المهارات insforge
📦
insforge
مراجعة المحتوى r1 مخاطر عالية 🔑 متغيرات البيئة⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات
Build Secure InsForge App Integrations
Building InsForge features requires correct SDK, authentication, storage, AI, and payment patterns. This skill provides focused implementation guidance and production-oriented examples.
يدعم: Claude Codex Code(CC)
توقف واطلب التأكيد قبل التثبيت.
راجع الخطة واحصل على موافقة صريحة من المستخدم قبل تغيير الملفات.
التثبيت باستخدام Agent لدي
انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.
طلب الوكيل
Review the Skillstore skill "insforge" from https://skillstore.io/skills/insforge-insforge.md and its manifest at https://skillstore.io/api/skills/insforge-insforge/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.
موارد مهيّأة لـ Agents
استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.
اختبرها
جارٍ استخدام "insforge". Add email and password authentication to a Next.js application.
النتيجة المتوقعة:
- A server and browser client structure using InsForge SSR helpers.
- Sign-up, sign-in, callback, refresh, and sign-out flow guidance.
- Cookie, redirect, error handling, and session security notes.
جارٍ استخدام "insforge". Create a user-owned image upload feature.
النتيجة المتوقعة:
- An upload workflow that stores both the public URL and object key.
- Authentication and storage policy requirements for user ownership.
- Download, replacement, and deletion behavior with error states.
جارٍ استخدام "insforge". Add subscription billing with Stripe.
النتيجة المتوقعة:
- Checkout and customer portal flow guidance.
- Required payment table policies and subject ownership rules.
- Webhook-based fulfillment and idempotency requirements.
التدقيق الأمني
مخاطر عاليةv2 • ٣١/٨/٢٠٢٦ فتح التقرير المرتبط بالإصدار
Most static findings are scanner noise from Markdown, placeholders, environment configuration, relative links, and documented provider endpoints. Confirmed risks include dynamic URL fetching and outbound email capability. Semantic review found unsafe RAG trust placement, consentless feedback, browser email abuse, unpinned package execution, and payment fulfillment flaws.
20
الملفات التي تم فحصها
3,958
الأسطر التي تم تحليلها
3
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (6)
مرتفع
Retrieved RAG Content Receives System-Role Authority
The RAG example concatenates retrieved document text into a system message. Malicious document instructions can override application behavior or redirect model output.
The example directly places retrieved document content in a system-role message without trust boundaries or prompt-injection handling.
مرتفع
Feedback Submission Lacks Explicit User Consent
The skill directs the agent to report InsForge problems and continue. The feedback command can transmit project-specific titles and details without first showing the payload.
The instruction explicitly says to report issues through a networked CLI and does not require user confirmation before submission.
مرتفع
payments/stripe.md:95-103payments/stripe.md:195-208payments/razorpay.md:113-120payments/razorpay.md:240-248
Payment Fulfillment Does Not Validate Purchased Value
Browser-controlled checkout terms are accepted, while webhook fulfillment marks an order paid using only its identifier. A modified request could pay less or select another item.
The checkout examples submit price or amount from browser code, but the fulfillment SQL never compares verified payment values with server-owned order expectations.
مرتفع
payments/stripe.md:119-126payments/stripe.md:232-268payments/razorpay.md:151-156payments/razorpay.md:270-301
Subscription Entitlements Ignore the Purchased Plan
Browser code selects a price or plan, but every successful subscription event grants the fixed pro entitlement. A cheaper product could receive higher access.
Both fulfillment functions set plan to pro without checking the verified provider product, price, plan, amount, currency, or expected application purchase.
متوسط
Authenticated Browser Users Can Send Arbitrary Email
The guide allows any signed-in browser client to send custom HTML email. Applications following this example may expose a spam and billing primitive without role checks.
The guide states that authentication is sufficient and demonstrates sending directly from the same client, with no application authorization or recipient restriction.
متوسط
Unpinned Packages Are Downloaded and Executed
Setup examples install the latest SDK and run the CLI through npx with automatic confirmation. Upstream compromise or an incompatible release would execute immediately.
The cited commands explicitly use the latest SDK or npx -y without a pinned CLI version.
عناصر مراجعة القدرات (3)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
متوسط
Fetch API call
const imageResponse = await fetch(imageUrl)
The example fetches a URL supplied by an external model response without validating its scheme or host. A manipulated response could make server-side code request an internal or otherwise unintended resource.
متوسط
Email sending capability
> **🛑 No SMTP, no third-party packages.** `insforge.emails.send()` works on every paid project — no
The guide explicitly enables outbound email through insforge.emails.send. Sending messages is an external side effect that can incur cost or support abuse if application authorization is weak.
متوسط
Email sending capability
> **Scope.** This module sends **custom** transactional emails (welcome, receipt, newsletter, alerts
The documented module sends welcome, receipt, newsletter, and alert messages to external recipients. This is a real network capability with spam, privacy, and billing impact.
عوامل الخطر
🔑 متغيرات البيئة (50)
ai/audio.md:67 ai/chat-completions.md:70 ai/chat-completions.md:70 ai/chat-completions.md:17 ai/embeddings-and-rag.md:58 ai/embeddings-and-rag.md:87 ai/embeddings-and-rag.md:106 ai/embeddings-and-rag.md:58 ai/embeddings-and-rag.md:87 ai/embeddings-and-rag.md:106 ai/embeddings-and-rag.md:26 ai/embeddings-and-rag.md:35 ai/embeddings-and-rag.md:151 ai/embeddings-and-rag.md:153 ai/image-generation.md:34 ai/image-generation.md:38 ai/image-generation.md:34 ai/image-generation.md:38 ai/image-generation.md:15 ai/image-generation.md:19 ai/image-generation.md:34 ai/models-list.md:15 ai/models-list.md:21 ai/models-list.md:40 ai/models-list.md:44 ai/models-list.md:48 ai/models-list.md:52 ai/models-list.md:56 ai/overview.md:59 ai/overview.md:59 ai/overview.md:28 ai/overview.md:35 ai/overview.md:59 ai/overview.md:93 ai/video-generation.md:25 ai/video-generation.md:28 auth/sdk-integration.md:17 auth/sdk-integration.md:18 auth/sdk-integration.md:17 auth/sdk-integration.md:18 auth/ssr-integration.md:198 auth/ssr-integration.md:209 auth/ssr-integration.md:198 auth/ssr-integration.md:209 database/sdk-integration.md:13 database/sdk-integration.md:14 database/sdk-integration.md:24 database/sdk-integration.md:25 database/sdk-integration.md:123 database/sdk-integration.md:124
⚙️ الأوامر الخارجية (50)
ai/embeddings-and-rag.md:108-132 ai/image-generation.md:34-50 ai/image-generation.md:50-59 ai/image-generation.md:75-96 database/sdk-integration.md:293-311 payments/razorpay.md:134-139 payments/stripe.md:98-99 payments/stripe.md:99-103 payments/stripe.md:103-110 payments/stripe.md:122-123 payments/stripe.md:123-126 payments/stripe.md:126-133 payments/stripe.md:143-150 realtime/sdk-integration.md:114-139 realtime/sdk-integration.md:200-229 SKILL.md:10 SKILL.md:16-18 SKILL.md:18-22 SKILL.md:22 SKILL.md:26-27 SKILL.md:27 SKILL.md:31-33 SKILL.md:33-35 SKILL.md:35 SKILL.md:37-39 SKILL.md:39-43 SKILL.md:43-45 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:52-54 SKILL.md:54-57 SKILL.md:57-59 SKILL.md:59 SKILL.md:65-72 SKILL.md:72-76 SKILL.md:76-83 SKILL.md:83-87 SKILL.md:87-94 SKILL.md:94-98 SKILL.md:98-105 SKILL.md:105-139 SKILL.md:139-140 SKILL.md:140-141 SKILL.md:141 SKILL.md:142-160 SKILL.md:160-163
🌐 الوصول إلى الشبكة (33)
ai/embeddings-and-rag.md:34 ai/image-generation.md:31 ai/image-generation.md:73 ai/image-generation.md:18 ai/image-generation.md:31 ai/models-list.md:20 ai/models-list.md:39 ai/models-list.md:43 ai/models-list.md:47 ai/models-list.md:51 ai/models-list.md:55 ai/overview.md:58 auth/sdk-integration.md:45 auth/sdk-integration.md:76 auth/sdk-integration.md:150 auth/sdk-integration.md:165 auth/sdk-integration.md:314 auth/sdk-integration.md:342 auth/sdk-integration.md:364 auth/sdk-integration.md:407 auth/ssr-integration.md:33 auth/ssr-integration.md:35 email/sdk-integration.md:5 email/sdk-integration.md:7 email/sdk-integration.md:150 payments/razorpay.md:99 SKILL.md:35 SKILL.md:55 SKILL.md:175 storage/s3-gateway.md:89 storage/s3-gateway.md:117 storage/s3-gateway.md:137 storage/s3-gateway.md:155
📁 الوصول إلى نظام الملفات (28)
ai/embeddings-and-rag.md:11 ai/embeddings-and-rag.md:17 auth/sdk-integration.md:7 auth/sdk-integration.md:11 database/sdk-integration.md:7 database/sdk-integration.md:181 database/sdk-integration.md:253 email/sdk-integration.md:13 email/sdk-integration.md:37 email/sdk-integration.md:43 functions/sdk-integration.md:7 realtime/sdk-integration.md:7 realtime/sdk-integration.md:30 realtime/sdk-integration.md:251 SKILL.md:139 SKILL.md:142 SKILL.md:149 SKILL.md:169 SKILL.md:185 SKILL.md:227 storage/postgres-rls.md:325 storage/s3-gateway.md:109 storage/s3-gateway.md:114 storage/s3-gateway.md:149 storage/s3-gateway.md:109 storage/s3-gateway.md:114 storage/s3-gateway.md:149 storage/sdk-integration.md:9
دقّقه: codex عرض سجل التدقيق →
شارك واستشهد بهذا التقرير
شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.
نسخ رابط التقرير
https://skillstore.io/skills/insforge-insforge/audits/2?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportشارة Markdown
[](https://skillstore.io/skills/insforge-insforge?utm_source=security_passport_badge)شارة HTML
<a href="https://skillstore.io/skills/insforge-insforge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/insforge-insforge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>بطاقة قابلة للتضمين
<iframe src="https://skillstore.io/embed/skills/insforge-insforge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>الاستشهادات الأكاديمية (APA · BibTeX · CFF)
اقتباس APA
insforge. (2026). insforge security audit report (audit version 2) [Author version unspecified]. Skillstore. https://skillstore.io/skills/insforge-insforge/audits/2اقتباس BibTeX
@techreport{insforge-insforge-insforge-2026,
author = {insforge},
title = {insforge security audit report (audit version 2)},
institution = {Skillstore},
year = {2026},
number = {2},
url = {https://skillstore.io/skills/insforge-insforge/audits/2},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "insforge security audit report (audit version 2)"
version: "unspecified"
type: report
authors:
- name: "insforge"
date-released: "2026-08-31"
url: "https://skillstore.io/skills/insforge-insforge/audits/2"
identifiers:
- type: other
value: "skillstore:insforge-insforge:audit:2"
description: "Skillstore immutable audit report identifier"
تقييم Skillstore
سبب هذا التقييم موثوقية الأدلة: متوسط 55
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
65
المجتمع
83
الامتثال للمواصفات
ما الذي يمكنك بناؤه
Launch a SaaS Application
Build authentication, database records, uploads, subscriptions, and transactional emails with InsForge services.
Add AI Product Features
Connect OpenRouter models to InsForge storage, vector search, job tracking, and protected application data.
Modernize Existing Integrations
Move existing S3, Stripe, Razorpay, and realtime workflows onto documented InsForge SDK patterns.
جرّب هذه الموجّهات
Create a Basic Client
Create an InsForge client for my [framework] application. Use the correct environment variables and explain where each value belongs.
Build Authenticated CRUD
Add sign-in and CRUD for [resource]. Derive ownership from the session, handle errors, and describe the required row-level security.
Implement Paid File Workflows
Build a [Stripe or Razorpay] checkout flow with protected file access. Include webhook fulfillment, storage keys, and user-visible states.
Design a Production RAG System
Design an InsForge RAG pipeline for [content]. Include schema, embeddings, tenant isolation, prompt-injection controls, evaluation, and bounded server processing.
أفضل الممارسات
- Keep admin and OpenRouter keys in server-only environment variables.
- Derive ownership from authenticated sessions and enforce row-level security for every protected table.
- Pin dependencies, validate external URLs, and require confirmation before networked administrative actions.
تجنب
- Do not place admin, payment, S3, or OpenRouter secrets in browser bundles.
- Do not trust browser-supplied ownership, prices, plan identifiers, or payment status.
- Do not fulfill payments from success pages or store temporary media URLs as durable assets.
الأسئلة المتكررة
Which InsForge features does this skill cover?
It covers SDK integration for data, auth, storage, functions, AI, realtime, email, Stripe, Razorpay, and S3-compatible tools.
Does this skill manage infrastructure?
No. Use the InsForge CLI workflow for migrations, deployments, secrets, provider configuration, buckets, functions, and schedules.
Can I use it with Next.js SSR?
Yes. The guides cover browser clients, server clients, auth actions, middleware refresh, callbacks, and secure cookie handling.
Can browser code use an InsForge anon key?
Yes. Anon keys support user-scoped clients, but row-level security and authenticated sessions must protect application data.
Does it support AI features?
Yes. It covers OpenRouter chat, images, video, audio, embeddings, model discovery, and RAG with InsForge storage and data.
What must I review before production use?
Review authorization, row-level security, secret placement, package versions, external URL validation, email permissions, payment webhooks, and plan limits.