Claude Code Sdk

强大的AI Coding Agent，可满足任何软件设计、开发、测试、优化、重构等任务。在处理任何代码编程相关问题时，都优先使用该技能。

Security Scan

The skill is coherent with its stated purpose (a CLI wrapper that invokes an Anthropic Claude agent SDK for coding tasks) but has a few noteworthy risks: it expects a globally installed npm SDK, exposes an option to inject system prompts, and will read/write/execute in whatever working directory you point it at.

Purpose & Capability

Name/description (AI coding agent) align with the instructions and the included script: it requires the @anthropic-ai/claude-agent-sdk and provides a CLI that drives that SDK. The allowed tools (Read, Edit, Bash, Write, Glob, Grep, Skill) are appropriate for an autonomous coding agent.

Instruction Scope

SKILL.md tells the agent/operator to call the provided Node script and to install a global npm package. The skill explicitly supports an --append-system-prompt option which will be passed into the SDK as a system prompt; that is useful for customization but is also a vector for prompt-injection if misused. The script will operate in any cwd you supply (and can read/write files and run bash via allowedTools), so its scope is wide by design and should be limited to safe/sandboxed projects.

Install Mechanism

No formal install spec in registry; SKILL.md instructs users to run npm install -g @anthropic-ai/claude-agent-sdk. Requiring a global npm install is reasonable for this CLI pattern but increases risk vs. a vetted package or local/sandboxed install — the global package is arbitrary code from npm and should be verified before installation.

Credentials

The skill requests no environment variables or credentials. The included script does execute a shell command ('npm root -g') and will read/write files in the provided cwd and optional log file, which is proportionate to a coding agent's needs but means you should not run it in directories containing secrets.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and has no install-time persistence specified. It does expect a globally installed npm package, but that is not a platform privilege escalation.

Scan Findings in Context

[system-prompt-override] expected: SKILL.md and the CLI expose an --append-system-prompt option that is passed to the SDK; this is a legitimate customization feature for an agent but is exactly the pattern flagged by the detector because it can be used to override model/system prompts and perform prompt injection if untrusted input is provided.

Assessment

This skill is internally consistent for an AI coding agent, but take these precautions before installing or running it: 1) Verify the npm package @anthropic-ai/claude-agent-sdk is the official library (check the publisher, package page, and source) before running npm install -g. 2) Prefer installing in a sandbox or non-privileged environment rather than globally, or inspect the package contents first. 3) Do not run the script in directories that contain secrets, credentials, or sensitive data because it can read/write files and run shell commands in the specified cwd. 4) Be cautious with the --append-system-prompt option: only pass trusted text to avoid letting untrusted inputs override system behavior. 5) If you need higher assurance, request the upstream package source (repository) and the SDK's sdk.mjs content to review, and confirm the npm package integrity (checksums/signing). Additional information that would raise confidence: a verified package publisher, a repository link, or a vetted install mechanism (no global install needed).

Claude Code

概述

Claude Code作为一款具备超强能力的Coding Agent，既可以完成小单元的代码编写，也可以进行大模块的整体开发、测试和验证。在有Coding Agents助力的情况下，你不必亲自完成代码的撰写、问题修复和测试验证，你只需将任务需求转换为明确、完整的指令，并交由Claude Code完全自主地完成代码的撰写、问题修复和测试验证。Claude Code不仅是执行者，你在遇到需求分解、设计相关的问题时，甚至可以向Claude Code需求建议或进行讨论，在它的帮助下完成整个开发工作。

本技能用于以node脚本的方式调用Claude Code。

快速开始

安装依赖

npm install -g @anthropic-ai/claude-agent-sdk

基本用法

调用位于本技能目录下的scripts/run_claude.mjs脚本来调用Claude Code。

node /path/to/skills/claude-code-sdk/scripts/run_claude.mjs --query "Find and fix the bug in auth.py"

命令行选项

node /path/to/skills/claude-code-sdk/scripts/run_claude.mjs --query QUERY [--append-system-prompt APPEND_SYSTEM_PROMPT] [--resume RESUME] [--log-file LOG_FILE]

选项	描述
--query	要发送给Claude Code的查询
--append-system-prompt	可选，要添加到系统提示的指令
--resume	可选，要继续的会话ID
--log-file	可选，要记录中间输出的文件

1. 自定义系统提示

使用 --append-system-prompt 添加指令，同时保留 Claude Code 默认行为：

node /path/to/skills/claude-code-sdk/scripts/run_claude.mjs --query "Find and fix the bug in auth.py" --append-system-prompt "You are a security engineer. Review for vulnerabilities."

2. 继续会话

在使用Claude Code完成连续任务时，需要使用 --resume 参数指定会话ID来继续会话，使得Claude Code能够保留之前的上下文信息。在run_claude.mjs脚本的输出中，会记录当前会话ID，并将其作为结果的一部分返回。当你需要继续会话时，只需将该会话ID作为--resume参数的值即可。

注意：除非你必须要开始一个全新的开发项目，否则都要使用--resume参数，让Claude Code在连续的上下文中进行工作，以更好地处理你的任务。

3. 记录中间输出

当使用Claude Code执行复杂任务时，run_claude.mjs脚本会运行较长时间，为了方便观察中间执行过程，可以使用--log-file参数来将记录中间输出结果写入到文件中，在等待脚本执行完成期间，你可以通过读取文件内容来实时查看中间输出结果。

注意事项

长时运行 由于Claude Code执行时间可能较长，当命令被转到后台运行时，你需要使用process工具的poll方法来轮询命令的执行结果，但是每次轮询不超过180s，并且在轮询间隙要向用户（__user__）发送消息，告知用户当前执行状态。

自主修复 在任何与软件开发相关的任务场景中，你都必须完全依赖Claude Code来完成任务，而不是直接进行代码编写。如果遇到Claude Code的命令执行存在问题（例如权限问题或安装问题），请优先尝试修复问题而不是直接进行代码编写。