Fähigkeiten setup-template
📦

setup-template

Inhaltsrevision r1 Hohes Risiko ⚙️ Externe Befehle🌐 Netzwerkzugriff📁 Dateisystemzugriff🔑 Umgebungsvariablen

Align TypeScript Repositories with Their Template

Template-derived repositories can retain missing GitHub settings and incomplete migration work even when builds pass. This skill guides repository setup and evidence-based comparisons against the template.

Unterstützt: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 Schlecht

Mit meinem Agent installieren

Kopieren Sie diese Anfrage in Ihren Agent. Sie enthält die maßgebliche Skill-Seite und das Manifest.

Agent-Anfrage
Review the Skillstore skill "setup-template" from https://skillstore.io/skills/masseater-setup-template.md and its manifest at https://skillstore.io/api/skills/masseater-setup-template/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Ihr Agent sollte weiterhin seinen Plan anzeigen und alle von der Sicherheitsrichtlinie verlangten Bestätigungen anfordern.

Agent-lesbare Ressourcen

Verwenden Sie diese Links, wenn ein KI-Agent, Crawler oder Skript sauberen Kontext benötigt, statt die vollständige Seite zu lesen.

Markdown-Detailseite GET /skills/masseater-setup-template.md Signiertes manifest GET /api/skills/masseater-setup-template/manifest Signiertes lockfile GET /api/skills/masseater-setup-template/lockfile

Testen

„setup-template“ wird verwendet. Illustrative assessment with a missing hook and an unsuccessful verification task.

Erwartetes Ergebnis:

  • Migration status: incomplete.
  • Git hooks: incomplete. The configured hook directory does not match the expected template location.
  • Verification: incomplete. The verification task failed; include the actual task output as evidence.
  • Next steps: correct the hook configuration and investigate the failed task before repeating the assessment.

„setup-template“ wird verwendet. Illustrative setup review where an existing ruleset requires tests before merging.

Erwartetes Ergebnis:

  • Existing protection: tests must pass before merging.
  • Template difference: the proposed ruleset requires only the up-to-date check.
  • Decision needed: preserve the existing test requirement rather than replacing it with weaker protection.
  • No settings changed.

Sicherheitsaudit

Hohes Risiko
v1 • 24.10.2026 Versionsbericht öffnen

Most static alerts are false positives from Markdown, Japanese text, or expected GitHub operations; installation and verification execute repository-controlled code. Check mode also applies remote configuration despite the stated inspection-only boundary. The prescribed ruleset replacement can remove stronger protections, while the template criteria place verification after merging rather than before.

4
Gescannte Dateien
244
Analysierte Zeilen
1
Prüfelemente
0
Falschmeldungen ignoriert

Bestätigte Sicherheitsbedenken (2)

Hoch
usecases/setup.md:47-58usecases/setup.md:65-74references/typescript-template.md:79-83
Template Alignment Can Weaken Pre-Merge Protections
Setup replaces a same-named ruleset with deletion, force-push, and up-to-date protections only. The reference requires verification after main pushes and treats PR verification as obsolete, potentially removing stronger checks and allowing unverified changes onto main.
The replacement payload lists only freshness as a required status check, and the reference explicitly excludes PR verification. Existing stronger protections are not preserved.
Mittel
SKILL.md:17usecases/check.md:9usecases/setup.md:9-42
Inspection Mode Applies Remote Configuration Changes
SKILL.md says inspection must not repair issues, but check step 5 directs the agent to apply the setup procedure. That procedure registers secrets and changes Actions permissions, merge settings, and branch rulesets, creating remote side effects during a requested assessment.
The check procedure explicitly directs configuration alignment, contradicting the stated inspection-only boundary. The referenced setup commands perform authenticated remote writes.
Elemente der Fähigkeitsprüfung (1)

Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.

Mittel
SKILL.md:43
Ruby/shell backtick execution
- `vp install` と `vp run verify` を実行する。verify が落ちたら、落ちたタスクとその出力を最初の欠けとして扱う
Although the backticks are Markdown, the prose explicitly directs execution of vp install and vp run verify. Repository-controlled scripts can run with agent privileges without a preceding trust review.

Risikofaktoren

⚙️ Externe Befehle (8)
SKILL.md:8 SKILL.md:10 SKILL.md:30 SKILL.md:43 SKILL.md:51 SKILL.md:52 usecases/setup.md:57 usecases/setup.md:58
🌐 Netzwerkzugriff (1)
SKILL.md:8
📁 Dateisystemzugriff (1)
usecases/check.md:7
🔑 Umgebungsvariablen (2)
usecases/setup.md:14 usecases/setup.md:22
Geprüft von: codex
Diesen Bericht teilen & zitieren

Teile den versionierten Bewertungsbericht, das neutrale Badge, die Einbettungskarte und Zitate. Skillstore berichtet Nachweise, ohne zu entscheiden, ob dieser Skill sicher ist.

Versionsbericht öffnen
Sicherheitsbewertung

Berichtslink kopieren

https://skillstore.io/skills/masseater-setup-template/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown-Badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/masseater-setup-template/security.svg)](https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge)

HTML-Badge

<a href="https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/masseater-setup-template/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Einbettungskarte

<iframe src="https://skillstore.io/embed/skills/masseater-setup-template.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Wissenschaftliche Zitate (APA · BibTeX · CFF)

APA-Zitat

masseater. (2026). setup-template security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/masseater-setup-template/audits/1

BibTeX-Zitat

@techreport{masseater-masseater-setup-template-2026, author = {masseater}, title = {setup-template security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/masseater-setup-template/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "setup-template security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "masseater" date-released: "2026-10-24" url: "https://skillstore.io/skills/masseater-setup-template/audits/1" identifiers: - type: other value: "skillstore:masseater-setup-template:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore-Score

Warum dieser Score Evidenzvertrauen: Mittel
41
Architektur
85
Wartbarkeit
87
Inhalt
65
Gemeinschaft
83
Spezifikationskonformität

Was Sie erstellen können

Initialize a Template-Derived Repository

Configure repository automation, deployment identifiers, secret names, and branch settings after creating a repository from the template.

Assess an AI-Assisted Migration

Compare the migrated repository with template elements and collect evidence for missing hooks, ineffective checks, and leftover configuration.

Review Automation Configuration

Compare GitHub settings and CI behavior with template expectations while identifying differences that require explicit policy decisions.

Diese Prompts ausprobieren

Review Setup Requirements 
List the setup steps for this template-derived repository. Identify required tools, permissions, and secret names without changing files or GitHub settings.
Configure an Approved Repository 
Prepare setup for [owner/repository]. Show proposed changes and existing protections first. Request approval before writes and use interactive secret entry.
Assess Migration Completeness 
Assess this migration against the template. Override setup-in-check behavior: report differences without repairs. Request approval before installation or verification, then provide evidence.
Compare Template and Security Policy 
Compare [owner/repository] with the template and our policy: [requirements]. Identify weaker rules, missing verification, and unsupported exceptions. Propose changes without applying them.

Bewährte Praktiken

  • Confirm the target repository and review existing permissions and rulesets before approving setup changes.
  • Enter credentials through secure interactive prompts, and review repository scripts before running installation or verification.
  • Preserve stronger organizational protections and retain command evidence for every migration judgment.

Vermeiden

  • Treating the default check workflow as read-only despite its setup step.
  • Replacing stronger branch protections solely to match the template.
  • Declaring migration complete because builds pass without checking hooks, automation, and obsolete configuration.

Häufig gestellte Fragen

Which repositories does this skill target?
It targets repositories derived from masseater/typescript-template. Other repositories require confirmation of applicable steps before work begins.
What tools and permissions are needed?
GitHub CLI authentication and sufficient repository permissions are needed for setup. Local checks also use Vite+ and project-specific tooling.
Does check mode change anything?
Yes. It runs installation and verification and directs GitHub setup. Explicitly prohibit remote writes when requesting an assessment only.
How should I provide secrets?
Use GitHub CLI interactive prompts or approved secret management. Avoid placing secret values in chat, reports, or committed files.
Does template alignment guarantee secure branch protection?
No. The prescribed model relies on freshness checks before merging and verification afterward. Preserve stronger requirements from your organizational policy.
Are newer template features automatically migration defects?
No. The skill separates later template additions from missing migration elements and requires reasons for elements that do not apply.

Entwicklerdetails

Autor

masseater

Lizenz

MIT

Skillstore-Revision

r1

Versionshinweis

Der Autor hat keine Version angegeben.

Repository

https://github.com/masseater/skills/tree/4810c8f1186a229ca57d2f278c0a94f0fc862fec/skills/setup-template

Ref.

965badf91ae3b8f9a49183f5a56d91de6efc51ad

Aktualität der Wartung

24.10.2026

Nutzung

0 Downloads · 0 Aufrufe

Dateistruktur

📁 references/

📄 typescript-template.md

📄 SKILL.md

📁 usecases/

📄 check.md

📄 setup.md

Mehr von masseater

Alle anzeigen

Ähnliche Skills

Alle anzeigen