Agent Skills › zeabur-oss/zeabur › zeabur-spec-work

zeabur-spec-work

GitHub

指导基于规范实现或修改Zeabur的安全及协议相关行为，涵盖K8s API、RBAC、OAuth等。强调源码引用、对抗性测试、防篡改计划验证、最小权限原则及密钥防泄露，确保功能符合预期且安全。

.claude/skills/zeabur-spec-work/SKILL.md zeabur-oss/zeabur

Trigger Scenarios

需要实现涉及安全或协议的行为变更需要进行对抗性测试以验证安全性处理RBAC、OAuth/OIDC或Kubernetes API语义相关任务

Install

npx skills add zeabur-oss/zeabur --skill zeabur-spec-work -g -y

More Options

Non-standard path

npx skills add https://github.com/zeabur-oss/zeabur/tree/main/.claude/skills/zeabur-spec-work -g -y

Use without installing

npx skills use zeabur-oss/zeabur@zeabur-spec-work

指定 Agent (Claude Code)

npx skills add zeabur-oss/zeabur --skill zeabur-spec-work -a claude-code -g -y

安装 repo 全部 skill

npx skills add zeabur-oss/zeabur --all -g -y

预览 repo 内 skill

npx skills add zeabur-oss/zeabur --list

SKILL.md

Frontmatter

{
    "name": "zeabur-spec-work",
    "description": "Implement or change a security- or protocol-relevant behaviour in Zeabur (Kubernetes API semantics, server-side apply, RBAC, OAuth\/OIDC with Zeabur Identity, HTTP caching) the way the codebase expects — from the specification text, with citations and adversarial tests. Use for any such feature or fix."
}

Specification-driven work

Follow zeabur-oss-spec-work (install: npx skills add zeabur-oss/skills --skill zeabur-oss-spec-work; skills-lock.json pins it): read the source, cite it in rustdoc, fail closed, test the attack. In Zeabur also:

Plans. A plan is applied only against the resource versions it was computed from; anything changed in between is refused. Test tampered plan tokens, replays and concurrent applies.
Zeabur's own rights. Zeabur's service account never gains a right its users lack, apart from pods in the terminal namespace after an access review of the person; no impersonate. Cluster tests: zeabur-cluster-tests.
Never leak a Secret's value. Values are read only on an explicit "show" request, never cached, never logged. Test it.