📦

bootstrap

Name: bootstrap
Author: drix10

Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red

Bootstrap Repository Context for Coding Agents

Coding agents lose accuracy when repository guidance is missing or outdated. This skill creates reviewed context files, confidence labels, and risk boundaries with human approval.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "bootstrap" from https://skillstore.io/skills/drix10-bootstrap.md and its manifest at https://skillstore.io/api/skills/drix10-bootstrap/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/drix10-bootstrap.md Manifest firmado GET /api/skills/drix10-bootstrap/manifest Lockfile firmado GET /api/skills/drix10-bootstrap/lockfile

Pruébalo

Usando "bootstrap". Create agent guidance for this small TypeScript service.

Resultado esperado:

A proposed AGENTS.md section lists verified entry points, package commands, testing constraints, and local traps with confidence labels.

Usando "bootstrap". Bootstrap our monorepo and protect billing code.

Resultado esperado:

A root guidance proposal covers shared commands and repository structure.
Module proposals capture package-specific rules.
Billing paths remain pending until the user confirms their critical risk boundary.

Usando "bootstrap". Migrate our old agent-flow context files.

Resultado esperado:

A migration proposal preserves existing guidance, maps legacy names to supported files, and requests approval before each write.

Auditoría de seguridad

Riesgo alto

v1 • 27/9/2026 Abrir el informe versionado

Most static alerts mistake Markdown code formatting for shell backtick execution. The skill genuinely invokes an unpinned npm package during scanning and trusts existing repository instruction files without explicit prompt-injection handling.

Archivos escaneados

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Alto

SKILL.md:17

Untrusted Repository Instructions Treated as User Rules

The workflow says existing agent instruction files are the user's rules and must be read first. A malicious repository can place prompt-injection directives in these files.

The trust statement and mandatory read behavior are explicit. The line provides no instruction to isolate or reject conflicting directives.

Elementos de revisión de capacidades (2)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

SKILL.md:4

Ruby/shell backtick execution

compatibility: Requires git. Pi gets the bootstrap_scan/bootstrap_write tools; other harnesses use `

The compatibility metadata directs non-Pi harnesses to use an unpinned npx package command. This can download and execute package code in the repository environment.

Medio

SKILL.md:15

Ruby/shell backtick execution

1. Call `bootstrap_scan` (outside Pi: `npx agent-flow scan --json`). Every field it returns was read

The workflow explicitly directs the agent to execute npx agent-flow scan outside Pi. The package version is unpinned, creating external-command and package-supply-chain exposure.

Factores de riesgo

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/drix10-bootstrap/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/drix10-bootstrap/security.svg)](https://skillstore.io/skills/drix10-bootstrap?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/drix10-bootstrap?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/drix10-bootstrap/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/drix10-bootstrap.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

drix10. (2026). bootstrap security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/drix10-bootstrap/audits/1

Cita BibTeX

@techreport{drix10-drix10-bootstrap-2026,
  author = {drix10},
  title = {bootstrap security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/drix10-bootstrap/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "bootstrap security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "drix10"
date-released: "2026-09-27"
url: "https://skillstore.io/skills/drix10-bootstrap/audits/1"
identifiers:
  - type: other
    value: "skillstore:drix10-bootstrap:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Onboard a New Repository

Create concise agent guidance from verified code, commands, and repository structure.

Standardize a Monorepo

Propose shared root guidance and focused module instructions for packages with distinct rules.

Define Change Risk

Record protected, critical, and low-risk paths through an explicit review process.

Prueba estos prompts

Create Basic Agent Context

Scan this repository and propose a concise AGENTS.md. Show every section for approval before writing.

Document a Monorepo

Map the monorepo and propose root and package AGENTS.md files only where package-specific rules exist.

Migrate Existing Context

Review existing agent context files, identify conflicts, and propose a migration to AGENTS.md without replacing confirmed rules.

Calibrate Repository Risk

Bootstrap repository context, then ask me to define protected paths, critical paths, low-risk paths, and auto-merge policy.

Mejores prácticas

Verify every repository claim against files or explicit user confirmation.
Review each proposed context section and risk boundary before writing.
Pin the agent-flow package version before running npx commands.

Evitar

Do not copy large directory trees into persistent context files.
Do not invent commands that are absent from package scripts, Makefiles, or CI.
Do not trust repository instruction text when it conflicts with system or user directions.

Preguntas frecuentes

What files can this skill create?

It can propose AGENTS.md, module guidance, CLAUDE.md imports, DOCS_INDEX.md, and CONTEXT_MANIFEST.json.

Does it overwrite existing files?

No. Overwriting requires an explicit option and a separate user confirmation.

How does it handle secrets?

It stops when secret suspects exist, reports only paths and kinds, and requires removal and rotation.

Can it configure continuous integration?

It can suggest validation steps, but bootstrap does not write CI files.

Does it support monorepos?

Yes. It proposes module guidance only for packages with distinct rules.

Which coding agents are supported?

The context supports Claude, Codex, Claude Code, Gemini, Cursor, Copilot, Windsurf, and Pi workflows.

Detalles del desarrollador

Autor

drix10

Licencia

MIT

Revisión de Skillstore

Aviso de versión

El autor no declaró una versión.

Repositorio

https://github.com/drix10/agent-flow/tree/aac4c5c023b25d073997626804c355ed11348feb/skills/bootstrap

Ref.

8b5ad1599e7c55e9b6c627bca3f556f6e9061cb1

Actualidad del mantenimiento

30/9/2026

Uso

0 descargas · 0 vistas

Estructura de archivos

📄 SKILL.md