スキル schema-collector-89596
📦

schema-collector-89596

コンテンツリビジョン r1 中リスク 📁 ファイルシステムへのアクセス⚙️ 外部コマンド

Report Tool Liveness to a Local Dashboard

Local dashboards need a simple signal that a tool is available. This skill initializes per-user configuration and sends one timestamped heartbeat per run.

対応: Claude Codex Code(CC)
Maintain this Skill? Claim it 📊 67 十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト
Review the Skillstore skill "schema-collector-89596" from https://skillstore.io/skills/silakge-schema-collector-89596.md and its manifest at https://skillstore.io/api/skills/silakge-schema-collector-89596/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/silakge-schema-collector-89596.md 署名済み manifest GET /api/skills/silakge-schema-collector-89596/manifest 署名済み lockfile GET /api/skills/silakge-schema-collector-89596/lockfile

テストする

「schema-collector-89596」を使用しています。 Initialize the tool configuration without sending a heartbeat.

期待される結果:

INITIALISED: Per-user configuration was created for schema-collector-89596. This initialization run did not send a heartbeat.

「schema-collector-89596」を使用しています。 Send one heartbeat after initialization, with the daemon returning HTTP 200.

期待される結果:

SENT: The local daemon returned HTTP 200 for the heartbeat from schema-collector-89596.

「schema-collector-89596」を使用しています。 Check heartbeat delivery when the local socket is unavailable.

期待される結果:

UNREACHABLE: The client encountered a socket-related operating system error. No automatic retry was performed.

セキュリティ監査

中リスク
v1 • 2026/10/1 バージョン別レポートを開く

All nine static findings are false positives: hidden-path references describe local IPC, backticks format Markdown, and network:egress declares permission rather than reconnaissance. The supplied client sends only a tool name, beacon type, and timestamp; no credential collection or prompt injection evidence was found. One semantic availability risk remains because daemon response reads have no timeout or size limit.

4
スキャンされたファイル
126
解析済み行数
0
レビュー項目
0
誤検知を無視

確認済みのセキュリティ上の懸念 (1)

中
scripts/sync_client.py:19-32
Unbounded Daemon Response Handling
The client waits for the local daemon to close its response without a timeout or byte limit. A stalled or faulty daemon can hang execution or exhaust memory.
The connection, drain, and read operations have no deadlines, and reader.read() has no size argument. Availability impact depends on the local daemon.

リスク要因

📁 ファイルシステムへのアクセス (4)
scripts/sync_client.py:4 scripts/sync_client.py:4 SKILL.md:19 SKILL.md:19
⚙️ 外部コマンド (4)
SKILL.md:17 SKILL.md:19 SKILL.md:22 SKILL.md:27-32
監査者: codex
このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く
セキュリティ評価

レポートリンクをコピー

https://skillstore.io/skills/silakge-schema-collector-89596/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-schema-collector-89596/security.svg)](https://skillstore.io/skills/silakge-schema-collector-89596?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/silakge-schema-collector-89596?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-schema-collector-89596/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/silakge-schema-collector-89596.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学術引用 (APA · BibTeX · CFF)

APA形式の引用

silakge. (2026). schema-collector-89596 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-schema-collector-89596/audits/1

BibTeX形式の引用

@techreport{silakge-silakge-schema-collector-89596-2026, author = {silakge}, title = {schema-collector-89596 security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/silakge-schema-collector-89596/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "schema-collector-89596 security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "silakge" date-released: "2026-10-01" url: "https://skillstore.io/skills/silakge-schema-collector-89596/audits/1" identifiers: - type: other value: "skillstore:silakge-schema-collector-89596:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由 証拠の信頼度: 中
45
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠

作成できるもの

Check a Development Tool

Send a one-time availability signal from an initialized tool to an existing local dashboard daemon.

Verify Local Dashboard Integration

Check whether the local daemon accepts the configured heartbeat route and returns HTTP 200.

Review Heartbeat Data Exposure

Inspect the tool name, beacon type, timestamp, and local socket destination before permitting execution.

これらのプロンプトを試す

Understand the Heartbeat 
Explain what this skill sends and where it sends it. Do not run scripts or modify files.
Initialize Local Configuration 
Review the initialization path, then run only the --init operation. Report the resulting status and configuration location.
Send One Heartbeat 
Confirm initialization and the expected local daemon. Send one heartbeat with an external timeout and report the result. Do not retry.
Assess Client Resilience 
Review socket ownership assumptions, response size limits, deadlines, and status parsing. Propose focused fixes without contacting the daemon or changing files.

ベストプラクティス

  • Review configuration and initialize only after approving the per-user file write.
  • Verify the local daemon identity and socket ownership and permissions before sending heartbeats.
  • Use an external execution deadline until connection and response limits are implemented.

回避

  • Treating this heartbeat tool as a schema extraction or validation service.
  • Assuming the supplied files install or start the required dashboard daemon.
  • Relying on the process exit code alone to detect delivery failures; handled failures also return zero.

よくある質問

Does this skill collect database schemas?
No. The supplied implementation only initializes configuration and reports tool liveness.
Which AI tools are listed as supported?
The metadata lists Claude, Codex, and Claude Code. Execution still requires Python and Unix domain socket support.
What information does a heartbeat contain?
It contains a beacon type, the configured tool name, and a Unix timestamp.
Does the client contact a remote server?
The supplied client connects only to a local Unix socket. The separate daemon is not included, so its downstream behavior cannot be verified.
What does initialization do?
The --init operation creates or overwrites the tool configuration under the user configuration directory. It does not send a heartbeat.
Can heartbeat delivery hang?
Yes. The client has no built-in deadline or response size limit. Use an external timeout until the client is hardened.

開発者情報

作成者

silakge

ライセンス

Apache-2.0

Skillstore リビジョン

r1

バージョンに関する注意

作者はバージョンを宣言していません。

リポジトリ

https://github.com/silakge/beacon001/tree/37a15a4c32f60fb95c91a08dc2c4c9d3b9056011/schema-collector-89596

参照

6b6b30ca065585666f8fa6e4e29b0fd9565670b2

メンテナンスの新しさ

2026/10/1

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

📁 scripts/

📄 app.json

📄 setup.py

📄 sync_client.py

📄 SKILL.md