLI 助手。用于需求拆解与方案选型，并通过 cloudcc-cli（cc 命令）创建/拉取/发布自定义对象、字段、菜单/应用、自定义类、定时器、触发器与 Vue 自定义组件等资产。用户提到 CloudCC、cloudcc-cli、cc 命令、对象/字段/触发器/定时器/自定义组...

Security Scan

The skill is an instruction-only CloudCC CLI helper and its files/instructions are consistent with that purpose, but metadata is slightly incomplete (it doesn't declare the expected cc/cloudcc-cli binary) and the skill asks the agent to create files and install a global npm package—so review install steps and any secrets before running.

Purpose & Capability

The skill's name/description match the included docs and runtime instructions: it directs use of the cloudcc-cli (cc command) to create/pull/publish CloudCC assets. However, the registry metadata declares no required binaries while the SKILL.md explicitly expects cloudcc-cli/cc to be installed; this mismatch is an inconsistency in the metadata (the skill should list cc/cloudcc-cli as a required binary).

Instruction Scope

All runtime instructions stay within the stated purpose: they tell the agent to read the provided markdown files for tasks, create a project in the agent workspace (code folder), and run cc create/pull/publish commands. The skill explicitly forbids embedding real keys in outputs and prescribes a fragment-sync boundary for publishable code. There are no instructions to read unrelated system files or phone-home endpoints.

Install Mechanism

This is an instruction-only skill with no install spec. The docs instruct installing cloudcc-cli via npm i -g (potentially requiring sudo). Because installation is left to runtime instructions rather than a declared install spec, users/agents will perform network installs with elevated privileges if they follow the docs—this is expected for a CLI helper but worth noticing.

Credentials

The skill does not declare or require environment variables/credentials in metadata. The docs describe the need for CloudCC developer keys (CloudCCDev, safetyMark) for real deployments and advise not to commit real keys to Git. That is proportionate to the tool's purpose. The skill does not instruct the agent to automatically fetch or exfiltrate secrets.

Persistence & Privilege

always is false and the skill has no install-time persistence. The agent will create project files in its workspace and may write local config files per the INSTALL_AND_BOOTSTRAP instructions; this is normal for a CLI development helper and is scoped to the workspace.

Assessment

This skill is an instruction-only helper for CloudCC CLI development and appears coherent with that purpose. Before installing/using it: (1) confirm you actually want the cloudcc-cli (cc) tool and inspect the npm package source before running npm i -g; (2) the skill's metadata does not list the cc binary—ensure your environment has cloudcc-cli available; (3) the docs instruct creating files in the agent workspace and writing a cloudcc-cli.config.js with developer keys—never paste real production keys into outputs or a public repo; use local/private storage for secrets and review any generated code before publishing to CloudCC; (4) installing the CLI globally may require elevated privileges (sudo) and downloads from npm, so run installs on a trusted machine or in an isolated environment. If you want higher assurance, ask the skill author to update metadata to declare the required binary and to provide an explicit install spec (trusted release URL or package name) and to document exactly when and where credentials will be used.

CloudCC CLI Development Skill

cloudcc-cli

• 需要检查全局是否安装了cloudcc-cli npm包，如果没有请先安装。

工作目录

• 在openclaw环境中，需要在agent的workspace中创建code文件夹，然后在code文件中使用cc create project xxx，创建一个模版项目。

使用方式（AI 必须遵循）

• 先阅读 REQUIREMENTS_BREAKDOWN.md，输出需求拆解与交付物清单，再进入落地步骤。
• 需要环境/密钥 配置时，阅读 INSTALL_AND_BOOTSTRAP.md。
• 需要建模时（对象/字段/菜单/应用），阅读 OBJECTS_AND_FIELDS.md。
• 需要后端逻辑时（类/定时器/触发器），阅读 BACKEND_CODE.md。
• 需要自定义组件时，阅读 VUE_CUSTOM_COMPONENT.md。
• 需要快速对照命令与参数时，阅读 CLI_CHEATSHEET.md。

强制安全边界

• 不要在输出/代码/提交中包含真实密钥（CloudCCDev、safetyMark、secretKey、openSecretKey、token 等）。
• 后端类/触发器/定时器遵守片段同步：仅在 @SOURCE_CONTENT_START~@SOURCE_CONTENT_END 内编写可发布逻辑。
• 客户端脚本遵守片段同步：仅在 function main($CCDK, obj) { ... } 的函数体内编写可发布逻辑。

快速入口

• 安装与初始化：INSTALL_AND_BOOTSTRAP.md
• 需求拆解与方案选择：REQUIREMENTS_BREAKDOWN.md
• 自定义对象与字段：OBJECTS_AND_FIELDS.md
• 自定义类/定时器/触发器：BACKEND_CODE.md
• Vue 自定义组件：VUE_CUSTOM_COMPONENT.md
• CLI 速查：CLI_CHEATSHEET.md