Communitygithub.com

trailofbits/设计工作流技能

指导设计和构建基于工作流的 Claude Code 技能,包含多步骤阶段、决策树、子代理委派和渐进式披露。适用于创建涉及顺序管道、路由模式、安全门、任务跟踪、分阶段执行或任何多步骤工作流的技能,也适用于审查或重构现有的工作流技能以提高质量。

设计工作流技能 是什么?

该技能旨在为开发者和 AI 代理用户提供一套系统的方法,用于设计、构建和优化基于工作流的 Claude Code 技能。它强调了在技能中实现多步骤阶段、决策树、子代理委派和渐进式披露等高级模式的重要性,以应对复杂的多步任务。此技能特别适用于需要顺序管道、路由逻辑、安全验证、任务状态跟踪以及分阶段执行的场景。通过遵循该技能的指导原则,用户可以创建出结构清晰、可维护性强且执行效率高的工作流技能,同时也能帮助审查和重构现有技能,提升它们的整体质量和可靠性。它支持 Claude Code 平台,其核心思想基于清晰的阶段划分、逻辑分支和子代理的灵活调用。

兼容平台✓Claude Code~Codex CLI~Cursor
npx skills add https://github.com/trailofbits/skills/tree/main/skills/designing-workflow-skills

在你喜欢的 AI 中提问

打开一个已预加载此 Agent Skill 的新对话。

文档

设计工作流技能 是做什么的?

指导设计和构建基于工作流的 Claude Code 技能,包含多步骤阶段、决策树、子代理委派和渐进式披露。适用于创建涉及顺序管道、路由模式、安全门、任务跟踪、分阶段执行或任何多步骤工作流的技能,也适用于审查或重构现有的工作流技能以提高质量。

概述

本技能提供了一套最佳实践和模式,用于在 Claude Code 中设计和实现复杂的工作流技能。工作流技能允许你将多步骤过程分解为可管理的阶段,在决策点路由逻辑,委派子代理处理子任务,并逐步向用户披露信息。

为什么使用工作流技能?

  • 模块化:将复杂的任务拆分为单独的、可测试的阶段。
  • 可维护性:清晰的阶段划分和路由逻辑使技能更容易更新和调试。
  • 鲁棒性:通过安全门和任务跟踪确保工作流按预期执行。
  • 用户体验:渐进式披露防止信息过载,并根据上下文提供相关信息。

关键概念

  • 阶段(Phase):工作流中的一个离散步骤,例如“收集输入”、“处理数据”、“生成输出”。每个阶段应明确输入、输出和预期行为。
  • 决策树(Decision Tree):在多个可能路径之间进行路由的机制。基于条件(如用户输入、先前结果)选择路径。
  • 子代理委派(Subagent Delegation):将子任务委派给专门的子代理,这些子代理拥有独立的功能。
  • 渐进式披露(Progressive Disclosure):按需显示信息,从高层次细节开始,允许用户深入挖掘。
  • 安全门(Safety Gate):在进入下一个阶段之前检查必要的前提条件或验证状态。
  • 任务跟踪(Task Tracking):采用一致的方法监控整个工作流的进度和状态。

设计模式

顺序管道

一系列按顺序执行的阶段,每个阶段依赖于前一个阶段的输出。

phases:
  - name: "收集要求"
    input: 用户需求
    output: 要求文档
  - name: "设计架构"
    input: 要求文档
    output: 架构图
  - name: "实现"
    input: 架构图
    output: 代码

路由模式

根据条件分支到不同的阶段。

输入 -> 决策: 是简单任务吗? -> 是: 直接处理
                                   -> 否: 进入多步工作流

带委派的子代理

主工作流将特定任务委派给专门的子代理,然后等待结果。

主代理 -> 委派: 数据分析 -> 子代理: 运行报告
        -> 委派: 代码审查 -> 子代理: 审查更改

安全门模式

在继续下一步之前验证前提条件。

阶段1 -> 安全检查: 是否已完成要求? -> 是: 继续阶段2
                                    -> 否: 提示用户提供缺失信息

在 SKILL.md 中实施

为你的工作流技能定义一个清晰的 SKILL.md 结构:

  1. 标题和描述:简要解释该技能的用途。
  2. 阶段定义:在 YAML 或列表中列出所有阶段及其依赖关系。
  3. 路由逻辑:描述如何以及何时做出决策。
  4. 子代理规范:界定子代理的范围和能力。
  5. 错误处理:定义当阶段失败时的后备策略。
  6. 示例:提供一个典型使用示例。

审查和重构

在审查现有工作流技能时,请注意以下问题:

  • 阶段之间是否存在清晰的界限?
  • 路由条件是否正确处理了所有情况?
  • 子代理是否得到了正确的委派,并且不会相互干扰?
  • 是否包含安全门来防止不完整的状态?
  • 整个工作流是否容易理解?(可读性评分为“是”)

资源

  • Claude Code 文档(链接)
  • 关于工作流设计的优秀实践(链接)

许可

此技能根据 MIT 许可提供。

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

trailofbits/address-sanitizer

AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C/C++ code to find buffer overflows and use-after-free bugs.

trailofbits/aflpp

AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C/C++ projects.

trailofbits/agentic-actions-auditor

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.

trailofbits/algorand-vulnerability-scanner

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal).

trailofbits/ask-questions-if-underspecified

Clarify requirements before implementing. Use when serious doubts arise.

trailofbits/atheris

Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.

trailofbits/audit-augmentation

Augments Trailmark code graphs with external audit findings from SARIF static analysis results and weAudit annotation files. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, cross-referencing Semgrep or CodeQL findings with call graph data, or visualizing audit findings in the context of code structure.

trailofbits/audit-context-building

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

trailofbits/audit-prep-assistant

Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).

trailofbits/burpsuite-project-parser

Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.

trailofbits/cairo-vulnerability-scanner

Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.

trailofbits/cargo-fuzz

cargo-fuzz is the de facto fuzzing tool for Rust projects using Cargo. Use for fuzzing Rust code with libFuzzer backend.

trailofbits/chrome-mcp-troubleshooting

Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.

trailofbits/claude-in-chrome-troubleshooting

Diagnose and fix Claude in Chrome MCP extension connectivity issues. Use when mcp__claude-in-chrome__* tools fail, return "Browser extension is not connected", or behave erratically.

trailofbits/code-improver

Runs an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and guards scope mechanically. Use when asked to 'improve this code until review passes', 'run an improvement loop with <reviewer>', or to iterate review-and-fix with a specific reviewer. For skills prefer the skill-improver entry; for a branch prefer pr-improver.

trailofbits/code-maturity-assessor

Systematic code maturity assessment using Trail of Bits' 9-category framework. Analyzes codebase for arithmetic safety, auditing practices, access controls, complexity, decentralization, documentation, MEV risks, low-level code, and testing. Produces professional scorecard with evidence-based ratings and actionable recommendations.

trailofbits/codeql

Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.

trailofbits/constant-time-analysis

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

trailofbits/constant-time-testing

Constant-time testing detects timing side channels in cryptographic code. Use when auditing crypto implementations for timing vulnerabilities.

trailofbits/cosmos-vulnerability-scanner

Scans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.

相关技能