📦

extension-oql

Name: extension-oql
Author: caffeinelabs

v0.4.0 Révision du contenu r1 Sûr ⚙️ Commandes externes

Expose Canister Data Through OQL

Structured canister data is difficult for intelligence agents to query safely. This skill adds OQL entities, schema discovery, query execution, relationships, and per-entity authorization.

Prend en charge: Claude Codex Code(CC)

🥈 82 Argent

Maintain this Skill? Claim it 🥈 82 Argent

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "extension-oql" from https://skillstore.io/skills/caffeinelabs-extension-oql.md and its manifest at https://skillstore.io/api/skills/caffeinelabs-extension-oql/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/caffeinelabs-extension-oql.md manifest signé GET /api/skills/caffeinelabs-extension-oql/manifest lockfile signé GET /api/skills/caffeinelabs-extension-oql/lockfile

Tester

Utilisation de « extension-oql ». Expose a products map while keeping access limited to controllers.

Résultat attendu:

Added a product entity with its identifier as the primary key.
Kept controller-only authorization and added an empty-state schema sample.
Registered schema discovery and query execution through the Expose mixin.

Utilisation de « extension-oql ». Make private notes queryable by each note owner.

Résultat attendu:

Tagged the owner principal as the row owner.
Applied user-scoped authorization so each caller receives only owned notes.
Kept ownership available during joins to prevent cross-user traversal.

Utilisation de « extension-oql ». Connect products and vendors through a supplies collection.

Résultat attendu:

Created a manual supply entity from map entries.
Promoted product and vendor identifiers into queryable fields.
Linked both identifiers to their target entities for relationship traversal.

Audit de sécurité

Sûr

v1 • 23/07/2026 Ouvrir le rapport versionné

All 115 static findings are false positives caused by Markdown code formatting, Motoko examples, a fixed Mops setup command, the `keys()` method, and sample records. SKILL.md contains no shell backtick execution, key-file access, system reconnaissance, prompt injection, or data-exfiltration intent. It documents explicit per-entity authorization and warns developers to choose access levels carefully.

Fichiers analysés

323

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Facteurs de risque

Le dernier audit statique et sémantique terminé n’a détecté aucun constat de sécurité confirmé. Cela ne prouve pas que le skill est sans effets secondaires.

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/caffeinelabs-extension-oql/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/caffeinelabs-extension-oql/security.svg)](https://skillstore.io/skills/caffeinelabs-extension-oql?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/caffeinelabs-extension-oql?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/caffeinelabs-extension-oql/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/caffeinelabs-extension-oql.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

caffeinelabs. (2026). extension-oql security audit report (audit version 1) [Author version 0.4.0]. Skillstore. https://skillstore.io/skills/caffeinelabs-extension-oql/audits/1

Citation BibTeX

@techreport{caffeinelabs-caffeinelabs-extension-oql-2026,
  author = {caffeinelabs},
  title = {extension-oql security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/caffeinelabs-extension-oql/audits/1},
  note = {Author version 0.4.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "extension-oql security audit report (audit version 1)"
version: "0.4.0"
type: report
authors:
  - name: "caffeinelabs"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/caffeinelabs-extension-oql/audits/1"
identifiers:
  - type: other
    value: "skillstore:caffeinelabs-extension-oql:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

100

Maintenabilité

Contenu

Communauté

100

Conformité aux spécifications

Ce que vous pouvez créer

Add Canister Analytics

Expose product, customer, or project collections for natural-language questions and aggregate analysis.

Protect User-Scoped Queries

Apply owner fields and scoped authorization so signed-in users receive only permitted rows.

Model Complex Relationships

Create edges, junction entities, flattened records, and computed payloads for richer queries.

Essayez ces prompts

Expose One Collection

Inspect my Motoko canister and expose the products collection through caffeineai-oql. Keep controller-only authorization and summarize each change.

Add User Scoping

Expose my notes collection. Use its owner principal for row-level access, and prevent users from reading another user's rows.

Connect Related Entities

Expose products, vendors, and supplies as related OQL entities. Define stable primary keys and edges that support dotted-path queries.

Design a Complex OQL Model

Review all persistent collections. Propose authorized entities, manual projections, conversion modules, hidden fields, samples, and synthetic junctions before implementing them.

Bonnes pratiques

Keep controller-only authorization until the intended audience for every entity is explicit.
Expose only fields and collections required for supported questions.
Verify primary keys, owner fields, edges, and empty-collection samples before deployment.

Éviter

Do not mark private or user-owned data as public.
Do not enable scoped access without a valid owner field or subject-aware iterator.
Do not rely on populated collections for schema discovery when data can be empty.

Foire aux questions

What does this skill add?

It adds queryable OQL entities plus schema discovery and query execution endpoints to a Motoko canister.

Which collection types are supported?

Maps, Sets, Lists, immutable arrays, and mutable arrays can use automatic entity conversion for supported row types.

How is access controlled?

Each entity selects public, controller-only, user-scoped, or controller-or-scoped authorization.

Does it expose every collection automatically?

No. Developers choose which persistent collections become entities and which fields remain visible.

What versions are required?

The documented integration uses caffeineai-oql 0.4.0 and requires Motoko compiler 1.11 or newer.

How are non-primitive fields handled?

Use manual payloads, flattened records, or type-specific conversion modules that produce one stable OQL value variant.

Détails du développeur

Auteur

caffeinelabs

Licence

MIT

Version de l’auteur

v0.4.0

Révision Skillstore

Dépôt

https://github.com/caffeinelabs/skills/tree/10fb452613c797633b8cb33639fc9a754a138039/skills/extension-oql

Réf

f32f934280aa94e399d875d7cf7b2ed16d1b82a3

Récence de maintenance

25/07/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md