DDD 六边形架构设计与部署技能包。提供 Domain/Case/Infrastructure 层设计模式与代码模板,以及 Docker 环境部署脚本。当用户询问 DDD 架构、设计模式或需要部署项目时调用。
Security Analysis
medium confidenceThis is an internally consistent DDD scaffolding and deployment skill that generates project code via a packaged script and provides documentation; the main residual risk is that the scaffolder relies on a third‑party Maven archetype repository (network fetch) rather than built-in artifacts.
Name/description (DDD hexagonal scaffolding + Docker deployment) match the included files: many DDD reference docs and a create-ddd-project.sh script used to generate a Maven archetype project. Required resources (none declared) are proportional to the stated purpose.
SKILL.md instructs the agent to guide the user through selecting a target directory, collecting project parameters, and running the bundled script; it does not instruct reading unrelated system secrets or contacting unexpected external endpoints beyond standard artifact download and optional Docker usage. The skill explicitly requires asking the user for the creation path before writing files.
There is no install spec, but the create script invokes Maven with an archetypeRepository set to https://maven.xiaofuge.cn/ (a third‑party domain). Running the script causes Maven to fetch and execute archetype artifacts from that repository and later the user may build images that pull external dependencies. This is expected for a scaffolding tool, but fetching code/artifacts from a non-official repository increases risk and should be reviewed.
The skill declares no required environment variables or credentials — consistent with a local scaffolding tool. Documentation references common config files (e.g., ~/.m2/settings.xml) and example runtime env (Redis/MySQL host vars) but those are typical deployment instructions and not required by the skill itself.
always is false and the skill is user-invocable. The script creates files in a user-approved target directory (the skill mandates prompting the user for the path). It does not attempt to persist settings for other skills or modify global agent configs.
Guidance
This skill appears to do what it says: generate DDD project skeletons and provide DDD/deploy guidance. Before running it: 1) Confirm and explicitly choose the target directory when prompted (the skill requires this). 2) Inspect the bundled scripts (scripts/create-ddd-project.sh) and generated code before building or running — the archetype will be fetched from https://maven.xiaofuge.cn/, a third‑party Maven repository; review that repository or consider switching to a trusted archetype source. 3) When following Docker instructions, be cautious of example passwords (README uses an example root password) and use secure credentials in production. 4) If you cannot or do not want to fetch artifacts from the skill's archetype repo, run the scaffolding steps manually or host a trusted archetype. If you want lower risk, run generation in an isolated environment (VM/container) and review all generated dependencies before executing mvn or docker-compose.
Latest Release
v2.2.3
xfg-ddd-skills v2.2.2 → v2.2.3 - Archetype 脚手架模板版本默认值由 1.3 升级为 1.8 - “创建 DDD 项目”相关文档同步,将项目名、默认目录等统一更新为 “xfg-ddd-skills” - 新增“新功能开发完整流程”分层说明和标准调用链路图,提升分层实践规范性 - 修正脚本执行方式与目录路径描述,确保用户指引准确
More by @fuzhengwei
Published by @fuzhengwei on ClawHub