Fähigkeiten project-checklist

📦

project-checklist

Name: project-checklist
Author: masseater

Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle📁 Dateisystemzugriff🔑 Umgebungsvariablen

Review Project Readiness With Evidence

Passing builds can hide missing design decisions and operational safeguards. This skill guides evidence-based project reviews and checks TypeScript template migrations and GitHub configuration.

Unterstützt: Claude Codex Code(CC)

⚠️ 38 Schlecht

Maintain this Skill? Claim it ⚠️ 38 Schlecht

Vor der Installation anhalten und eine Bestätigung anfordern.

Prüfen Sie den Plan und holen Sie vor Änderungen an Dateien die ausdrückliche Zustimmung des Benutzers ein.

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage

Review the Skillstore skill "project-checklist" from https://skillstore.io/skills/masseater-project-checklist.md and its manifest at https://skillstore.io/api/skills/masseater-project-checklist/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/masseater-project-checklist.md Signiertes manifest GET /api/skills/masseater-project-checklist/manifest Signiertes lockfile GET /api/skills/masseater-project-checklist/lockfile

Testen

„project-checklist“ wird verwendet. Review a repository that has no production deployment.

Erwartetes Ergebnis:

Requirements: satisfied. The project documentation identifies intended users and supported tasks.
Production performance: unverified. No production URL is available.
Deficiencies and unverified items: collect production measurements after deployment.

„project-checklist“ wird verwendet. Assess a template migration without applying fixes.

Erwartetes Ergebnis:

Verification entry point: satisfied. The repository provides a shared verification command.
Hook integration: deficient. The configured hook directory does not match the installed hooks.
GitHub settings: unverified. Administrative API access is unavailable.
No configuration changes applied.

Sicherheitsaudit

Hohes Risiko

v1 • 1.11.2026 Versionsbericht öffnen

All 44 static findings are false positives involving Markdown formatting, readable Japanese text, example configuration, or legitimate GitHub commands. Two semantic risks remain: repository changes during assessment and guidance that omits pre-merge verification. No evidence found of credential exfiltration, obfuscated payloads, or prompt injection.

Gescannte Dateien

434

Analysierte Zeilen

Prüfelemente

Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch

references/typescript-template.md:86-88 usecases/setup.md:65-74

Template Criteria Omit Pre-Merge Verification

Template criteria require verify only on main pushes or manual runs and treat pull-request verification as obsolete. Setup requires only the up-to-date status check. Changes can therefore reach the default branch before tests and security checks run, even when deployment remains gated.

The criteria explicitly exclude PR verification and assume no per-PR review. The shown ruleset requires only up-to-date, not successful verification before merge.

Mittel

SKILL.md:11 usecases/check.md:18 usecases/setup.md:29-47 usecases/setup.md:57-78

Assessment Workflow Changes Repository Configuration

The check workflow instructs execution of setup during assessment, despite the assessment-only rule. Setup uploads secrets, changes Actions permissions, enables auto-merge, and replaces a named ruleset without a separate approval step. This can change repository security controls during a requested review.

The check workflow explicitly requires setup through its confirmation stage. Setup contains mutating GitHub API calls and ruleset replacement, with no separate approval requirement.

Risikofaktoren

⚙️ Externe Befehle (21)

📁 Dateisystemzugriff (1)

usecases/check.md:16

🔑 Umgebungsvariablen (2)

usecases/setup.md:14 usecases/setup.md:22

Geprüft von: codex

Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen

Berichtslink kopieren

https://skillstore.io/skills/masseater-project-checklist/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/masseater-project-checklist/security.svg)](https://skillstore.io/skills/masseater-project-checklist?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/masseater-project-checklist?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/masseater-project-checklist/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/masseater-project-checklist.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

masseater. (2026). project-checklist security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/masseater-project-checklist/audits/1

BibTeX-Zitat

@techreport{masseater-masseater-project-checklist-2026,
  author = {masseater},
  title = {project-checklist security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/masseater-project-checklist/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "project-checklist security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "masseater"
date-released: "2026-11-01"
url: "https://skillstore.io/skills/masseater-project-checklist/audits/1"
identifiers:
  - type: other
    value: "skillstore:masseater-project-checklist:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel

Architektur

Wartbarkeit

Inhalt

Gemeinschaft

Spezifikationskonformität

Was Sie erstellen können

Assess Release Readiness

Review access controls, deployment paths, monitoring, recovery, and production evidence before a release.

Review Template Migration Completeness

Compare a migrated repository against template components and identify missing hooks, disconnected checks, or obsolete configuration.

Evaluate Existing Project Decisions

Collect evidence for cost, privacy, performance, accessibility, and published resources when planning a substantial project change.

Diese Prompts ausprobieren

Start a Repository Review

Review this repository with project-checklist. Keep the assessment read-only. List deficiencies and unverified items, and cite evidence for each judgment.

Assess Without Production Access

Review this project using repository files and build outputs only. Mark production-dependent items unverified and explain the missing evidence. Do not change settings.

Audit a Template Migration

Compare this repository with the masseater TypeScript template. Check installation, functioning integration, and obsolete configuration. Report differences before running commands or applying setup changes.

Plan Controlled GitHub Setup

Prepare a GitHub setup plan for the selected repository. Preserve existing protections and require pre-merge verification. Show proposed changes and await approval before executing mutations.

Bewährte Praktiken

Specify the target repository, authorized production URLs, and read-only boundaries before starting.
Require observed evidence for each judgment and keep unavailable checks explicitly unverified.
Approve setup separately, enter secrets outside chat, and preserve existing review and pre-merge security checks.

Vermeiden

Treating written configuration or passing builds as proof that production safeguards work.
Allowing a checklist review to replace branch protections or change secrets without explicit approval.
Removing pre-merge verification or weakening checks merely to match template preferences.

Häufig gestellte Fragen

Which AI tools are supported?

The skill supports Claude, Codex, and Claude Code. Command execution also requires the relevant local tools and permissions.

What does a review produce?

It produces a table of areas, items, current conditions, judgments, and evidence. Separate lists identify deficient and unverified items.

Can I use it without production access?

Yes. Repository and build checks remain possible, but production-dependent checks must be marked unverified.

Does the assessment change my repository?

The main instructions prohibit assessment-time fixes, but the template check invokes setup changes. Request read-only operation and approve setup separately.

How are credentials handled?

Setup uses GitHub CLI to store user-provided repository secrets. Enter values through the CLI rather than sharing them in chat.

Does the checklist certify security?

No. It guides evidence collection rather than certification. Review its GitHub mutations and post-merge verification guidance before adopting template settings.