📦

astrale-cli

Name: astrale-cli
Author: astrale-os

Inhaltsrevision r1 Mittleres Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff

Manage Astrale Kernels with CLI Workflows

Astrale operations require precise paths, identity selection, and command options. This reference guides assistants through Kernel operations, graph workflows, diagnostics, and local UI setup.

Unterstützt: Claude Codex Code(CC)

📊 69 Angemessen

Maintain this Skill? Claim it 📊 69 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "astrale-cli" from https://skillstore.io/skills/astrale-os-astrale-cli.md and its manifest at https://skillstore.io/api/skills/astrale-os-astrale-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/astrale-os-astrale-cli.md Signiertes manifest GET /api/skills/astrale-os-astrale-cli/manifest Signiertes lockfile GET /api/skills/astrale-os-astrale-cli/lockfile

Testen

„astrale-cli“ wird verwendet. Explain how to read notes from staging without changing data.

Erwartetes Ergebnis:

Select staging explicitly and use an identity authorized to read notes.
Query the Note class with a finite limit and structured output.
Resume with each returned cursor until no continuation remains.

„astrale-cli“ wird verwendet. Explain how to review a mutation before sending it.

Erwartetes Ergebnis:

Use mutation dry mode to admit and display the canonical document without connecting to a Kernel.
Review the operations and preconditions against the intended instance.
Require approval before executing the atomic transition.

„astrale-cli“ wird verwendet. Explain how to protect locally edited Astrale UI components.

Erwartetes Ergebnis:

Ordinary component addition refuses to replace locally edited installed files.
Preview proposed changes with dry-run mode.
Use overwrite and confirmation flags only after reviewing the intended replacement.

Sicherheitsaudit

Mittleres Risiko

v1 • 10.10.2026 Versionsbericht öffnen

All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.

Gescannte Dateien

631

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel

SKILL.md:373-374 SKILL.md:387

Bearer Credentials Exposed Through Command Arguments

The examples pass minted bearer credentials using --creds "$TOKEN" and --creds "$(astrale token --raw)". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.

The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window.

Risikofaktoren

⚙️ Externe Befehle (50)

🌐 Netzwerkzugriff (6)

SKILL.md:60 SKILL.md:158 SKILL.md:228 SKILL.md:274 SKILL.md:275 SKILL.md:277

📁 Dateisystemzugriff (2)

SKILL.md:592 SKILL.md:592

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/astrale-os-astrale-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg)](https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/astrale-os-astrale-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

astrale-os. (2026). astrale-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/astrale-os-astrale-cli/audits/1

BibTeX-Zitat

@techreport{astrale-os-astrale-os-astrale-cli-2026,
  author = {astrale-os},
  title = {astrale-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/astrale-os-astrale-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "astrale-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "astrale-os"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/astrale-os-astrale-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:astrale-os-astrale-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Inspect Application Graph Data

Read nodes, inspect callable schemas, and paginate bounded graph queries on an explicitly selected instance.

Plan Domain Updates

Review installed releases, dependency compatibility, and issuer changes before approving a grouped domain installation.

Configure Local UI Projects

Initialize React and Tailwind CSS projects, search available patterns, and review source changes before adding components.

Diese Prompts ausprobieren

Check Connection and Identity

Use astrale-cli to explain read-only connection and identity checks for staging. Do not print tokens or change configuration.

Prepare a Paginated Graph Query

Prepare a bounded query for /:notes.example:class.Note on staging using identity reader. Explain cursor pagination without running mutations.

Review a Mutation Before Execution

Review mutation.v3.json and prepare an Astrale mutation dry run. Explain preconditions and atomicity; require approval before execution.

Plan an Authorized Domain Upgrade

Plan a grouped domain upgrade on staging. Review release pins, compatibility, and issuer consent using an authorized identity; require approval before installation.

Bewährte Praktiken

Select the instance and least-privileged identity explicitly, and verify current command help before remote operations.
Review dry runs and release pins; approve mutations, issuer changes, root recovery, and destructive uninstalls explicitly.
Prefer identity selection over bearer arguments; keep secret payloads in protected files or stdin, and redact shared diagnostics.

Vermeiden

Relying on an ambient active instance or root identity for unattended production changes.
Placing bearer credentials or secret payloads in command arguments, logs, or issue reports.
Treating partial domain inventory or authorization-masked reads as proof that data is missing.

Häufig gestellte Fragen

What does this skill provide?

It provides an Astrale CLI reference for assistants. It does not include the CLI binary or verify its implementation.

Which assistants can use it?

The marketplace lists Claude, Codex, and Claude Code. Executing commands also requires a local CLI installation and authorized credentials.

Can it deploy domains?

No. The CLI connects to existing Kernels and installs published releases. Building, deploying, and publishing use the separate astrale-domain binary.

Can I inspect changes without applying them?

Mutations support --dry, while calls and UI additions support --dry-run. These previews do not replace permission checks during execution.

How should I handle credentials?

Prefer identity selection. Bearer arguments can expose tokens; use protected files or stdin for secret call payloads and avoid logging credentials.

Why is a domain absent from the installed list?

The list omits built-in, local, and unreadable domains. An absent origin does not prove that the domain is not installed.

Entwicklerdetails

Autor

astrale-os

Lizenz

MIT

Skillstore-Revision

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/astrale-os/cli/tree/db2fc39650aa2fbd37e8439804d5e627ac83bcb0/skills/astrale-cli

Ref.

e406bf64b5db6e514879399e87b346fa7ff7c2fb

Aktualität der Wartung

11.10.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📄 SKILL.md