スキル setup-template
📦

setup-template

コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数

Align TypeScript Repositories with Their Template

Template-derived repositories can retain missing GitHub settings and incomplete migration work even when builds pass. This skill guides repository setup and evidence-based comparisons against the template.

対応: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト
Review the Skillstore skill "setup-template" from https://skillstore.io/skills/masseater-setup-template.md and its manifest at https://skillstore.io/api/skills/masseater-setup-template/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/masseater-setup-template.md 署名済み manifest GET /api/skills/masseater-setup-template/manifest 署名済み lockfile GET /api/skills/masseater-setup-template/lockfile

テストする

「setup-template」を使用しています。 Illustrative assessment with a missing hook and an unsuccessful verification task.

期待される結果:

  • Migration status: incomplete.
  • Git hooks: incomplete. The configured hook directory does not match the expected template location.
  • Verification: incomplete. The verification task failed; include the actual task output as evidence.
  • Next steps: correct the hook configuration and investigate the failed task before repeating the assessment.

「setup-template」を使用しています。 Illustrative setup review where an existing ruleset requires tests before merging.

期待される結果:

  • Existing protection: tests must pass before merging.
  • Template difference: the proposed ruleset requires only the up-to-date check.
  • Decision needed: preserve the existing test requirement rather than replacing it with weaker protection.
  • No settings changed.

セキュリティ監査

高リスク
v1 • 2026/10/24 バージョン別レポートを開く

Most static alerts are false positives from Markdown, Japanese text, or expected GitHub operations; installation and verification execute repository-controlled code. Check mode also applies remote configuration despite the stated inspection-only boundary. The prescribed ruleset replacement can remove stronger protections, while the template criteria place verification after merging rather than before.

4
スキャンされたファイル
244
解析済み行数
1
レビュー項目
0
誤検知を無視

確認済みのセキュリティ上の懸念 (2)

高
usecases/setup.md:47-58usecases/setup.md:65-74references/typescript-template.md:79-83
Template Alignment Can Weaken Pre-Merge Protections
Setup replaces a same-named ruleset with deletion, force-push, and up-to-date protections only. The reference requires verification after main pushes and treats PR verification as obsolete, potentially removing stronger checks and allowing unverified changes onto main.
The replacement payload lists only freshness as a required status check, and the reference explicitly excludes PR verification. Existing stronger protections are not preserved.
中
SKILL.md:17usecases/check.md:9usecases/setup.md:9-42
Inspection Mode Applies Remote Configuration Changes
SKILL.md says inspection must not repair issues, but check step 5 directs the agent to apply the setup procedure. That procedure registers secrets and changes Actions permissions, merge settings, and branch rulesets, creating remote side effects during a requested assessment.
The check procedure explicitly directs configuration alignment, contradicting the stated inspection-only boundary. The referenced setup commands perform authenticated remote writes.
機能レビュー項目 (1)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中
SKILL.md:43
Ruby/shell backtick execution
- `vp install` と `vp run verify` を実行する。verify が落ちたら、落ちたタスクとその出力を最初の欠けとして扱う
Although the backticks are Markdown, the prose explicitly directs execution of vp install and vp run verify. Repository-controlled scripts can run with agent privileges without a preceding trust review.

リスク要因

⚙️ 外部コマンド (8)
SKILL.md:8 SKILL.md:10 SKILL.md:30 SKILL.md:43 SKILL.md:51 SKILL.md:52 usecases/setup.md:57 usecases/setup.md:58
🌐 ネットワークアクセス (1)
SKILL.md:8
📁 ファイルシステムへのアクセス (1)
usecases/check.md:7
🔑 環境変数 (2)
usecases/setup.md:14 usecases/setup.md:22
監査者: codex
このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く
セキュリティ評価

レポートリンクをコピー

https://skillstore.io/skills/masseater-setup-template/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/masseater-setup-template/security.svg)](https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/masseater-setup-template/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/masseater-setup-template.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学術引用 (APA · BibTeX · CFF)

APA形式の引用

masseater. (2026). setup-template security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/masseater-setup-template/audits/1

BibTeX形式の引用

@techreport{masseater-masseater-setup-template-2026, author = {masseater}, title = {setup-template security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/masseater-setup-template/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "setup-template security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "masseater" date-released: "2026-10-24" url: "https://skillstore.io/skills/masseater-setup-template/audits/1" identifiers: - type: other value: "skillstore:masseater-setup-template:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由 証拠の信頼度: 中
41
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
83
仕様準拠

作成できるもの

Initialize a Template-Derived Repository

Configure repository automation, deployment identifiers, secret names, and branch settings after creating a repository from the template.

Assess an AI-Assisted Migration

Compare the migrated repository with template elements and collect evidence for missing hooks, ineffective checks, and leftover configuration.

Review Automation Configuration

Compare GitHub settings and CI behavior with template expectations while identifying differences that require explicit policy decisions.

これらのプロンプトを試す

Review Setup Requirements 
List the setup steps for this template-derived repository. Identify required tools, permissions, and secret names without changing files or GitHub settings.
Configure an Approved Repository 
Prepare setup for [owner/repository]. Show proposed changes and existing protections first. Request approval before writes and use interactive secret entry.
Assess Migration Completeness 
Assess this migration against the template. Override setup-in-check behavior: report differences without repairs. Request approval before installation or verification, then provide evidence.
Compare Template and Security Policy 
Compare [owner/repository] with the template and our policy: [requirements]. Identify weaker rules, missing verification, and unsupported exceptions. Propose changes without applying them.

ベストプラクティス

  • Confirm the target repository and review existing permissions and rulesets before approving setup changes.
  • Enter credentials through secure interactive prompts, and review repository scripts before running installation or verification.
  • Preserve stronger organizational protections and retain command evidence for every migration judgment.

回避

  • Treating the default check workflow as read-only despite its setup step.
  • Replacing stronger branch protections solely to match the template.
  • Declaring migration complete because builds pass without checking hooks, automation, and obsolete configuration.

よくある質問

Which repositories does this skill target?
It targets repositories derived from masseater/typescript-template. Other repositories require confirmation of applicable steps before work begins.
What tools and permissions are needed?
GitHub CLI authentication and sufficient repository permissions are needed for setup. Local checks also use Vite+ and project-specific tooling.
Does check mode change anything?
Yes. It runs installation and verification and directs GitHub setup. Explicitly prohibit remote writes when requesting an assessment only.
How should I provide secrets?
Use GitHub CLI interactive prompts or approved secret management. Avoid placing secret values in chat, reports, or committed files.
Does template alignment guarantee secure branch protection?
No. The prescribed model relies on freshness checks before merging and verification afterward. Preserve stronger requirements from your organizational policy.
Are newer template features automatically migration defects?
No. The skill separates later template additions from missing migration elements and requires reasons for elements that do not apply.

開発者情報

作成者

masseater

ライセンス

MIT

Skillstore リビジョン

r1

バージョンに関する注意

作者はバージョンを宣言していません。

リポジトリ

https://github.com/masseater/skills/tree/4810c8f1186a229ca57d2f278c0a94f0fc862fec/skills/setup-template

参照

965badf91ae3b8f9a49183f5a56d91de6efc51ad

メンテナンスの新しさ

2026/10/24

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

📁 references/

📄 typescript-template.md

📄 SKILL.md

📁 usecases/

📄 check.md

📄 setup.md

masseater のその他のスキル

すべて表示

関連スキル

すべて表示