Compétences subgraph-migrate
📩

subgraph-migrate

RĂ©vision du contenu r1 Critique ⚙ Commandes externes🌐 AccĂšs rĂ©seau

Migrate a Subgraph to Goldsky

Moving from The Graph can require a reliable source identifier, deployment path, and endpoint transition. This skill guides the migration and verifies sync before application cutover.

Prend en charge: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠ 38 MĂ©diocre

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent
Review the Skillstore skill "subgraph-migrate" from https://skillstore.io/skills/goldsky-io-subgraph-migrate.md and its manifest at https://skillstore.io/api/skills/goldsky-io-subgraph-migrate/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/goldsky-io-subgraph-migrate.md manifest signé GET /api/skills/goldsky-io-subgraph-migrate/manifest lockfile signé GET /api/skills/goldsky-io-subgraph-migrate/lockfile

Tester

Utilisation de « subgraph-migrate ». I have the old public GraphQL endpoint but no IPFS hash.

RĂ©sultat attendu:

Use the public endpoint migration path. Confirm the endpoint first, deploy the subgraph, and verify indexing before changing the application.

Utilisation de « subgraph-migrate ». The deployment is stuck at a low synchronization percentage.

RĂ©sultat attendu:

  • Check the reported network and deployment status.
  • Treat a low percentage as a possible mapping or handler error.
  • Send the exact error to the subgraph troubleshooting workflow.

Utilisation de « subgraph-migrate ». The migration is synced and I need a stable production endpoint.

RĂ©sultat attendu:

Create a production tag for the verified version, test its endpoint, then update the application to use the tagged URL.

Audit de sécurité

Critique
v1 ‱ 28/09/2026 Ouvrir le rapport versionnĂ©

The 38 external-command findings are false positives caused by Markdown backticks, code fences, and inline command examples in SKILL.md. The installer command at SKILL.md:55 pipes a remote script into a shell and is a confirmed critical supply-chain risk; the three hardcoded URLs are expected service or documentation endpoints, with the installer URL retaining a low network risk.

2
Fichiers analysés
143
Lignes analysées
1
ÉlĂ©ments Ă  examiner
0
Faux positifs ignorés

Préoccupations de sécurité confirmées (1)

Critique
SKILL.md:55
Pipe to shell pattern
curl https://goldsky.com | sh
curl https://goldsky.com | sh executes content fetched from a remote server without local inspection, signature verification, or version pinning. A compromised server or transit path could execute arbitrary commands with the user's shell privileges.
ÉlĂ©ments d’évaluation des capacitĂ©s (1)

Il s’agit de capacitĂ©s locales rĂ©elles qui peuvent ĂȘtre attendues pour cette compĂ©tence ; elles nĂ©cessitent donc un examen, mais ne sont pas comptabilisĂ©es comme comportement malveillant confirmĂ©.

Faible
SKILL.md:55
Hardcoded URL
curl https://goldsky.com | sh
The line uses a fixed external URL to download the CLI installer, creating a real network and supply-chain dependency. The critical risk comes from piping that response into a shell, while this verdict records the separate network exposure.

Facteurs de risque

⚙ Commandes externes (38)
SKILL.md:11 SKILL.md:16 SKILL.md:17 SKILL.md:22 SKILL.md:30 SKILL.md:31 SKILL.md:32 SKILL.md:34 SKILL.md:41 SKILL.md:42-44 SKILL.md:44-45 SKILL.md:45-47 SKILL.md:47 SKILL.md:53-60 SKILL.md:60-62 SKILL.md:62 SKILL.md:66-68 SKILL.md:68-77 SKILL.md:77-81 SKILL.md:81-85 SKILL.md:85-87 SKILL.md:87-89 SKILL.md:89-91 SKILL.md:91-93 SKILL.md:93-96 SKILL.md:96-97 SKILL.md:97 SKILL.md:101-103 SKILL.md:103-107 SKILL.md:107-109 SKILL.md:109-113 SKILL.md:113-115 SKILL.md:115 SKILL.md:116-117 SKILL.md:117-118 SKILL.md:118-123 SKILL.md:123-124 SKILL.md:124-125
🌐 AccĂšs rĂ©seau (3)
SKILL.md:55 SKILL.md:106 SKILL.md:126

Motifs détectés

Pipe to shell pattern
Audité par: codex
Partager et citer ce rapport

Partagez le rapport d’évaluation versionnĂ©, le badge neutre, la carte intĂ©grable et les citations. Skillstore prĂ©sente les preuves sans dĂ©cider si ce Skill est sĂ»r.

Ouvrir le rapport versionné
Évaluation de sĂ©curitĂ©

Copier le lien du rapport

https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/goldsky-io-subgraph-migrate/security.svg)](https://skillstore.io/skills/goldsky-io-subgraph-migrate?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/goldsky-io-subgraph-migrate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/goldsky-io-subgraph-migrate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/goldsky-io-subgraph-migrate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citations académiques (APA · BibTeX · CFF)

Citation APA

goldsky-io. (2026). subgraph-migrate security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1

Citation BibTeX

@techreport{goldsky-io-goldsky-io-subgraph-migrate-2026, author = {goldsky-io}, title = {subgraph-migrate security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "subgraph-migrate security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "goldsky-io" date-released: "2026-09-28" url: "https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1" identifiers: - type: other value: "skillstore:goldsky-io-subgraph-migrate:audit:1" description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Faible
55
Architecture
85
Maintenabilité
87
Contenu
65
Communauté
83
Conformité aux spécifications

Ce que vous pouvez créer

Replace a The Graph endpoint

Move a production subgraph to Goldsky while preserving the existing application query model.

Recover a sunset deployment

Use an existing endpoint or IPFS deployment hash when a former hosted subgraph endpoint is unavailable.

Validate a migration rollout

Deploy, monitor indexing, create a stable tag, and prepare the new endpoint for an application cutover.

Essayez ces prompts

Start a migration 
Help me migrate my subgraph from The Graph to Goldsky. Ask for the current endpoint or IPFS deployment hash before choosing a path.
Choose the source 
I have a public GraphQL endpoint, an IPFS deployment hash, and local source. Compare the migration paths and recommend the safest option.
Deploy and verify 
Guide me through deploying this subgraph to Goldsky, checking indexing progress, and identifying whether any error requires troubleshooting.
Plan production cutover 
Create a production cutover checklist for my Goldsky subgraph, including a stable tag, endpoint validation, rollback considerations, and sync verification.

Bonnes pratiques

  • Require the user to provide and verify the source endpoint or IPFS hash.
  • Confirm indexing progress before changing the application endpoint.
  • Use a stable tag so future deployments do not require frontend URL changes.

Éviter

  • Do not guess a The Graph endpoint, IPFS hash, network, or deployment name.
  • Do not declare success before the Goldsky index advances and the endpoint responds.
  • Do not use this workflow to diagnose complex mapping or synchronization errors.

Foire aux questions

What source information is required?
Provide the current GraphQL endpoint, the IPFS deployment hash, or local source when the published deployment is unavailable.
Does migration require subgraph code changes?
The standard migration is a drop-in replacement, but Goldsky validation can expose specification issues that require changes.
Which migration path should I use?
Use the public endpoint when available. Use the IPFS hash when you have the deployment identifier but no queryable endpoint.
How do I know the migration is working?
Check the deployment status and query metadata to confirm that the indexed block advances without indexing errors.
How should I avoid changing my frontend later?
Create a stable Goldsky tag and configure the application to use the tagged endpoint.
What if deployment or sync fails?
Capture the exact error and route it to the subgraph troubleshooting workflow. Do not guess at network or schema changes.

Détails du développeur

Auteur

goldsky-io

Licence

MIT

RĂ©vision Skillstore

r1

Avis de version

L’auteur n’a dĂ©clarĂ© aucune version.

DĂ©pĂŽt

https://github.com/goldsky-io/goldsky-agent/tree/e8e18c16233d9a7cee64dc548ba779c5fb99205a/skills/subgraph-migrate

RĂ©f

8b5ad1599e7c55e9b6c627bca3f556f6e9061cb1

RĂ©cence de maintenance

30/09/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📁 evals/

📄 trigger-eval.json

📄 SKILL.md