Compétences momentic-maintain

📦

momentic-maintain

Name: momentic-maintain
Author: momentic-ai

Révision du contenu r1 Risque élevé ⚙️ Commandes externes🌐 Accès réseau📁 Accès au système de fichiers🔑 Variables d’environnement

Maintain and Repair Momentic Tests

Failing Momentic tests can hide the earliest broken state and waste repair time. This skill investigates evidence, classifies causes, and guides verified repairs.

Prend en charge: Claude Codex Code(CC)

⚠️ 38 Médiocre

Maintain this Skill? Claim it ⚠️ 38 Médiocre

Arrêtez-vous et demandez confirmation avant l’installation.

Examinez le plan et obtenez le consentement explicite de l’utilisateur avant de modifier des fichiers.

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent

Review the Skillstore skill "momentic-maintain" from https://skillstore.io/skills/momentic-ai-momentic-maintain.md and its manifest at https://skillstore.io/api/skills/momentic-ai-momentic-maintain/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/momentic-ai-momentic-maintain.md manifest signé GET /api/skills/momentic-ai-momentic-maintain/manifest lockfile signé GET /api/skills/momentic-ai-momentic-maintain/lockfile

Tester

Utilisation de « momentic-maintain ». Why did run 7f2 fail after the setup module passed?

Résultat attendu:

The setup module ended on the parent page instead of the editor. The later title step failed because its required field never appeared.

Utilisation de « momentic-maintain ». Which quarantined test should we repair first?

Résultat attendu:

Prioritize checkout-address because three recent runs failed at the same locator before recovery.
Review the failed child step, tighten the locator, and replay the test before removing quarantine.

Utilisation de « momentic-maintain ». Can this timeout be fixed by increasing the wait?

Résultat attendu:

The evidence shows a slow application response, not an unstable test action. Classify it as infrastructure and keep the assertion unchanged.

Audit de sécurité

Risque élevé

v1 • 22/08/2026 Ouvrir le rapport versionné

Most static alerts are false positives caused by Markdown backticks, documentation examples, and test-run inspection language. Two API examples can disclose MOMENTIC_API_KEY when MOMENTIC_SERVER is untrusted. Unpinned npx execution and temporary storage of sensitive artifacts also require safeguards.

Fichiers analysés

499

Lignes analysées

Éléments à examiner

Faux positifs ignorés

Préoccupations de sécurité confirmées (2)

Élevé

SKILL.md:51-56 SKILL.md:301-306

Credential Forwarding to Configurable Server

The examples send MOMENTIC_API_KEY to MOMENTIC_SERVER without validating the destination. A poisoned environment variable could redirect the bearer token to an attacker-controlled host.

Both command blocks combine a secret-bearing Authorization header with an environment-controlled base URL. The data flow is explicit in adjacent lines.

Moyen

SKILL.md:151-155 SKILL.md:211-220 SKILL.md:236-251 SKILL.md:276-282

Unpinned Package Execution Through npx

The workflow repeatedly executes npx momentic without a pinned package version. Package resolution may run newly downloaded or project-local code before classification or repository edits.

The commands explicitly use npx without a version in several executable examples. Resolution behavior depends on the local project and package registry state.

Éléments d’évaluation des capacités (4)

Il s’agit de capacités locales réelles qui peuvent être attendues pour cette compétence ; elles nécessitent donc un examen, mais ne sont pas comptabilisées comme comportement malveillant confirmé.

Élevé

SKILL.md:55

Generic API/secret keys

-H "Authorization: Bearer ${MOMENTIC_API_KEY:?Set MOMENTIC_API_KEY}" \

The command places MOMENTIC_API_KEY in an Authorization header sent to a URL controlled by MOMENTIC_SERVER. An untrusted override could receive the bearer token.

Élevé

SKILL.md:305

Generic API/secret keys

-H "Authorization: Bearer ${MOMENTIC_API_KEY:?Set MOMENTIC_API_KEY}" \

The command places MOMENTIC_API_KEY in an Authorization header sent to a URL controlled by MOMENTIC_SERVER. An untrusted override could receive the bearer token.

Faible

SKILL.md:52

Temp file creation

RUN_INSPECTION_DIR="$(mktemp -d)"

The command creates a temporary directory for sensitive run metadata or artifacts. The document requests manual removal but provides no automatic cleanup on failure or interruption.

Faible

SKILL.md:302

Temp file creation

RUN_INSPECTION_DIR="$(mktemp -d)"

The command creates a temporary directory for sensitive run metadata or artifacts. The document requests manual removal but provides no automatic cleanup on failure or interruption.

Facteurs de risque

⚙️ Commandes externes (50)

🌐 Accès réseau (4)

SKILL.md:51 SKILL.md:216 SKILL.md:301 SKILL.md:467

📁 Accès au système de fichiers (2)

SKILL.md:52 SKILL.md:302

🔑 Variables d’environnement (3)

SKILL.md:55 SKILL.md:190 SKILL.md:305

Audité par: codex

Partager et citer ce rapport

Partagez le rapport d’évaluation versionné, le badge neutre, la carte intégrable et les citations. Skillstore présente les preuves sans décider si ce Skill est sûr.

Ouvrir le rapport versionné

Copier le lien du rapport

https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/momentic-ai-momentic-maintain/security.svg)](https://skillstore.io/skills/momentic-ai-momentic-maintain?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/momentic-ai-momentic-maintain?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/momentic-ai-momentic-maintain/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/momentic-ai-momentic-maintain.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citations académiques (APA · BibTeX · CFF)

Citation APA

momentic-ai. (2026). momentic-maintain security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1

Citation BibTeX

@techreport{momentic-ai-momentic-ai-momentic-maintain-2026,
  author = {momentic-ai},
  title = {momentic-maintain security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "momentic-maintain security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "momentic-ai"
date-released: "2026-08-22"
url: "https://skillstore.io/skills/momentic-ai-momentic-maintain/audits/1"
identifiers:
  - type: other
    value: "skillstore:momentic-ai-momentic-maintain:audit:1"
    description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen

Architecture

Maintenabilité

Contenu

Communauté

Conformité aux spécifications

Ce que vous pouvez créer

Diagnose a branch failure

Trace the earliest divergent step, classify the cause, and explain the broken postcondition.

Triage a failing main branch

Review all relevant failed runs, group shared symptoms, and identify representative evidence.

Reduce flaky retries

Inspect quarantined, recovered, and retry-heavy tests, then verify durable repairs.

Essayez ces prompts

Inspect one failed run

Inspect Momentic run <run-id>. Identify the failing step, earliest divergence, likely category, and evidence. Do not save changes.

Explain branch failures

Review Momentic runs on branch <branch> from <start> to <end>. Explain each failure and compare with main only when relevant.

Analyze flakiness

Find quarantined, recovered, or retry-heavy tests in <time-range>. Prioritize repeated failures and identify the earliest unstable postcondition.

Plan and verify repairs

Classify runs <run-ids>, prepare the application, and dry-run triage. Propose repairs, review each diff, then describe focused replay verification.

Bonnes pratiques

Start with the exact run and current attempt before using historical comparisons.
Tie every diagnosis to screenshots, traces, URLs, or metadata that prove the earliest broken postcondition.
Use explicit delivery settings, inspect every diff, and replay repaired tests before accepting changes.

Éviter

Do not weaken assertions, add arbitrary sleeps, or increase timeouts to conceal an application or setup failure.
Do not treat a recovered or retried pass as a clean run without inspecting earlier attempts.
Do not persist classifications, commits, patches, or pull requests unless the user requested that action.

Foire aux questions

What access does this skill require?

It needs Momentic MCP or CLI access, project configuration, and permission to read the selected run artifacts.

Can it repair every failed test?

No. It repairs suitable test authorship issues but reports application bugs, outages, missing fixtures, and credential problems.

Does classification change saved run data?

Diagnostic classification does not save by default. Saving requires an explicit option and should follow a user request.

How does it investigate flaky tests?

It reviews quarantined, recovered, and retry-heavy runs, then compares repeated failures and unstable postconditions.

Can triage create commits or pull requests?

Yes, Momentic triage supports several delivery modes. The skill recommends explicit settings and user approval before remote delivery.

How are repairs verified?

The workflow reviews generated diffs, checks replay evidence, and reruns repaired tests before accepting a result.

Détails du développeur

Auteur

momentic-ai

Licence

MIT

Révision Skillstore

Avis de version

L’auteur n’a déclaré aucune version.

Dépôt

https://github.com/momentic-ai/skills/tree/88379b4443b88b1f6c5a0b52b476030bc95d341e/skills/momentic-maintain

Réf

0163af2a467ae752b7eaa3c69de00711c4b1e429

Récence de maintenance

22/08/2026

Utilisation

1 téléchargements · 0 vues

Structure de fichiers

📄 SKILL.md