Claude Code 精通指南 第5篇：Skills 技能模块

.claude/skills/
└── code-review/
    ├── SKILL.md           # 必需 - 指令和 frontmatter
    ├── examples/          # 可选 - 输出示例
    │   ├── good-review.md
    │   └── bad-review.md
    ├── templates/         # 可选 - 输出模板
    │   └── review-template.md
    └── scripts/           # 可选 - 可执行辅助脚本
        └── lint-check.sh

---
name: code-review
description: "Review pull requests using OWASP security guidelines, performance best practices, and team formatting standards"
allowed-tools: Read, Grep, Glob
model: claude-sonnet-4-5-20250929
---
# Code Review Standards

## Purpose
Apply consistent code review standards across all PRs.

## When to Use
- Reviewing pull requests
- Checking code for security issues
- Validating against team conventions

## Instructions

### Security Checks
1. SQL injection vulnerabilities
2. XSS attack vectors
3. Authentication bypasses
4. Sensitive data exposure

### Performance Checks
1. N+1 query patterns
2. Unnecessary re-renders
3. Memory leaks
4. Blocking operations

### Style Checks
1. Naming conventions per team standards
2. Function length (max 50 lines)
3. Cyclomatic complexity

## Output Format
Organize findings by severity:
- 🚨 Critical (blocks merge)
- ⚠️ Warnings (should fix)
- 💡 Suggestions (nice to have)

## Examples
See ./examples/good-review.md for proper format.

mkdir -p .claude/skills/tdd

cat > .claude/skills/tdd/SKILL.md << 'EOF'
---
name: tdd
description: "Apply test-driven development workflow when writing tests, implementing features with tests, or following red-green-refactor cycle"
allowed-tools: Read, Write, Edit, Bash(npm test:*), Bash(bun test:*)
---
# Test-Driven Development

## Purpose
Guide development through proper TDD: Red → Green → Refactor.

## When to Use
- When user asks to "add a feature with tests"
- When user mentions "TDD" or "test-driven"
- When creating new functionality that requires tests
- When user asks to implement something "the right way"

## The TDD Cycle

### Phase 1: Red (Write Failing Test)
1. Understand the requirement fully
2. Write the simplest test that fails
3. Verify the test fails for the RIGHT reason
4. DO NOT write implementation yet

### Phase 2: Green (Make It Pass)
1. Write minimal code to pass the test
2. No extra features, no edge cases yet
3. Ugly code is acceptable—just make it green

### Phase 3: Refactor (Clean Up)
1. Improve code quality
2. Remove duplication
3. Better naming
4. Tests MUST stay green

### Repeat
For each new behavior, start the cycle again.

## Anti-Patterns to Avoid
- Writing implementation before tests
- Writing multiple tests at once
- Refactoring while tests are red
- Skipping the refactor phase

## Example Session
See ./examples/tdd-session.md for a complete walkthrough.
EOF

mkdir -p .claude/skills/tdd/examples
cat > .claude/skills/tdd/examples/tdd-session.md << 'EOF'
# TDD Session: Adding Email Validation

## Requirement
Validate email format in user registration.

## Cycle 1: Basic Validation

### Red
```typescript
// user.test.ts
it('should reject invalid email format', () => {
  expect(() => new User('notanemail')).toThrow('Invalid email');
});
```
Run: `npm test` → FAILS (User doesn't validate emails yet)

### Green
```typescript
// user.ts
constructor(email: string) {
  if (!email.includes('@')) {
    throw new Error('Invalid email');
  }
  this.email = email;
}
```
Run: `npm test` → PASSES

### Refactor
Extract validation:
```typescript
private validateEmail(email: string): void {
  if (!email.includes('@')) {
    throw new Error('Invalid email');
  }
}
```

## Cycle 2: Domain Validation

### Red
```typescript
it('should reject email without domain', () => {
  expect(() => new User('test@')).toThrow('Invalid email');
});
```
...continue cycle...
EOF

/plugin marketplace add obra/superpowers-marketplace
/plugin install superpowers@superpowers-marketplace

git clone https://github.com/obra/superpowers.git ~/.claude/skills/superpowers

.claude/skills/security-audit/
├── SKILL.md
└── scripts/
    ├── check-dependencies.sh
    ├── scan-secrets.py
    └── validate-permissions.js

## Available Scripts

Run these for automated checks:
- `./scripts/check-dependencies.sh` - Scan for vulnerable packages
- `./scripts/scan-secrets.py` - Find hardcoded secrets
- `./scripts/validate-permissions.js` - Check file permissions

https://github.com/topics/claude-skills