Habilidades captain-obvious

📦

captain-obvious

Name: captain-obvious
Author: shmulc8

Revisión del contenido r1 Riesgo medio 📁 Acceso al sistema de archivos⚙️ Comandos externos⚡ Contiene scripts🌐 Acceso a red

Audit TypeScript and Python Test Quality

Redundant assertions can inflate confidence without protecting observable behavior. Captain Obvious combines deterministic scanners with contextual review and a test-authoring contract checklist.

Compatible con: Claude Codex Code(CC)

⚠️ 50 Deficiente

Maintain this Skill? Claim it ⚠️ 50 Deficiente

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "captain-obvious" from https://skillstore.io/skills/shmulc8-captain-obvious.md and its manifest at https://skillstore.io/api/skills/shmulc8-captain-obvious/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/shmulc8-captain-obvious.md Manifest firmado GET /api/skills/shmulc8-captain-obvious/manifest Lockfile firmado GET /api/skills/shmulc8-captain-obvious/lockfile

Pruébalo

Usando "captain-obvious". Review a Python test that assigns a local value of five and immediately checks that it equals five.

Resultado esperado:

Finding: local constant echo.
Reason: the assertion repeats the test arrangement and does not inspect production behavior.
Next step: identify the intended contract before replacing or removing the test.

Usando "captain-obvious". Review a TypeScript promise rejection assertion that is not awaited.

Resultado esperado:

Finding: advisory asynchronous assertion.
Reason: failure behavior depends on the test runner, and the assertion is not awaited.
Proposal: await the assertion, then run the focused test after approval.

Usando "captain-obvious". Review a conditional assertion when coverage shows that its line never executed.

Resultado esperado:

Finding: conditional assertion promoted to proven by coverage.
Reason: the supplied coverage report records zero executions for the assertion line.
Proposal: investigate the guard and preserve the intended contract. Do not automatically delete this report-only finding.

Auditoría de seguridad

Riesgo medio

v1 • 21/10/2026 Abrir el informe versionado

Most static alerts are false positives involving documentation, template literals, AST identifiers, or legitimate toolchain operations. Confirmed risks involve shadow-file overwrite and deletion, plus symlink-following report writes to documented predictable temporary paths. The fix guards also permit irreversible changes to untracked tests; no evidence found of credential exfiltration or prompt injection.

Archivos escaneados

3,933

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (1)

Medio

scripts/co_py/gitguard.py:24-32 scripts/co_ts/gitguard.mjs:23-30 scripts/co_py/fixer.py:155-156 scripts/co_ts/fixer.mjs:88-92

Untracked Tests Bypass Recovery Safeguards

Both Git guards use --untracked-files=no, but test discovery includes untracked files. --fix can overwrite those tests without backups or Git restoration.

Both guards explicitly exclude untracked files, while discovery and fixers do not restrict edits to tracked targets. Neither fixer creates recovery backups.

Elementos de revisión de capacidades (7)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Medio

scripts/captain_obvious_py.py:285

Python file write/append

with open(args.json, "w") as fh:

The report writer truncates its destination and follows symlinks. The documented predictable /tmp destination permits another local actor to redirect this write.

Medio

scripts/captain_obvious_ts.mjs:245

Node.js fs operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

writeFileSync follows symlinks and truncates existing destinations. Combined with the documented predictable /tmp path, this allows local report-write redirection.

Medio

scripts/captain_obvious_ts.mjs:245

Synchronous file operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

The report write follows existing symlinks and truncates their targets. The documented fixed /tmp output path makes this a local overwrite risk.

Medio

scripts/co_py/mypy_pass.py:167

Python file write/append

with open(shadow, "w", encoding="utf-8") as f:

The predictable shadow path is opened with truncation after only a symlink check. Existing regular files or hard-linked targets can be overwritten during scanning.

Medio

scripts/co_py/mypy_pass.py:271

Python os file operations

os.remove(s)

Cleanup removes every recorded shadow path, including paths that existed before the scan and were truncated. Existing file contents are lost without recovery.

Medio

SKILL.md:72

Temp directory access

node <skill-dir>/scripts/captain_obvious_ts.mjs --project <repo> --json /tmp/co-ts.json

The documented command writes to predictable /tmp/co-ts.json. An existing symlink can redirect the truncating report write to another writable file.

Medio

SKILL.md:73

Temp directory access

python3 <skill-dir>/scripts/captain_obvious_py.py --path <repo> --json /tmp/co-py.json

The documented command writes to predictable /tmp/co-py.json. An existing symlink can redirect Python's truncating report write to another writable file.

Factores de riesgo

📁 Acceso al sistema de archivos (43)

⚙️ Comandos externos (50)

⚡ Contiene scripts (3)

scripts/captain_obvious_ts.mjs:78 scripts/captain_obvious_ts.mjs:80 scripts/co_py/analyzer.py:7-19

🌐 Acceso a red (1)

scripts/co_py/analyzer.py:570

Auditado por: codex

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/shmulc8-captain-obvious/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg)](https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/shmulc8-captain-obvious.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

shmulc8. (2026). captain-obvious security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/shmulc8-captain-obvious/audits/1

Cita BibTeX

@techreport{shmulc8-shmulc8-captain-obvious-2026,
  author = {shmulc8},
  title = {captain-obvious security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/shmulc8-captain-obvious/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "captain-obvious security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "shmulc8"
date-released: "2026-10-21"
url: "https://skillstore.io/skills/shmulc8-captain-obvious/audits/1"
identifiers:
  - type: other
    value: "skillstore:shmulc8-captain-obvious:audit:1"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Medio

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Review Generated Test Suites

Find tautologies and mock echoes in generated tests, then review advisory findings against the production behavior.

Maintain Shared Test Standards

Use contract questions and documented detector categories to distinguish meaningful regression checks from redundant assertions during review.

Compare Test Changes in CI

Compare supported proven syntactic findings against a Git baseline without enabling fixes. Comparison errors return success with a diagnostic.

Prueba estos prompts

Review One Python Test

Review this Python test using the authoring questions. Identify its observable contract and a plausible regression. Do not run commands or edit files.

Run a Report-Only Python Audit

Audit this trusted Python repository with --no-types and without --fix. Use stdout instead of a report file. Summarize findings without deleting tests.

Review Coverage-Based Findings

Audit this trusted TypeScript project using its existing coverage report. Separate proven and advisory findings. Propose advisory changes for approval; do not edit files.

Plan a Baseline Quality Check

Review the --check workflow for this trusted repository against [base]. Explain fail-open behavior and excluded categories. Propose a report-only CI command for approval.

Mejores prácticas

Scan only trusted repositories, start without fixes, and avoid predictable shared temporary report paths.
Back up untracked tests and existing shadow-named files before scanning or fixing; Python --no-types avoids shadow-file creation.
Review each proposed deletion against its contract, obtain approval for advisory edits, and run type checks and tests afterward.

Evitar

Treating a clean scanner report as proof that every test can detect meaningful regressions.
Deleting advisory findings or weakening security contract tests solely because their assertions look repetitive.
Using --force, trusting Git cleanliness for untracked files, or running repository toolchains without reviewing their trust boundary.

Preguntas frecuentes

Which languages and test styles are supported?

The bundled scanners target TypeScript and JavaScript Jest-style or Vitest-style tests, plus Python pytest and unittest patterns.

Does scanning execute my tests?

The scanners parse tests rather than run the test suite. They can load repository TypeScript code or execute mypy plugins and environment commands.

Can I scan without modifying Python files?

Use --no-types without --fix or a file output option. Single-file Python mode also parses source without mypy shadow files.

Are all findings automatically deleted?

No. Explicit --fix targets findings marked safe. Advisory and report-only findings require review, and advisory edits require user approval.

What does coverage input add?

Coverage can confirm that a conditional assertion never executed or suppress a finding when it did. The report must include test-file lines.

Can the baseline check enforce every finding?

No. It compares newly introduced proven syntactic findings. Type-dependent and coverage-dependent categories are excluded, and comparison failures return success with diagnostics.