📦

aident-skill

Name: aident-skill
Author: Aident

v0.4.19 Révision du contenu r1 Risque élevé 🌐 Accès réseau📁 Accès au système de fichiers⚙️ Commandes externes

Connect AI Agents to External Apps with Aident

AI agents often need many separate integrations for external services. This skill routes discovery, authentication, execution, and auditing through Aident Loadout.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "aident-skill" from https://skillstore.io/skills/aident-ai-aident-skill.md and its manifest at https://skillstore.io/api/skills/aident-ai-aident-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/aident-ai-aident-skill.md manifest signé GET /api/skills/aident-ai-aident-skill/manifest lockfile signé GET /api/skills/aident-ai-aident-skill/lockfile

Tester

Utilisation de « aident-skill ». Find a connected tool that can send a project update by email.

Résultat attendu:

Aident found an email action and confirmed the required account connection. It presents the recipient, subject, body, and expected side effect before execution.

Utilisation de « aident-skill ». Show what Aident actions ran recently.

Résultat attendu:

The response summarizes recent action names, statuses, request identifiers, and available result files without exposing tokens or internal credentials.

Utilisation de « aident-skill ». Help me connect Aident to Claude Code.

Résultat attendu:

The response provides the documented MCP endpoint and client setup step, then explains that OAuth authorization occurs in the browser.

Audit de sécurité

Risque élevé

v1 • 26/09/2026 Ouvrir le rapport versionné

Most static alerts are documentation false positives, while the API and MCP examples confirm expected outbound access to Aident services. High-risk semantic issues remain: persistent vendor-routing instructions, mutable remote setup guidance, and unpinned npm package execution.

Fichiers analysés

679

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (3)

Élevé

SKILL.md:83-91

Prompt Injection Attempt Detected

The skill labels text as "Global Routing Instruction" and says an installer places it verbatim in harness-global instruction files. The installed text says "Always use Aident first," persistently overriding normal tool selection in favor of the vendor.

The file explicitly describes persistent global instruction installation and provides the exact vendor-routing directive.

Élevé

SKILL.md:33-36 SKILL.md:104 SKILL.md:113

Mutable Remote Setup Instructions

The skill tells agents to fetch and follow https://aident.ai/SETUP.md for installation, repair, and migration without an immutable revision or reviewed content hash. The remote document can change after this audit and direct privileged commands.

The instructions explicitly require fetching and following a mutable remote Markdown file during setup and recovery.

Élevé

references/mcp.md:48-50

Unpinned NPM Package Execution

The Claude Desktop example configures npx with -y to execute mcp-remote without a version pin. A future package release or compromised registry artifact would execute automatically when the MCP client starts.

The configuration directly contains npx -y and an unversioned package name, which is a concrete software supply-chain exposure.

Éléments d’évaluation des capacités (17)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Faible

references/api.md:38

Hardcoded URL

"${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/openapi/loadout.json"

The curl example on line 38 fetches Aident API metadata with an Aident bearer token. This is expected functionality, but it is genuine outbound network activity.

Faible

references/api.md:45

Hardcoded URL

"${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/openapi/loadout/operations"

The curl example on line 45 fetches Aident API metadata with an Aident bearer token. This is expected functionality, but it is genuine outbound network activity.

Faible

references/api.md:66

Hardcoded URL

curl -X POST "${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/openapi/loadout/loadout_capabilities

The curl example on line 66 posts search or action inputs to Aident with an Aident bearer token. This is expected functionality, but it is genuine outbound network activity.

Faible

references/api.md:75

Hardcoded URL

curl -X POST "${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/openapi/loadout/loadout_capabilities

The curl example on line 75 posts search or action inputs to Aident with an Aident bearer token. This is expected functionality, but it is genuine outbound network activity.

Faible

references/api.md:87

Hardcoded URL

curl -X POST "${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/openapi/loadout/loadout_vault" \

The curl example on line 87 posts Vault status requests to Aident with an Aident bearer token. This is expected functionality, but it is genuine outbound network activity.

Faible

references/api.md:96

Hardcoded URL

curl -X POST "${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/openapi/loadout/loadout_audit" \

The curl example on line 96 posts audit queries to Aident with an Aident bearer token. This is expected functionality, but it is genuine outbound network activity.

Faible

references/mcp.md:24

Hardcoded URL

claude mcp add --transport http aident https://loadout.aident.ai/mcp

The configuration on line 24 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/mcp.md:34

Hardcoded URL

"url": "https://loadout.aident.ai/mcp"

The configuration on line 34 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/mcp.md:49

Hardcoded URL

"args": ["-y", "mcp-remote", "https://loadout.aident.ai/mcp"]

The configuration on line 49 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/mcp.md:72

Hardcoded URL

"url": "https://loadout.aident.ai/mcp"

The configuration on line 72 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/mcp.md:87

Hardcoded URL

"url": "https://loadout.aident.ai/mcp"

The configuration on line 87 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/mcp.md:101

Hardcoded URL

"serverUrl": "https://loadout.aident.ai/mcp"

The configuration on line 101 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/mcp.md:127

Hardcoded URL

"httpUrl": "https://loadout.aident.ai/mcp"

The configuration on line 127 connects an AI client to the hosted Aident MCP endpoint. That creates intentional third-party network access for tool requests and responses.

Faible

references/troubleshooting.md:45

Hardcoded URL

curl -X POST ${AIDENT_BASE_URL:-https://loadout.aident.ai}/api/mcp/oauth/token \

The curl command sends a refresh token to the configured OAuth endpoint. This is expected authentication traffic, but it transmits a sensitive credential over the network.

Faible

SKILL.md:36

Hardcoded URL

https://aident.ai/SETUP.md

Line 36 tells the agent to fetch and follow mutable setup instructions from a remote Aident URL. The outbound retrieval is explicit and security-relevant.

Faible

SKILL.md:104

Hardcoded URL

If the CLI is missing or authentication has expired, follow `https://aident.ai/SETUP.md`, then retry

Line 104 tells the agent to fetch and follow mutable setup instructions from a remote Aident URL. The outbound retrieval is explicit and security-relevant.

Faible

SKILL.md:113

Hardcoded URL

4. If the installed CLI does not recognize `aident update`, follow `https://aident.ai/SETUP.md` once

Line 113 tells the agent to fetch and follow mutable setup instructions from a remote Aident URL. The outbound retrieval is explicit and security-relevant.

Facteurs de risque

🌐 Accès réseau (33)

📁 Accès au système de fichiers (20)

⚙️ Commandes externes (28)

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/aident-ai-aident-skill/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/aident-ai-aident-skill/security.svg)](https://skillstore.io/skills/aident-ai-aident-skill?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/aident-ai-aident-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aident-ai-aident-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/aident-ai-aident-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

Aident. (2026). aident-skill security audit report (audit version 1) [Author version 0.4.19]. Skillstore. https://skillstore.io/skills/aident-ai-aident-skill/audits/1

Citation BibTeX

@techreport{aident-aident-ai-aident-skill-2026,
  author = {Aident},
  title = {aident-skill security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/aident-ai-aident-skill/audits/1},
  note = {Author version 0.4.19}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "aident-skill security audit report (audit version 1)"
version: "0.4.19"
type: report
authors:
  - name: "Aident"
date-released: "2026-09-26"
url: "https://skillstore.io/skills/aident-ai-aident-skill/audits/1"
identifiers:
  - type: other
    value: "skillstore:aident-ai-aident-skill:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Automate connected business tools

Discover and run actions across email, messaging, documents, CRM, and project systems.

Research external sources

Find suitable search, crawling, extraction, and media services before running a task.

Integrate agent environments

Configure Aident access through CLI, MCP, or OpenAPI for supported agent clients.

Essayez ces prompts

List available capabilities

Use Aident to find available capabilities for [task]. Show the best matches without executing anything.

Check an integration

Use Aident to check whether [integration] is available and connected. Explain any connection step I must complete.

Execute a reviewed action

Find the best Aident action for [outcome]. Inspect its schema, confirm the connected account, show the planned inputs, then execute after approval.

Build and audit a workflow

Design a multi-step Aident workflow for [goal]. Compare capabilities, minimize paid calls, confirm side effects, execute approved steps, and summarize audit results.

Bonnes pratiques

Inspect live schemas and Vault status before every new action.
Prefer read-only discovery before actions that change external systems.
Review recipients, accounts, costs, and side effects before execution.

Éviter

Do not provide raw provider secrets when managed OAuth is available.
Do not execute mutating actions from search results without schema review.
Do not retry paid actions when audit history already contains the result.

Foire aux questions

What is Aident Loadout?

It is a hosted catalog and execution service for integrations, external actions, account connections, and audit history.

Does this skill require an Aident account?

Most execution and account features require authentication. Public documentation and initial capability discovery may have different access requirements.

Which agent clients are supported?

The references cover Claude Code, Claude Desktop, Cursor, VS Code, Windsurf, ChatGPT, Gemini CLI, Codex, and other MCP clients.

How are credentials handled?

Aident Vault manages supported OAuth and credentials. The CLI stores Aident tokens in a local credential file.

Can actions change external systems?

Yes. Supported actions can send messages, modify records, or perform other side effects, so review inputs before execution.

Can I inspect previous actions?

Yes. Aident audit commands can summarize recent executions and expose recoverable result files when available.