📦

xget

Name: xget
Author: xixu-me

Revisión del contenido r1 Riesgo alto ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos🔑 Variables de entorno

Acelera las descargas con Xget

Los desarrolladores a menudo necesitan un acceso más rápido a recursos upstream de paquetes, contenedores y API. Esta skill ayuda a convertir URLs y aplicar la configuración de Xget en herramientas comunes.

Compatible con: Claude Codex Code(CC)

⚠️ 38 Deficiente

Maintain this Skill? Claim it ⚠️ 38 Deficiente

Detente y solicita confirmación antes de instalar.

Revisa el plan y obtén el consentimiento explícito del usuario antes de modificar archivos.

Instalar con mi Agente

Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.

Solicitud de agente

Review the Skillstore skill "xget" from https://skillstore.io/skills/xixu-me-xget.md and its manifest at https://skillstore.io/api/skills/xixu-me-xget/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.

Recursos legibles por agentes

Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.

Detalle Markdown GET /skills/xixu-me-xget.md Manifest firmado GET /api/skills/xixu-me-xget/manifest Lockfile firmado GET /api/skills/xixu-me-xget/lockfile

Pruébalo

Usando "xget". Convierte una URL de repositorio de GitHub usando mi URL base de Xget.

Resultado esperado:

Una URL de Xget reescrita, el prefijo de plataforma coincidente y una nota breve si la URL upstream no es compatible.

Usando "xget". Muestra orientación de Docker Compose para mi despliegue de Xget.

Resultado esperado:

Una sección de configuración enfocada con el host público de demostración reemplazado por el host de Xget solicitado.

Usando "xget". Configura mi proyecto para usar Xget en instalaciones de npm.

Resultado esperado:

Un resumen conciso de cambios, el archivo de configuración afectado y un comando de verificación o resultado de comprobación.

Auditoría de seguridad

Riesgo alto

v5 • 8/7/2026 Abrir el informe versionado

Most script command-execution alerts are false positives from JavaScript template literals, and most placeholder URL alerts are benign documentation. Real risks remain because the skill fetches live remote guidance, encourages execution-first behavior, writes persistent shell profiles, and targets credential-bearing config files. Publication should require confirmation gates and stronger source-trust controls.

Archivos escaneados

1,232

Líneas analizadas

Elementos de revisión

Falsos positivos ignorados

Preocupaciones de seguridad confirmadas (5)

Alto

references/REFERENCE.md:117

Environment file access

- `.env`, SDK initialization code, shell profile files

The skill lists .env, SDK initialization code, and shell profile files as targets for project changes. These files can contain secrets or sensitive runtime configuration.

Alto

references/REFERENCE.md:114

NPM config file (may contain tokens)

- `.npmrc`, `pip.conf`, `NuGet.Config`, `.cargo/config.toml`, `.condarc`

The skill lists .npmrc and similar package manager config files as targets for edits. These files often contain registry tokens, so execution-first edits create credential exposure and corruption risk.

Alto

SKILL.md:78

Environment file access

example, pair a package-manager section with container, deployment, or `.env`

The skill recommends pairing package-manager work with .env guidance when needed. Because .env files often contain secrets, this target deserves review safeguards.

Alto

SKILL.md:55-67 scripts/xget.mjs:6-8 scripts/xget.mjs:926-970

Remote Live Guidance Can Drive Local Changes

The skill tells agents to fetch live README guidance and adapt it to the user project. The helper downloads platform and README data from raw.gitcode.com, so changed or compromised upstream content can influence local edits.

The cited instructions require live README lookup before applying changes, and the helper contains default remote URLs used by topics and snippet. This is a clear remote-content trust boundary.

Alto

SKILL.md:13-18 SKILL.md:51-67 references/REFERENCE.md:33-57 references/REFERENCE.md:108-122

Execution-First Workflow Encourages Persistent Changes

The skill instructs agents to run commands, edit real files, and apply changes end to end. The reference guide includes persistent shell profile setup, which can modify future user sessions.

Multiple cited sections explicitly prefer execution over examples and include commands that persist environment variables in shell profile files. The risk is behavioral and not fully captured by single-line pattern matches.

Elementos de revisión de capacidades (16)

Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.

Alto

references/REFERENCE.md:45

Hidden file in home directory

echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.bashrc

The referenced command appends XGET_BASE_URL to ~/.bashrc, a hidden shell startup file. Persistent profile edits can alter future shell behavior and should require explicit confirmation.

Alto

references/REFERENCE.md:51

Hidden file in home directory

echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.zshrc

The referenced command appends XGET_BASE_URL to ~/.zshrc, a hidden shell startup file. Persistent profile edits can alter future shell behavior and should require explicit confirmation.

Alto

references/REFERENCE.md:45

Hidden file access

echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.bashrc

The command writes directly to ~/.bashrc as part of persistent setup. This is legitimate configuration, but it is a real filesystem modification with persistence risk.

Alto

references/REFERENCE.md:51

Hidden file access

echo 'export XGET_BASE_URL="https://xget.example.com"' >> ~/.zshrc

The command writes directly to ~/.zshrc as part of persistent setup. This is legitimate configuration, but it is a real filesystem modification with persistence risk.

Medio

SKILL.md:30

Ruby/shell backtick execution

Prefer [`scripts/xget.mjs`](./scripts/xget.mjs) over manual guessing for live

The skill tells agents to prefer the included Node helper script for live platform data. Running that helper is expected, but it invokes local code that performs network fetches.

Medio

SKILL.md:31

Ruby/shell backtick execution

platform data, URL conversion, and README `Use Cases` lookup.

This line continues the instruction to use the helper for live platform data and README lookup. The risk is indirect execution of a local script that retrieves remote content.

Medio

SKILL.md:57

Ruby/shell backtick execution

- list candidate headings with `node scripts/xget.mjs topics --format json`

The skill explicitly instructs agents to run node scripts/xget.mjs topics. This is a real external command path, even though it is part of the intended workflow.

Medio

SKILL.md:59

Ruby/shell backtick execution

`node scripts/xget.mjs snippet --base-url https://xget.example.com --heading "Docker Compose Configu

The skill explicitly instructs agents to run node scripts/xget.mjs snippet. The helper fetches remote README content and rewrites it for the selected base URL.

Medio

SKILL.md:75

Ruby/shell backtick execution

`node scripts/xget.mjs platforms --format json` when the answer depends on

The skill explicitly instructs agents to run node scripts/xget.mjs platforms. The command fetches live remote platform data, so the external command risk is real.

Medio

SKILL.md:76

Ruby/shell backtick execution

current prefixes, and use `convert` for exact URL rewrites.

This line continues the instruction to use helper commands for current prefixes and URL conversion. It is legitimate tooling but still directs command execution.

Bajo

scripts/xget.mjs:7

Hardcoded URL

'https://raw.gitcode.com/xixu-me/xget/raw/main/src/config/platform-catalog.js';

The script hardcodes the remote GitCode URL used to fetch the live Xget platform catalog. This is intentional network behavior and creates a source-trust dependency.

Bajo

scripts/xget.mjs:8

Hardcoded URL

const DEFAULT_README_URL = 'https://raw.gitcode.com/xixu-me/xget/raw/main/README.md';

The script hardcodes the remote GitCode README URL used by topics and snippet commands. This is intentional network behavior and creates a source-trust dependency.

Bajo

scripts/xget.mjs:888

Environment variable access (dot notation)

resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??

The convert command reads process.env.XGET_BASE_URL as a configuration fallback. The variable is a service URL rather than a secret, but it is real environment access.

Bajo

scripts/xget.mjs:958

Environment variable access (dot notation)

resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??

The snippet command reads process.env.XGET_BASE_URL as a configuration fallback. The variable is a service URL rather than a secret, but it is real environment access.

Bajo

scripts/xget.mjs:888

Environment variable object

resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??

The code accesses the process.env object to resolve XGET_BASE_URL for URL conversion. This is expected configuration access, but it is still environment-variable use.

Bajo

scripts/xget.mjs:958

Environment variable object

resolveBaseUrl(getStringOption(options, 'base-url'), process.env.XGET_BASE_URL) ??

The code accesses the process.env object to resolve XGET_BASE_URL for README snippet rewriting. This is expected configuration access, but it is still environment-variable use.

Factores de riesgo

⚙️ Comandos externos (53)

references/REFERENCE.md:15 references/REFERENCE.md:17 references/REFERENCE.md:35 references/REFERENCE.md:37 scripts/xget.mjs:15 scripts/xget.mjs:16 scripts/xget.mjs:75 scripts/xget.mjs:81-121 scripts/xget.mjs:140 scripts/xget.mjs:151 scripts/xget.mjs:175 scripts/xget.mjs:181 scripts/xget.mjs:201 scripts/xget.mjs:230 scripts/xget.mjs:270 scripts/xget.mjs:274 scripts/xget.mjs:287 scripts/xget.mjs:330 scripts/xget.mjs:353 scripts/xget.mjs:390 scripts/xget.mjs:393 scripts/xget.mjs:410 scripts/xget.mjs:493 scripts/xget.mjs:496 scripts/xget.mjs:507 scripts/xget.mjs:526 scripts/xget.mjs:547-600 scripts/xget.mjs:600-643 scripts/xget.mjs:643-648 scripts/xget.mjs:648-758 scripts/xget.mjs:758-763 scripts/xget.mjs:763-838 scripts/xget.mjs:838-901 scripts/xget.mjs:901-963 scripts/xget.mjs:963 SKILL.md:7 SKILL.md:23 SKILL.md:27 SKILL.md:30 SKILL.md:31 SKILL.md:50 SKILL.md:57 SKILL.md:58 SKILL.md:59 SKILL.md:61 SKILL.md:75 SKILL.md:76 SKILL.md:78 SKILL.md:82 SKILL.md:83 SKILL.md:84 SKILL.md:85 SKILL.md:88

🌐 Acceso a red (16)

references/REFERENCE.md:18 references/REFERENCE.md:24 references/REFERENCE.md:30 references/REFERENCE.md:39 references/REFERENCE.md:45 references/REFERENCE.md:51 references/REFERENCE.md:57 references/REFERENCE.md:93 scripts/xget.mjs:7 scripts/xget.mjs:8 scripts/xget.mjs:10 scripts/xget.mjs:11 scripts/xget.mjs:118 scripts/xget.mjs:120 SKILL.md:27 SKILL.md:59

📁 Acceso al sistema de archivos (8)

references/REFERENCE.md:5 references/REFERENCE.md:45 references/REFERENCE.md:51 references/REFERENCE.md:45 references/REFERENCE.md:51 scripts/xget.mjs:547 scripts/xget.mjs:185 scripts/xget.mjs:268

🔑 Variables de entorno (4)

scripts/xget.mjs:888 scripts/xget.mjs:958 scripts/xget.mjs:888 scripts/xget.mjs:958

Auditado por: codex Ver historial de auditorías →

Compartir y citar este informe

Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.

Abrir el informe versionado

Copiar enlace del informe

https://skillstore.io/skills/xixu-me-xget/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Insignia Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/xixu-me-xget/security.svg)](https://skillstore.io/skills/xixu-me-xget?utm_source=security_passport_badge)

Insignia HTML

<a href="https://skillstore.io/skills/xixu-me-xget?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xixu-me-xget/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Tarjeta para insertar

<iframe src="https://skillstore.io/embed/skills/xixu-me-xget.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citas académicas (APA · BibTeX · CFF)

Cita APA

xixu-me. (2026). xget security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/xixu-me-xget/audits/5

Cita BibTeX

@techreport{xixu-me-xixu-me-xget-2026,
  author = {xixu-me},
  title = {xget security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/xixu-me-xget/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "xget security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "xixu-me"
date-released: "2026-07-08"
url: "https://skillstore.io/skills/xixu-me-xget/audits/5"
identifiers:
  - type: other
    value: "skillstore:xixu-me-xget:audit:5"
    description: "Skillstore immutable audit report identifier"

Puntuación de Skillstore

Por qué esta puntuación Confianza de la evidencia: Alto

Arquitectura

Mantenibilidad

Contenido

Comunidad

Cumplimiento de la especificación

Lo que puedes crear

Configurar la aceleración del gestor de paquetes

Configura npm, pip, Cargo, NuGet, Conda o herramientas similares para usar un despliegue de Xget.

Preparar flujos de trabajo de contenedores y CI

Adapta ejemplos de Docker, Kubernetes y GitHub Actions para usar prefijos de registro de Xget.

Cambiar URLs base de SDK

Actualiza URLs base de AI SDK o API de inferencia manteniendo el comportamiento normal de autenticación del proveedor.

Prueba estos prompts

Convertir una URL

Convierte esta URL upstream en una URL de Xget usando mi URL base: [base URL] y [upstream URL].

Listar temas de configuración coincidentes

Encuentra los temas actuales de casos de uso de Xget relacionados con [tool or platform] y resume la ruta de configuración relevante.

Configurar un archivo de proyecto

Actualiza este proyecto para usar Xget con [package manager or container registry]. Usa [base URL] y verifica la configuración modificada.

Planificar una migración multicapa

Revisa este repositorio y planifica los cambios de Xget para instalaciones de paquetes, descargas de contenedores, trabajos de CI y URLs base de SDK antes de aplicarlos.

Mejores prácticas

Proporciona la URL base real de Xget antes de solicitar cambios de configuración aplicados.
Actualiza el mapa en vivo de la plataforma cuando importen los prefijos exactos o el soporte más reciente.
Revisa los cambios persistentes en el perfil de shell y en la configuración del proyecto antes de ejecutarlos.

Evitar

No uses el host de marcador de posición de Xget para comandos de producción.
No asumas que una URL upstream es compatible sin comprobar el mapa de la plataforma.
No apliques cambios persistentes de perfil cuando el usuario solo pidió ejemplos.