Everything Claude Code

Provides performance optimization guides and best practices for Claude AI agents, including CLI tools and Anthropic API integration details.

Security Scan

The skill appears to be a large, feature-rich Claude Code knowledgebase rather than a lightweight performance guide — it contains many executable scripts, hooks that reference email/calendar/credentials, and instructions that read/write user files but does not declare the credentials or install steps those behaviors require.

Purpose & Capability

The name/description claim a performance/optimization guide for Claude agents, but the bundle contains a broad production-ready plugin: 500+ files, agents (e.g., chief-of-staff), hooks, install.sh and CLI scripts. That scope is wider than the short description implies (personal assistant functionality, Git/Gmail/Playwright interactions, rule installers). This may be legitimate (the repo really is comprehensive) but is inconsistent with the minimal summary.

Instruction Scope

The SKILL.md and many agent files instruct actions that go beyond a read-only knowledgebase: examples include calling Gmail CLI, reading private relationship files, invoking calendar scripts, copying rules into ~/.claude, running install.sh, and performing git commit & push. These instructions access and modify local state and external services but the skill does not declare or constrain those behaviors.

Install Mechanism

There is no declared install spec in the registry metadata (instruction-only), yet the repository includes an install.sh and many scripts that appear intended to be executed. The absence of a formal install mechanism in the package metadata but presence of an installer script increases the chance a user or agent will run arbitrary code without explicit platform-managed installation safeguards.

Credentials

requires.env lists none, but README and agents reference environment variables and credentials (CLAUDE_PACKAGE_MANAGER, placeholders for YOUR_*_HERE, and service CLIs for Gmail/Slack/Playwright). Tools and access (email/calendar/GitHub apps, MCP servers, mailbox and calendar access) would require secrets or tokens which are not declared. That mismatch suggests the skill expects access to sensitive credentials without declaring or justifying them in the metadata.

Persistence & Privilege

The content recommends copying rules into ~/.claude, running install scripts, and agents/hook configurations that persist knowledge files and perform git commit & push. While the skill is not marked always:true, it explicitly describes behaviors that modify user configuration and repository state and could be used autonomously by an agent — raising risk if run without review.

Scan Findings in Context

[prompt_injection:ignore-previous-instructions] unexpected: SKILL.md contained 'ignore-previous-instructions' pattern—this is not expected for a documentation/guide repository and could be an attempt to manipulate agent instruction handling; review for hidden prompt control sequences.

[prompt_injection:unicode-control-chars] unexpected: Unicode control characters were detected in SKILL.md content. These are not expected in normal docs and can be used to obfuscate or manipulate rendered prompt content; inspect files for invisible characters.

What to consider before installing

This package is a large, full-featured Claude Code plugin rather than a short guide — it includes installers, hooks, and agents that expect to access email, calendars, Git, and copy files into ~/.claude. Before installing or running anything: 1) Do NOT run install.sh or any scripts until you inspect them line-by-line; run them in a disposable container/VM if you must test. 2) Search the repo for calls to network endpoints, git push, and CLI commands that require credentials (gmail, slack, calendar, play/playwright) and confirm what secrets would be needed. 3) Verify the source/maintainer (GitHub repo, signed releases, checksums) — the registry metadata here lists an unknown owner and no homepage. 4) If you intend to use features that access email/calendar/GitHub, create dedicated service accounts with minimal privileges rather than supplying personal credentials. 5) Consider copying only specific docs (README, AGENTS.md, performance guidance) rather than installing hooks or running installers. If you want, I can: (A) list all files that invoke network/CLI/git operations, (B) extract and summarize install.sh and any scripts that modify user files, or (C) suggest a safe step-by-step sandboxed validation plan.

SKILL.md - everything-claude-code

Description

Claude Code 性能优化系统，来自 Anthropic Hackathon 获奖者。50K+ stars 的开源项目，提供 AI agent 性能优化指南和最佳实践。

When to Use

• 用户需要 Claude Code 使用指南
• 用户询问如何优化 AI agent 性能
• 用户需要 CLI 工具使用技巧
• 用户询问 Anthropic API 集成

Skills/Commands

• agents/ - Agent 配置和示例
• commands/ - 命令行工具集合
• docs/ - 多语言文档
• skills/ - 各种技能配置

Notes

• 这是一个知识库/指南集合
• 包含 6 种语言支持
• 有 CLAUDE.md 和 AGENTS.md 可供参考