SkillAtlasSkill 详情

claude-code-reverse

106 Cross-Runtime Skills | 7 Claude Code Agents | One Command Install

审核状态:已审核Quality 80Security 80

复制安装命令

用 Codex 或 Claude 安装复制这段 Prompt,粘贴到 Codex、Claude 或其他助手里,让它先审查 Skill 页面再帮你安装。

复制前请先查看来源、License 和安全提示。

项目 README

来源文件:README.md

抓取于 2026年9月6日

Spellbook

106 Cross-Runtime Skills | 7 Claude Code Agents | One Command Install

A cross-runtime skill library for Claude Code, Codex, and multi-agent workflows.

Stars License Skills Agents

Quick Start • Runtime Targets • Pick a Workflow • Skills • Agents • Changelog • Release Status • Contributing • 中文


Rename notice: Spellbook was formerly Claude Arsenal. Claude Code remains a first-class target; the new name reflects the broader roadmap for Claude Code, Codex, and cross-runtime agent skills. See the migration note for details.


Quick Start

Start with one job-shaped workflow. The maintained skills CLI lets you choose the supported coding agents during installation and installs only these four skills:

npx skills add majiayu000/spellbook --skill frontend-design --skill app-ui-design --skill ui-design-system --skill figma-to-react

Use npx skills add majiayu000/spellbook --list to inspect the catalog before installing. See Pick a Workflow for four other focused starting points.

Advanced Cross-Runtime Installer

install.sh remains available when you want explicit Claude Code/Codex target paths or need to install the repository's Claude Code agents as well as skills.

# Install all skills and supported agents into both maintained runtimes
curl -fsSL https://raw.githubusercontent.com/majiayu000/spellbook/main/install.sh | bash -s -- --target all

# Or clone the repository and select skills explicitly
git clone https://github.com/majiayu000/spellbook.git
cd spellbook
./install.sh --target all --skills typescript-project,python-project,devops-excellence

Verify Installation

  • Claude Code: type / to see your installed skills.
  • Codex: restart Codex so it reloads ~/.agents/skills.

Runtime Targets

Spellbook keeps the skill source in one place and installs it into the runtime you use.

TargetInstalled ToStatus
Claude Code~/.claude/skills plus ~/.claude/agentsSkills and agents supported
Codex~/.agents/skillsSkills supported; agents skipped
AllBoth Claude Code and Codex pathsRecommended for multi-tool users

Claude Code remains a first-class target and search entry. The project was formerly known as Claude Arsenal; the new Spellbook name reflects the broader goal: reusable skills that can travel across coding agents. Older Spellbook versions installed Codex skills under ~/.codex/skills; reinstall with the current installer to use the documented Codex user-level skill path.


Pick a Workflow

Start with a small bundle that matches the job, then add more skills when the workflow sticks.

WorkflowInstallGood for
Frontend and UInpx skills add majiayu000/spellbook --skill frontend-design --skill app-ui-design --skill ui-design-system --skill figma-to-reactProduct UI, landing pages, design systems, Figma handoff
Code qualitynpx skills add majiayu000/spellbook --skill codebase-audit --skill flowguard --skill systematic-debugging --skill review-gateAudits, guarded delivery, root-cause debugging, pre-landing review
Ops and releasenpx skills add majiayu000/spellbook --skill release-engineering --skill server-security --skill clash-doctor --skill system-doctorRelease planning, server hardening, and local or network diagnosis
Product and docsnpx skills add majiayu000/spellbook --skill product-discovery --skill prd-master --skill technical-spec --skill product-analyticsDiscovery, PRDs, technical specs, metrics plans
Agent workflowsnpx skills add majiayu000/spellbook --skill codex-agent --skill multi-ai-research --skill flowguard --skill vibeguardCross-review, multi-AI research, context handoff, anti-hallucination checks

High-signal individual skills to try first: github-trending, harmonyos-app, app-ui-design, product-discovery, xiaohongshu, codebase-audit, and server-security.

See Showcase for copy-paste prompts and expected outputs. Use the Spellbook Skill Browser for curated first-party skills, or the Claude Skills Registry for broader community discovery. Release history lives in Changelog.


Why Spellbook

  • Cross-runtime install: one source tree can install into Claude Code and Codex.
  • Validated registry: every installable skill is checked by python3 scripts/validate_skills.py --check.
  • Progressive disclosure: larger skills use references/, templates/, scripts/, and eval files instead of one giant prompt.
  • Practical coverage: engineering, operations, product, UI, content, and agent workflows live in one catalog.

Skills

The generated full skill inventory lives in Skill Registry. Skill layout rules live in Skill Format Policy. Skill authoring quality rules live in Skill Quality Playbook.

Search the Registry

# Free-text query (AND semantics across name, description, category, tags)
python3 scripts/validate_skills.py search rust testing

# Filter by tag
python3 scripts/validate_skills.py search --tag agent

# Restrict to a description language
python3 scripts/validate_skills.py search --language zh deploy

# Machine-readable output
python3 scripts/validate_skills.py search --tag react --json

The tag index lives in registry/tags.json for tooling and dashboards. Curated overrides for skills the keyword heuristic cannot infer live in registry/tag_overrides.yml.

Audit non-blocking skill quality signals:

python3 scripts/audit_skill_quality.py
python3 scripts/audit_skill_quality.py skill-creator

AI & Agent Workflow

Skills for orchestrating, guarding, and maintaining AI agent workflows — the core of Spellbook's cross-runtime mission.

SkillDescription
multi-model-orchestratorCoordinate multi-agent tasks via a centralized handoff document
flowguardGuard long, ambiguous, or stateful agent tasks from drift
skill-lifeguardAdd reliable-skill contracts, checkpoints, smoke hooks, and drift signals
review-gateProduce review packs and require human approval before landing agent changes
skill-auditAudit, design, categorize, and measure agent skills
skill-ecosystem-doctorGovern canonical sources, projections, retirement, quarantine, and cross-runtime verification
threadsCodex-native subagents and parallel GitHub queue lanes
codex-fluentCodex session hygiene, archive strategy, and handoff discipline
codex-retrospectiveCodex self-review of recent history to improve behavior
brainstormingSocratic dialogue for design refinement and architecture exploration

See docs/agent-reliability-trio.md for the Reliable Skill + Context Engineering + Review Gate workflow.

Development Architecture

Build production-ready projects with language-specific best practices.

SkillLanguageKey Features
typescript-projectTypeScriptESM, Zod, Biome, Clean Architecture
python-projectPythonuv, Pydantic, Ruff, FastAPI
rust-projectRustCargo workspace, error handling, async
golang-webGoChi/Echo, sqlc, structured logging
zig-projectZigBuild system, memory management
architecture-foundationCross-languageRuntime, state ownership, adapters, and convergence specs
elegant-architectureCross-languageClean architecture with strict 200-line file limits

Product Lifecycle

End-to-end product development from discovery to deployment.

SkillPhaseWhat You Get
product-discoveryDiscoveryJTBD, user interviews, market research
prd-masterDefinitionPRD writing, user stories, RICE prioritization
technical-specDesignDesign docs, ADR, C4 diagrams
product-analyticsGrowthEvent tracking, A/B testing, AARRR
devops-excellenceDeploymentCI/CD, Docker, Kubernetes, GitOps
observability-sreOperationsMonitoring, logging, tracing, SLO/SLI
product-manager-toolkitDefinitionRICE, customer interviews, PRD templates, discovery frameworks

API & Backend

SkillDescription
api-designREST/GraphQL/gRPC patterns, OpenAPI 3.2
auth-securityOAuth 2.1, JWT, security best practices
database-patternsPostgreSQL, Redis, migrations, optimization
codebase-auditDeep adaptive repository audit with severity-ranked findings and repair roadmap
structured-logging-liteCentralized logging, field standards, and distributed tracing

Development Practices

SkillDescriptionOrigin
contributorEnd-to-end open source contribution workflow from issue discovery to PR submissionCustom
repo-agent-context-auditAudit and scaffold repo agent context across AGENTS, skills, and specsCustom
skill-creatorCreate, improve, and benchmark reusable skillsCustom
humanizerRemove obvious AI writing patterns from user-facing textExternal guide + custom adaptation

Delivery Workflow

Disciplined end-to-end delivery: testing, commits, health checks, and contribution flow.

SkillDescription
app-user-story-qaEnd-to-end app feature inventory, canonical tracker, user-story testing, fixes, and retest loop
test-driven-developmentEnforce RED-GREEN-REFACTOR TDD discipline
comprehensive-testingTest pyramid, unit/integration/E2E/property testing, framework best practices
git-commit-smartGenerate meaningful conventional commit messages from diff
push-allStage, commit, and push all changes after safety checks
project-health-auditorCodebase health, tech debt, dependency, and project risk analysis
contribution-architectMove from bug fixes to architectural improvements and debt discovery

Cross-Tool Interop

Skills for using multiple coding agents and CLI tools together.

SkillDescription
codexInvoke Codex CLI sessions from another agent workflow
codex-agentOptional second-opinion review, cross-verification, and alternatives through Codex CLI
sol-luna-routerKeep GPT-5.6 Sol as commander/reviewer while GPT-5.6 Luna performs bounded implementation
ask-opencliAsk Grok or Gemini through opencli and an existing browser session
multi-ai-researchParallel research across multiple AI tools and internal agents

UI/UX & Design

SkillDescription
app-ui-designiOS/Android UI design, Material Design 3, HIG
product-ux-expertUX evaluation, heuristics, accessibility
frontend-designWeb frontend design patterns
ui-designerExtract design systems from UI screenshots and references
ui-design-systemDesign system toolkit and design-dev handoff support
web-artifacts-builderClaude.ai HTML artifacts
react-best-practicesReact and Next.js performance patterns distilled from Vercel guidance
react-hooks-best-practicesReact hooks, effects, refs, and component design patterns
slidesSpeech-friendly slide deck and background slide generation
ui-ux-pro-maxCompact UI/UX tables for product patterns, landing pages, charts, and 9 stacks
figma-to-codeFigma designs to production React/Next.js with TypeScript and Tailwind
css-debugDiagnose CSS/layout issues, Tailwind conflicts, z-index stacking
playwright-automationBrowser automation and testing with Playwright

Tooling & Automation

SkillDescription
web-asset-generatorFavicons, app icons, OG images
github-trendingGitHub trending analysis
vibeguardTask contracts, finding scoring, and lightweight anti-hallucination reviews
clash-doctorClash proxy & network diagnostics
clash-routesInspect active proxy routes for specific processes via Mihomo API
optimize-networkSafe local network speed, latency, DNS, Wi-Fi, and bufferbloat diagnostics with VPN/proxy guardrails
disk-cleanerScan and reclaim disk space with interactive cleanup guidance
system-doctorDiagnose CPU, memory, and process-level system slowdowns
codex-log-guardDiagnose and mitigate excessive Codex local SQLite diagnostic log writes
server-securityAudit and harden Linux server SSH, firewall, and exposed services
cliproxy-newapi-stackAdd a loopback-first NewAPI metering layer to an independently verified CLIProxyAPI upstream

Operations & Deploy

Deploy models and diagnose local and remote environments.

SkillDescription
gemma4-local-deployDeploy Gemma 4 12B locally on Mac/Apple Silicon via llama.cpp or Ollama
gpu-useInspect remote server GPU usage (per-card VRAM, processes, containers)
rustdesk-doctorDiagnose RustDesk connection issues
vscode-doctorDiagnose slow or freezing VS Code-compatible editors

Content & Social Media

SkillDescription
xiaohongshuXiaohongshu content creation & publishing
trip-plannerTravel itinerary planning
weeklyWeekly report from Git, Claude Code, and Codex sessions
xiaohongshu-netfeel-guardianRemove translation-tone from Claude's Chinese content for native readability

Mobile & Cross-Platform

SkillDescription
harmonyos-appHarmonyOS with ArkTS, ArkUI, Stage Model

Rust Specific

SkillDescription
rust-best-practicesMicrosoft Rust guidelines, error handling

Agents

Specialized agents for complex tasks.

AgentExpertiseUse Case
tech-lead-orchestratorCoordinationMulti-step tasks, delegation
code-archaeologistExplorationLegacy codebase documentation
backend-typescript-architectArchitectureBun/Node.js, API design
senior-code-reviewerReviewSecurity, performance, architecture
kubernetes-specialistInfrastructureK8s, Helm, GitOps
security-auditorSecurityOWASP Top 10, SAST
opensource-contributorContributionOpen source workflow

Plugins

Spellbook is also a Claude Code plugin marketplace. Install the repo as a marketplace, then install plugins from it:

/plugin marketplace add majiayu000/spellbook
/plugin install idea-coach
/plugin install rust-dev
PluginDescription
idea-coachOpinionated product coach (idea -> PRD -> clickable HTML prototype) + multi-role idea group chat; plugin commands are /idea-coach:idea and /idea-coach:idea-team
rust-devRust best practices, code review, performance, and async patterns

Plugin skills are packaged copies of catalog skills; the catalog (installed by install.sh) remains the cross-runtime source of truth.


Skill Design Philosophy

Every skill in Spellbook follows these principles:

  1. Hard Rules - Mandatory constraints with FORBIDDEN / REQUIRED markers
  2. Practical Examples - Real code, not just theory
  3. Verification Checklists - Actionable validation steps
  4. Battle-Tested - Used in production environments

Documentation

DocumentDescription
ChangelogRelease history and current release status
Installation GuideDetailed setup instructions
Runtime TargetsClaude Code and Codex installation targets
ShowcaseCopy-paste workflow demos
Spellbook Operating ContractAgent behavior rules for autonomy, escalation, pushback, feedback loops, and done-when checks
Skill Format PolicyDirectory vs file skill layout rules
Skill Quality PlaybookTrigger descriptions, gotchas, progressive disclosure, and verification
Skill Testing GuideHow to validate skills work
Creating PluginsBuild your own skills
Product Lifecycle (EN)Full lifecycle coverage
Product Lifecycle (中文)产品生命周期覆盖

Release Status

Spellbook is in pre-1.0 release-readiness mode. No numbered GitHub release tag has been cut yet; the current install path uses the repository main branch. See Changelog for release history.

Current limitations:

  • Codex installs skills only; Claude Code agents are skipped for Codex targets.
  • Some skills depend on external CLIs, accounts, credentials, or platform access that are not bundled by the installer.
  • The registry validator checks installable skill structure, not every external workflow end to end.

Support paths:


Credits

Built on the shoulders of giants:


Contributing

Contributions welcome! Please read our Contributing Guide first.


The Agent Infra Stack

This project is one layer of an open-source stack for running coding agents (Claude Code, Codex) as serious infrastructure. Every piece works standalone; together they close the loop:

spellbook sits in the Extend layer — the authoring side of the skill story: write once, run on Claude Code and Codex. Discovery and distribution live in claude-skill-registry.

LayerProjectWhat it does
Extendclaude-skill-registryDiscover and search community Claude Code skills
Extendspellbook ◀ you are hereCross-runtime skills for Claude Code, Codex, and multi-agent workflows
TrustargusStatic install-time scanner for supply-chain attacks (npm / PyPI / crates.io)
TrustvibeguardRules, hooks, and guards against hallucinated or unverified agent changes
RememberrememLocal-first persistent memory for Claude Code and Codex sessions
OrchestrateharnessRust agent orchestration platform — rules, skills, GC, observability
Routelitellm-rsHigh-performance Rust AI gateway — 100+ LLM APIs via OpenAI format
KeepkeeplineSession command center — monitor, recover, never lose agent work

License

MIT License - Use freely in your projects.


If this helps you, consider giving it a ⭐

Made for builders using Claude Code, Codex, and multi-agent workflows

开发与工程

中风险

  • 来源需自行核对维护者身份。
  • 包含脚本或命令调用,安装前请复核。
  • 未检测到明显外部权限要求。
  • 未检测到高风险命令。
  • 扫描发现:2 条。

Codex — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/majiayu000/spellbook.git
  3. 将 "skills/claude-code-reverse" 文件夹复制到 Codex 的 skills 目录中。
  4. 重启 Codex 让新的 skill 生效。

Codex — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Codex 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Codex 让新的 skill 生效。

Claude Code — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/majiayu000/spellbook.git
  3. 将 "skills/claude-code-reverse" 文件夹复制到 Claude Code 的 skills 目录中。
  4. 重启 Claude Code 让新的 skill 生效。

Claude Code — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Claude Code 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Claude Code 让新的 skill 生效。

Cursor — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/majiayu000/spellbook.git
  3. 将 "skills/claude-code-reverse" 文件夹复制到 Cursor 的 skills 目录中。
  4. 重启 Cursor 让新的 skill 生效。

Cursor — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Cursor 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Cursor 让新的 skill 生效。

GitHub Copilot — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/majiayu000/spellbook.git
  3. 将 "skills/claude-code-reverse" 文件夹复制到 GitHub Copilot 的 skills 目录中。
  4. 重启 GitHub Copilot 让新的 skill 生效。

GitHub Copilot — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 GitHub Copilot 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 GitHub Copilot 让新的 skill 生效。

Windsurf — Git Clone 安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 克隆仓库:git clone https://github.com/majiayu000/spellbook.git
  3. 将 "skills/claude-code-reverse" 文件夹复制到 Windsurf 的 skills 目录中。
  4. 重启 Windsurf 让新的 skill 生效。

Windsurf — 手动复制安装

  1. 安装前请先查看来源仓库和风险报告。
  2. 从源仓库下载 SKILL.md 及相关文件。
  3. 在 Windsurf 的 skills 目录中创建新文件夹。
  4. 将所有 skill 文件复制到新文件夹中。
  5. 重启 Windsurf 让新的 skill 生效。
查看 SKILL.md 原文
name: claude-code-reverse
description: 对用户拥有或明确获授权的本机可执行文件、应用二进制和版本产物做只读静态逆向,包括 Claude Code 及其他 CLI、Mach-O、ELF、PE、Wasm 或打包应用。仅在用户明确要求“逆向、扒实现、查二进制字符串/符号/依赖、验证内部行为、比较两个版本”时使用;不要因普通提及软件而触发,也不要用于执行未知样本、绕过授权/计费、破解或再分发。

Local Binary Reverse

对明确指定的本机目标做证据优先的静态分析。默认只读,不执行目标,也不把“可见字符串”夸大为“已证明运行时行为”。

自主边界

  • 可直接执行:读取用户指定的单个本机文件;运行 file、哈希、strings、符号表、依赖表、段表和只读反汇编工具;把分析缓存写入当前用户的私有 cache。
  • 先征得同意:运行目标、附加调试器、注入/hook、解包到用户目录、安装分析工具、上传样本、分析未获授权的软件或受保护数据。
  • 直接拒绝:绕过许可证、计费或访问控制,提取凭据,制作破解补丁,规避检测,或再分发专有代码/资源。
  • 不确定所有权、目标路径或交付问题时先澄清,不要扫描整台机器寻找“可能的目标”。

1. 锁定目标与问题

先记录:

  1. 精确目标路径或命令名。
  2. 用户要验证的具体问题,例如 UI 文案来源、功能开关、网络端点、依赖或版本差异。
  3. 对比版本的两个精确文件(如适用)。

不要把进程名、应用名或猜测路径当成已确认目标。不要运行目标来“看看会发生什么”。

2. 建立文件身份

使用同目录的 extract.sh。它只接受普通文件或可由 command -v 解析的命令,缓存按内容 SHA-256 隔离并存放在 ${XDG_CACHE_HOME:-$HOME/.cache}/claude-code-reverse/。

SKILL_DIR=/path/to/claude-code-reverse
bash "$SKILL_DIR/extract.sh" info --target /absolute/path/to/target
bash "$SKILL_DIR/extract.sh" dump --target /absolute/path/to/target
bash "$SKILL_DIR/extract.sh" search --target /absolute/path/to/target "literal anchor"
bash "$SKILL_DIR/extract.sh" diff --target-a /path/to/v1 --target-b /path/to/v2 "literal anchor"

info 必须先给出规范化路径、文件类型、字节数和 SHA-256。若目标在分析期间发生变化,重新执行 info 和 dump;不要复用旧缓存作结论。

3. 按格式选择只读工具

先用 command -v <tool> 验证工具存在。缺失时报告缺失项,不要悄悄换成会执行目标的方案。

格式首选证据可选深入工具
Mach-Ofile、otool -L、otool -l、nmotool -tvV、已安装的反编译器
ELFfile、readelf -h -l -d -s、objdump -xobjdump -d、已安装的反编译器
PE/COFFfile、objdump -x、ASCII/UTF 字符串objdump -d、已安装的 PE 工具
Wasmfile、wasm-objdump -xwasm2wat
ZIP/JAR/APK/打包资源先列目录,不落盘解包在用户批准的临时目录中解包后逐件分析

不要对不可信目标使用 ldd,因为某些实现可能通过加载器执行代码。不要对大文件直接输出完整反汇编、完整字符串或完整符号表;先用字面锚点缩小范围,把原始大输出留在 cache 或单独 artifact 中。

常见失败信号

  • strings 几乎没有输出:目标可能被剥离、压缩、加密或只是启动器;先检查文件类型和段表,不要据此断言“没有实现”。
  • 刚 dump 后却提示 cache 不存在:内容哈希已经变化,说明目标文件被更新;重新执行 info 和 dump,不要复用旧版本结论。
  • 同一字符串重复出现:universal/fat binary 可能包含多个架构切片;先按架构检查,不能把重复次数直接解释为调用次数。
  • ASCII 搜索无命中:PE 或资源文件可能使用 UTF-16;确认本机 strings 实现支持相应编码选项后再查,不要假定跨平台参数一致。

4. 从证据到结论

按以下顺序收敛:

  1. 用产品文案、端点、配置键、错误消息或符号名做字面锚点。
  2. 截取锚点附近上下文,并记录来源文件和 SHA-256。
  3. 交叉检查符号、导入依赖、相邻常量或两个版本的差异。
  4. 区分结论等级:已观察(文件中直接存在)、强推断(多项静态证据一致)、未知(需要运行时或服务端证据)。

字符串存在不等于代码路径可达,导入存在不等于功能被调用,客户端文案也不能证明服务端策略。

5. Claude Code 兼容模式

不提供 --target 时,脚本保留原来的 Claude Code 快捷模式:

bash "$SKILL_DIR/extract.sh" dump
bash "$SKILL_DIR/extract.sh" search "usage limit reached"
bash "$SKILL_DIR/extract.sh" diff 2.1.190 2.1.191 "literal anchor"

需要 Claude Code 的安装位置、锚点地图和特有限制时,读取 references/claude-code.md。其他目标不要套用 Claude 专用锚点。

静态分析边界

静态分析通常无法证明服务端下发内容、运行时生成值、加密后数据、动态加载路径、优化掉的逻辑或混淆变量的真实语义。需要越过这些边界时,明确说明缺少的证据和下一步会产生的副作用,再请求许可。

完成标准

  • 报告目标规范化路径、文件类型、字节数和 SHA-256。
  • 列出本次真实运行的命令和关键输出位置。
  • 每项结论附直接证据,并标记 已观察、强推断 或 未知。
  • 说明未覆盖的静态分析边界。
  • 确认没有执行或修改目标,也没有把样本上传到外部服务。

发现问题?提交给管理员复核

评分:

评论 (0)

暂无评论,成为第一个评论者吧!