Fähigkeiten caveman-discover
📦

caveman-discover

Inhaltsrevision r1 Mittleres Risiko ⚙️ Externe Befehle

Label LLM Workflows for Caveman Cloud

Unlabeled LLM traffic hides which jobs create spend. This skill discovers repository workflows, proposes durable labels, applies approved changes, and verifies attribution.

UnterstĂĽtzt: Claude Codex Code(CC)
đź“Š 70 Angemessen

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage
Review the Skillstore skill "caveman-discover" from https://skillstore.io/skills/juliusbrussee-caveman-discover.md and its manifest at https://skillstore.io/api/skills/juliusbrussee-caveman-discover/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/juliusbrussee-caveman-discover.md Signiertes manifest GET /api/skills/juliusbrussee-caveman-discover/manifest Signiertes lockfile GET /api/skills/juliusbrussee-caveman-discover/lockfile

Testen

„caveman-discover“ wird verwendet. Discover workflows in a service with a support endpoint and nightly summary job.

Erwartetes Ergebnis:

  • support-reply: answers inbound support tickets from the reply handler.
  • nightly-digest: creates the scheduled summary from the digest job.
  • Approval required before applying either label.

„caveman-discover“ wird verwendet. Report results after labeling one routed workflow and finding one direct provider call.

Erwartetes Ergebnis:

Labeled support-reply and verified its request succeeded. The direct evaluation call remains not wired because it bypasses the Caveman gateway.

„caveman-discover“ wird verwendet. Handle an unclear evaluation script during discovery.

Erwartetes Ergebnis:

Proposed eval-suite with review status because its purpose was inferred from the filename. No edit was applied pending confirmation.

Sicherheitsaudit

Mittleres Risiko
v1 • 12.8.2026 Versionsbericht öffnen

All 26 static findings are false positives caused by Markdown backticks, fenced examples, and inline technical identifiers in SKILL.md. The skill does direct approved code changes and repository-native command execution, creating a moderate operational risk when used on untrusted projects.

1
Gescannte Dateien
119
Analysierte Zeilen
0
PrĂĽfelemente
0
Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (1)

Mittel
SKILL.md:92-93
Untrusted Repository Command Execution
The skill directs the agent to run a repository test, development script, or curl command, which may execute project-controlled behavior.
Lines 92-93 explicitly require exercising a labeled path with repository tooling or curl. The command is unspecified and therefore may inherit untrusted side effects.

Risikofaktoren

⚙️ Externe Befehle (25)
SKILL.md:16 SKILL.md:23 SKILL.md:36 SKILL.md:42 SKILL.md:47 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:53 SKILL.md:57 SKILL.md:63-69 SKILL.md:69-73 SKILL.md:73-74 SKILL.md:74-76 SKILL.md:76 SKILL.md:77 SKILL.md:78-81 SKILL.md:81 SKILL.md:82-83 SKILL.md:83-94 SKILL.md:94-95 SKILL.md:95-101 SKILL.md:101-111 SKILL.md:111-114 SKILL.md:114-117
GeprĂĽft von: codex
Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen
Sicherheitsbewertung

Berichtslink kopieren

https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/juliusbrussee-caveman-discover/security.svg)](https://skillstore.io/skills/juliusbrussee-caveman-discover?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/juliusbrussee-caveman-discover?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/juliusbrussee-caveman-discover/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/juliusbrussee-caveman-discover.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

juliusbrussee. (2026). caveman-discover security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1

BibTeX-Zitat

@techreport{juliusbrussee-juliusbrussee-caveman-discover-2026, author = {juliusbrussee}, title = {caveman-discover security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "caveman-discover security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "juliusbrussee" date-released: "2026-08-12" url: "https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1" identifiers: - type: other value: "skillstore:juliusbrussee-caveman-discover:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel
55
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
91
Spezifikationskonformität

Was Sie erstellen können

Attribute Product AI Spend

Separate support, onboarding, and reporting costs by the product job that generated each request.

Label Scheduled Automation

Identify cron jobs, queue workers, and CI tasks that consume LLM tokens and assign stable labels.

Audit Agent Workflows

Map graphs, agents, chains, and evaluation suites into distinct workflows before reviewing their spend.

Diese Prompts ausprobieren

Discover Workflows 
Discover LLM workflows in this repository. Present the proposed workflow table, but do not edit files yet.
Review Workflow Names 
Review the proposed workflow labels for valid syntax, clear job names, and uncertain purposes. Mark uncertain labels for review.
Apply Approved Labels 
Apply the approved workflow labels with minimal changes. Label callers, preserve repository style, and list calls without Caveman gateway routing.
Verify and Report 
Verify one labeled path using the repository's existing method. Report observed results, dashboard timing, unlabeled traffic, and unresolved workflow names.

Bewährte Praktiken

  • Review and approve the workflow table before any repository files change.
  • Name each human-recognizable job instead of its provider, model, or shared helper.
  • Inspect verification commands and referenced scripts before running them.

Vermeiden

  • Do not label a shared LLM helper when several distinct jobs call it.
  • Do not invent a workflow purpose when repository evidence is unclear.
  • Do not claim dashboard verification before the labeled workflow actually runs.

Häufig gestellte Fragen

Does this skill configure the Caveman gateway?
No. The repository must already route LLM requests through the Caveman gateway.
Will it modify code without approval?
No. It presents a workflow table and waits for user approval before applying changes.
Which LLM entry points can it inspect?
It covers handlers, scheduled jobs, workers, scripts, evaluations, agents, chains, and raw HTTP calls.
How are workflow names chosen?
Names describe stable human-recognizable jobs and follow the gateway's lowercase slug rules.
What happens when a workflow purpose is unclear?
The skill derives a tentative slug from the filename and marks it for review.
When do labels appear in Caveman Cloud?
Each label appears after its workflow next runs and sends traffic through the gateway.

Entwicklerdetails

Lizenz

MIT

Skillstore-Revision

r1

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/juliusbrussee/caveman/tree/a0109974ea3258a14aadaef1ed1f8ff2837d30d5/skills/caveman-discover

Ref.

95244ee20a58fc3ea629a87b9e746dbc45854aa0

Aktualität der Wartung

13.8.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

đź“„ SKILL.md