스킬 building-chat-widgets

📦

building-chat-widgets

Name: building-chat-widgets
Author: Asmayaseen

콘텐츠 리비전 r2 높은 위험 ⚡ 스크립트 포함⚙️ 외부 명령어🌐 네트워크 접근

Crear widgets de chat interactivos

El chat solo de texto no puede admitir flujos de trabajo de tareas enriquecidos. Esta skill ayuda a los equipos a diseñar widgets interactivos, acciones, etiquetado de entidades y manejadores de servidor.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "building-chat-widgets" from https://skillstore.io/skills/asmayaseen-building-chat-widgets.md and its manifest at https://skillstore.io/api/skills/asmayaseen-building-chat-widgets/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/asmayaseen-building-chat-widgets.md 서명된 manifest GET /api/skills/asmayaseen-building-chat-widgets/manifest 서명된 lockfile GET /api/skills/asmayaseen-building-chat-widgets/lockfile

테스트해 보기

"building-chat-widgets" 사용 중입니다. Un equipo de producto necesita un widget de estado de pedido con botones.

예상 결과:

Un plan de widget con campos de pedido, etiquetas de estado y nombres de acciones.
Responsabilidades de acciones del cliente para ver detalles y solicitar más actualizaciones.
Responsabilidades de acciones de servidor para confirmar cambios y reemplazar el widget.

"building-chat-widgets" 사용 중입니다. Un ingeniero backend necesita comportamiento de envío de formulario.

예상 결과:

Un flujo de trabajo de servidor que valida campos de payload, procesa el formulario, reemplaza el widget y envía una respuesta clara del asistente.

"building-chat-widgets" 사용 중입니다. Un equipo quiere menciones para personas y artículos en el chat.

예상 결과:

Un plan de etiquetado de entidades con comportamiento de búsqueda, campos de visualización, manejo de clics y orientación para conversión segura de contexto.

보안 감사

높은 위험

v9 • 2026. 7. 23. 버전별 보고서 열기

All static alerts are false positives from Markdown syntax, Python imports, ordinary payload fields, or a same-origin request. Three semantic risks remain: hidden context injection, an unauthorized database mutation pattern, and raw exception disclosure.

스캔된 파일

839

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (3)

높음

references/server-action-handler.md:42-60

Untrusted Data Added to Hidden Agent Context

A client-provided action identifier is inserted into HiddenContextItem without validation or escaping. Crafted delimiters or instructions could influence future model input.

The example directly interpolates action.payload data into hidden model context. No allowlist, type validation, or delimiter escaping is shown.

높음

references/server-action-handler.md:105-110

Database Mutation Lacks Authorization Check

The confirmation handler trusts a client-provided item identifier and mutates the database without checking ownership or permission. This pattern can enable unauthorized changes.

The complete handler calls confirm_item with an action payload identifier and shows no authorization or record ownership check.

중간

references/server-action-handler.md:206-216

Raw Exception Details Exposed to Users

The error handler returns str(e) in an assistant message. Exceptions may reveal internal implementation details, identifiers, paths, or sensitive service responses.

The catch-all handler directly embeds the exception string in user-visible content. The disclosure path is explicit in the example.

위험 요인

⚡ 스크립트 포함 (2)

references/server-action-handler.md:9-20 SKILL.md:152-155

⚙️ 외부 명령어 (47)

🌐 네트워크 접근 (1)

SKILL.md:203

감사자: codex 감사 이력 보기 →

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/asmayaseen-building-chat-widgets/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/asmayaseen-building-chat-widgets/security.svg)](https://skillstore.io/skills/asmayaseen-building-chat-widgets?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/asmayaseen-building-chat-widgets?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/asmayaseen-building-chat-widgets/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/asmayaseen-building-chat-widgets.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

Asmayaseen. (2026). building-chat-widgets security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/asmayaseen-building-chat-widgets/audits/9

BibTeX 인용

@techreport{asmayaseen-asmayaseen-building-chat-widgets-2026,
  author = {Asmayaseen},
  title = {building-chat-widgets security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/asmayaseen-building-chat-widgets/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "building-chat-widgets security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "Asmayaseen"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/asmayaseen-building-chat-widgets/audits/9"
identifiers:
  - type: other
    value: "skillstore:asmayaseen-building-chat-widgets:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Diseñar flujos de trabajo de producto

Crear widgets de chat para aprobaciones, listas de tareas, opciones de productos o decisiones guiadas.

Conectar acciones frontend

Asignar botones de widgets a navegación, cambios de estado local y mensajes de chat de seguimiento.

Implementar manejadores backend

Planificar acciones de servidor que actualicen datos, reemplacen widgets y transmitan respuestas del asistente.

이 프롬프트를 사용해 보세요

Crear un plan básico de widget

Crea un plan de widget de chat para [task]. Incluye tipo de widget, campos visibles, botones y nombres de acciones del cliente.

Agregar acciones del cliente

Diseña acciones manejadas por el cliente para este widget: [describe widget]. Incluye campos de payload, actualizaciones de UI y comportamiento de navegación.

Implementar acciones de servidor

Crea un diseño de acción de servidor para [workflow]. Incluye validación, cambios de estado, reemplazo de widgets y comportamiento de respuesta de cara al usuario.

Auditar un flujo de widget

Revisa este flujo de trabajo de widget de chat para preparación de producción: [paste summary]. Comprueba la validación de payload, autorización, manejo de entidades y comportamiento de fallback.

모범 사례

Valida los campos de payload y la autorización antes de que cualquier acción de servidor cambie el estado.
Mantén las acciones solo de cliente enfocadas en la navegación o en cambios locales de UI.
Escapa los metadatos de entidades antes de insertarlos en contexto legible por el modelo.

피하기

No manejes la misma acción tanto en el cliente como en el servidor.
No confíes en los valores de payload de acciones sin comprobaciones de propiedad.
No expongas errores de validación sin procesar ni detalles de stack a los usuarios finales.