スキル k-skill-setup
📦

k-skill-setup

コンテンツリビジョン r1 高リスク ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数

Configure the k-skill Bundle and Runtime

Setting up k-skill requires coordinating installation, CLI access, and credential handling. This skill guides those steps and offers optional update checks with approval requirements.

対応: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト
Review the Skillstore skill "k-skill-setup" from https://skillstore.io/skills/nomadamas-k-skill-setup.md and its manifest at https://skillstore.io/api/skills/nomadamas-k-skill-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

テストする

「k-skill-setup」を使用しています。 Illustrative request: assess a vault-enabled workstation without making changes.

期待される結果:

  • Installation: an existing skills CLI installation is available; no duplicate plugin installation is proposed.
  • Credentials: use the available vault; do not create a plaintext fallback file.
  • Next step: approve a reviewed CLI release before running verification.

「k-skill-setup」を使用しています。 Illustrative request: explain a fallback-file check when the file exists with mode 0644.

期待される結果:

  • Result: the fallback file has broader permissions than the helper permits.
  • Expected permissions: 0600, allowing only the owner to read and write.
  • Scope: this check does not establish credential validity or service availability.
  • Next step: confirm the fallback file is necessary, then approve permission correction.

「k-skill-setup」を使用しています。 Illustrative request: review the optional daily update check before scheduling it.

期待される結果:

  • Schedule: the documented example checks daily at 09:00.
  • Security concern: the helper invokes an unpinned npm package on each run.
  • Decision: defer task creation until the checker version and removal procedure are reviewed.

セキュリティ監査

高リスク

Most static detections are benign documentation, restricted credential-file setup, or metadata checks; no evidence found of credential exfiltration or concealed malware. Global updates and scheduled execution of mutable npm packages retain genuine supply-chain and persistence risks despite consent requirements. Separately, the adapter promotes remotely fetched CLI output to primary instructions without binding it to the reviewed source.

4
スキャンされたファイル
301
解析済み行数
4
レビュー項目
0
誤検知を無視

確認済みのセキュリティ上の懸念 (2)

高
Windows scheduled task creation
schtasks /Create /SC DAILY /TN "k-skill-update-check" /TR "\"$HOME/.config/k-skill/bin/check-skill-u
schtasks creates a daily persistent task whose helper executes an unpinned npm package. Explicit opt-in reduces authorization concerns but not supply-chain exposure.
高
Mutable Remote Instructions Cross the Audit Trust Boundary
The adapter says, "follow its output as the primary instructions for this skill," then executes @nomadamas/k-skill@0 through npx. This mutable major-version selector can supply executable code and replacement instructions not bound to the reviewed source. No evidence found of a malicious package payload; the risk is unverified upstream authority over later agent behavior.
The adapter explicitly delegates primary instructions to CLI output and selects a major version rather than an immutable artifact. The CLI implementation is not included.
機能レビュー項目 (4)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

高
Hidden file in home directory
`update`는 CLI가 뒤처져 있으면 갱신하고, `npx --yes skills add NomaDamas/k-skill --all -g` 로 Vercel Agent Skills
The update operation replaces global skills across coding agents using mutable upstream sources. This can change executable instructions beyond the current skill.
高
Hidden file access
`update`는 CLI가 뒤처져 있으면 갱신하고, `npx --yes skills add NomaDamas/k-skill --all -g` 로 Vercel Agent Skills
The documented update changes global agent skill installations, including ~/.agents/skills, from mutable upstream sources. The security concern is broad replacement of trusted agent instructions.
中
Hidden file access
(crontab -l 2>/dev/null; echo "0 9 * * * $HOME/.config/k-skill/bin/check-skill-updates.sh") | cronta
The cron entry persists daily execution of a helper that runs unpinned npx --yes skills check. Consent does not eliminate mutable-package execution risk.
中
Hidden file access
schtasks /Create /SC DAILY /TN "k-skill-update-check" /TR "\"$HOME/.config/k-skill/bin/check-skill-u
The command registers persistent daily execution of a helper that invokes an unpinned npm package. The named task is optional but retains supply-chain risk.

検出されたパターン

Windows scheduled task creation
監査者: codex
このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く
セキュリティ評価

レポートリンクをコピー

https://skillstore.io/skills/nomadamas-k-skill-setup/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/nomadamas-k-skill-setup/security.svg)](https://skillstore.io/skills/nomadamas-k-skill-setup?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/nomadamas-k-skill-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/nomadamas-k-skill-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/nomadamas-k-skill-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学術引用 (APA · BibTeX · CFF)

APA形式の引用

nomadamas. (2026). k-skill-setup security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/nomadamas-k-skill-setup/audits/1

BibTeX形式の引用

@techreport{nomadamas-nomadamas-k-skill-setup-2026, author = {nomadamas}, title = {k-skill-setup security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/nomadamas-k-skill-setup/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "k-skill-setup security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "nomadamas" date-released: "2026-11-08" url: "https://skillstore.io/skills/nomadamas-k-skill-setup/audits/1" identifiers: - type: other value: "skillstore:nomadamas-k-skill-setup:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由 証拠の信頼度: 中
45
アーキテクチャ
85
保守性
87
コンテンツ
65
コミュニティ
91
仕様準拠

作成できるもの

Prepare a Development Workstation

Choose one bundle installation method, confirm CLI access, and identify only the credentials required by selected skills.

Configure Vault-Based Credentials

Check Dolshoi vault prerequisites and request missing credentials without asking users to paste secret values into chat.

Plan Periodic Update Checks

Review the optional scheduler examples, assess package execution risks, and approve only the required check task.

これらのプロンプトを試す

Review Setup Requirements
Review the k-skill setup requirements for my workstation. Identify prerequisites and existing installations without installing packages, updating skills, or creating files.
Choose an Installation Method
Compare the skills CLI and Claude Code plugin installation paths for my environment. Show proposed changes and request approval before executing either path.
Assess Credentials and Verification
Determine whether my selected skills need credentials and whether a vault is available. Report variable names and verification limits without displaying secret values.
Review Scheduled Check Security
Review the update-check example for my operating system. Identify mutable-package execution, existing task conflicts, and removal steps before proposing any scheduled task.

ベストプラクティス

  • Review and pin the CLI package before execution, and request explicit approval for installation, global updates, scheduling, and GitHub changes.
  • Use a vault when available, prepare only required credentials, and never paste secret values into chat.
  • Distinguish file-permission checks from runtime and service validation; document approved scheduled tasks and their removal procedures.

回避

  • Running the default update as a harmless check even though it can replace global skills across coding agents.
  • Creating credential files for proxy-backed skills that do not require user secrets.
  • Adding recurring tasks or unrelated automation without explicit approval and review of the executed package.

よくある質問

Which agent tools does this setup target?
The instructions describe general skills CLI installation for coding agents and a separate Claude Code plugin route. Claude, Codex, and Claude Code are listed.
Do I need to install the CLI globally?
No. The documented default uses npx. Global installation is optional for users who need a persistent command.
Must I create a secrets.env file?
No. Prefer environment variables or a vault. Many proxy-backed features need no user API key, and Dolshoi mode prohibits creating this file.
What does the bundled verification script check?
It checks whether the selected secrets file exists and has mode 0600. It does not validate secret values, Node.js, or remote services.
Does update only check for new versions?
No. The default update can refresh the CLI and global agent skills. The instructions provide check-only alternatives and require approval before external changes.
Are scheduled checks and GitHub starring required?
No. Both are optional and require consent. Scheduled checks execute external packages, while GitHub starring also requires authenticated GitHub CLI access.

開発者情報

作成者

nomadamas

ライセンス

MIT

Skillstore リビジョン

r1

バージョンに関する注意

作者はバージョンを宣言していません。

参照

9938f91a9ab0f5763a54332b129295339bf829dd

メンテナンスの新しさ

2026/11/9

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

nomadamas のその他のスキル

すべて表示
すべて表示