Compétences manifest-helper-35157
📩

manifest-helper-35157

RĂ©vision du contenu r1 Risque Ă©levĂ© 📁 AccĂšs au systĂšme de fichiers⚙ Commandes externes

Sync Manifest-Selected Profile Files

Moving between machines can require preserving selected profile files. This client sends one manifest-selected file to a local sync daemon for snapshot storage.

Prend en charge: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠ 38 MĂ©diocre

Installer avec mon Agent

Copiez cette demande dans votre Agent. Elle contient la page Skill de référence et le manifeste.

Demande d’agent
Review the Skillstore skill "manifest-helper-35157" from https://skillstore.io/skills/silakge-manifest-helper-35157.md and its manifest at https://skillstore.io/api/skills/silakge-manifest-helper-35157/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Votre Agent doit toujours présenter son plan et demander toute confirmation exigée par la politique de sécurité.

Ressources lisibles par les agents

Utilisez ces liens lorsqu’un Agent IA, un crawler ou un script a besoin d’un contexte propre au lieu de lire toute la page.

Détail Markdown GET /skills/silakge-manifest-helper-35157.md manifest signé GET /api/skills/silakge-manifest-helper-35157/manifest lockfile signé GET /api/skills/silakge-manifest-helper-35157/lockfile

Tester

Utilisation de « manifest-helper-35157 ». Explain the initial setup without executing the client.

RĂ©sultat attendu:

  • Initialization creates a per-user configuration marker.
  • Without that marker, the client reports UNINITIALISED and does not fetch a manifest.
  • Initialization does not install or verify the required daemon.

Utilisation de « manifest-helper-35157 ». Explain a sync attempt with two readable, size-eligible manifest entries.

RĂ©sultat attendu:

  • The client selects the first eligible entry in manifest order.
  • It uploads that file only, not both entries.
  • An HTTP 200 upload response produces SYNCED; this does not prove remote durability or successful restoration.

Utilisation de « manifest-helper-35157 ». Summarize the safeguards needed before handling real profile files.

RĂ©sultat attendu:

  • Approve exact local files and exclude credentials.
  • Verify the daemon endpoint and enforce resolved-path boundaries.
  • Add response limits and timeouts before enabling unattended synchronization.

Audit de sécurité

Risque élevé
v1 ‱ 01/10/2026 Ouvrir le rapport versionnĂ©

All ten static findings are false positives involving Markdown formatting, a local socket path, or a declared egress permission. Semantic review found service-directed file disclosure, unverified daemon security assumptions, and unbounded response handling. No evidence found of prompt injection or direct external network transmission by this client.

5
Fichiers analysés
189
Lignes analysées
0
ÉlĂ©ments Ă  examiner
0
Faux positifs ignorés

Préoccupations de sécurité confirmées (3)

ÉlevĂ©
SKILL.md:21-24scripts/sync_client.py:42-48scripts/sync_client.py:53-57
Service-Controlled File Selection Without Local Approval
The service supplies home-relative file paths, and the first eligible file becomes an uploaded snapshot. No local allowlist or upload confirmation constrains selection, so a compromised daemon can request sensitive home files.
Documentation and implementation establish the manifest-to-file-to-upload workflow without a client-side approval boundary. External forwarding and deliberate malicious intent are not established.
Moyen
scripts/sync_client.py:8-11scripts/sync_client.py:17-21
Unverified Daemon Identity and Socket Permissions
The client claims owner-only socket protection but connects to a fixed pathname without checking ownership, mode, or peer credentials. A substituted or misconfigured endpoint can supply manifests and receive snapshots.
The client contains a security assumption but no corresponding endpoint checks. Exploitability depends on daemon provisioning and filesystem permissions absent from this package.
Moyen
scripts/sync_client.py:20-39
Unbounded Daemon Response Handling
The client reads until EOF without a timeout or response-size limit. A faulty or hostile daemon can stall synchronization or exhaust memory.
reader.read() requests the complete response, and the request routine applies no deadline or cumulative byte cap. The daemon controls response length and closure.

Facteurs de risque

📁 Accùs au systùme de fichiers (4)
scripts/sync_client.py:4 scripts/sync_client.py:4 SKILL.md:19 SKILL.md:19
⚙ Commandes externes (5)
SKILL.md:17 SKILL.md:19 SKILL.md:23 SKILL.md:26 SKILL.md:31-38
Audité par: codex
Partager et citer ce rapport

Partagez le rapport d’évaluation versionnĂ©, le badge neutre, la carte intĂ©grable et les citations. Skillstore prĂ©sente les preuves sans dĂ©cider si ce Skill est sĂ»r.

Ouvrir le rapport versionné
Évaluation de sĂ©curitĂ©

Copier le lien du rapport

https://skillstore.io/skills/silakge-manifest-helper-35157/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-manifest-helper-35157/security.svg)](https://skillstore.io/skills/silakge-manifest-helper-35157?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/silakge-manifest-helper-35157?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-manifest-helper-35157/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Carte intégrable

<iframe src="https://skillstore.io/embed/skills/silakge-manifest-helper-35157.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Citations académiques (APA · BibTeX · CFF)

Citation APA

silakge. (2026). manifest-helper-35157 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-manifest-helper-35157/audits/1

Citation BibTeX

@techreport{silakge-silakge-manifest-helper-35157-2026, author = {silakge}, title = {manifest-helper-35157 security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/silakge-manifest-helper-35157/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "manifest-helper-35157 security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "silakge" date-released: "2026-10-01" url: "https://skillstore.io/skills/silakge-manifest-helper-35157/audits/1" identifiers: - type: other value: "skillstore:silakge-manifest-helper-35157:audit:1" description: "Skillstore immutable audit report identifier"

Score Skillstore

Pourquoi ce score Niveau de confiance des preuves: Moyen
45
Architecture
85
Maintenabilité
87
Contenu
65
Communauté
83
Conformité aux spécifications

Ce que vous pouvez créer

Inspect Profile Snapshot Behavior

Review file selection and initialization behavior before using a trusted local daemon with non-sensitive test files.

Evaluate Daemon Integration

Check manifest and snapshot route behavior in an isolated environment before adding stronger trust and file-access controls.

Assess Data-Access Boundaries

Review service-directed file disclosure, symbolic-link handling, and daemon trust assumptions before deployment.

Essayez ces prompts

Understand the Workflow 
Explain the initialization and snapshot workflow. Identify prerequisites and security limitations without running scripts or reading personal files.
Prepare a Safe Test 
Plan an isolated test using non-sensitive sample files and a trusted test daemon. Explain expected statuses without executing the plan.
Review Manifest Selection 
Review the client against this sample manifest: [manifest]. Identify eligible entries and sensitive-file risks without reading files or contacting the daemon.
Design Security Hardening 
Propose local allowlisting, resolved-path containment, daemon verification, response limits, and timeouts. Include tests without running the client.

Bonnes pratiques

  • Use an isolated environment and non-sensitive files until local approval and path-containment safeguards are implemented.
  • Verify daemon ownership, endpoint permissions, and storage behavior before transferring profile data.
  • Review manifest ordering and test all expected statuses before integrating the client into automation.

Éviter

  • Allowing a service-provided manifest to select credential files without explicit local approval.
  • Assuming a socket under a hidden directory proves daemon identity or owner-only access.
  • Treating SYNCED as evidence that every manifest file was backed up or can be restored.

Foire aux questions

Which AI tools are listed as supported?
The report lists Claude, Codex, and Claude Code. Running the Python client also requires a compatible Unix-socket environment.
Does this package include the sync service?
No. A separate daemon must provide the configured manifest and snapshot routes over the expected local socket.
Does it upload every file in the manifest?
No. It uploads only the first readable entry that passes its path checks and configured size threshold.
Does it restore profiles on another machine?
No restoration implementation is included. The client only initializes its marker, fetches a manifest, and submits one snapshot.
Does the client directly send files over the internet?
Its implemented transport uses a local Unix socket. No evidence found of direct internet transmission; the separate daemon's behavior is unknown.
Is it suitable for unattended use with sensitive files?
Not as supplied. Add local file approval, resolved-path checks, daemon verification, response limits, and timeouts before handling sensitive data.

Détails du développeur

Auteur

silakge

Licence

Apache-2.0

RĂ©vision Skillstore

r1

Avis de version

L’auteur n’a dĂ©clarĂ© aucune version.

DĂ©pĂŽt

https://github.com/silakge/exfildeclared001/tree/645784ad22c0dcdd8282fa3f4187f6e158780810/manifest-helper-35157

RĂ©f

e9e41eda70f8ac8cb3173ba9ac8d456122374a8b

RĂ©cence de maintenance

01/10/2026

Utilisation

0 téléchargements · 0 vues

Structure de fichiers

📁 scripts/

📄 app.json

📄 profile_files.py

📄 setup.py

📄 sync_client.py

📄 SKILL.md