スキル incidentio-cli

📦

incidentio-cli

Name: incidentio-cli
Author: paymog

コンテンツリビジョン r1 中リスク ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス🔑 環境変数

Manage incident.io Operations Through the CLI

Incident response work spans incidents, alerts, schedules, catalogs, and status pages. This skill provides CLI commands and recipes for incident.io public APIs and internal dashboard endpoints.

対応: Claude Codex Code(CC)

📊 69 十分

Maintain this Skill? Claim it 📊 69 十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "incidentio-cli" from https://skillstore.io/skills/paymog-incidentio-cli.md and its manifest at https://skillstore.io/api/skills/paymog-incidentio-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/paymog-incidentio-cli.md 署名済み manifest GET /api/skills/paymog-incidentio-cli/manifest 署名済み lockfile GET /api/skills/paymog-incidentio-cli/lockfile

テストする

「incidentio-cli」を使用しています。 Show an example summary of live incidents.

期待される結果:

Illustrative result: two live incidents.
API 5xx spike: critical severity, investigating.
Payment delays: major severity, monitoring.

「incidentio-cli」を使用しています。 Prepare a new component for our public status page.

期待される結果:

Proposed component: Payments API.
Required access: imported dashboard session for the selected organization.
Planned changes: create the component, then add it to the page structure.
Approval required before applying changes.

「incidentio-cli」を使用しています。 Explain the alert route update plan.

期待される結果:

Read the current route version and escalation targets.
Prepare the affected-components binding and increment the version.
Omit incompatible users fields from escalation targets.
Request approval before writing, then verify the returned configuration.

セキュリティ監査

中リスク

v1 • 2026/10/19 バージョン別レポートを開く

All 207 static findings are false positives for their reported patterns, including Markdown backticks, service resource IDs, and intended authentication references. Two semantic findings identify credential exposure through command arguments and unsafe write-request probing. No evidence found of prompt injection or malicious exfiltration; only SKILL.md was available, so CLI implementation behavior was not verified.

スキャンされたファイル

630

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (2)

中

SKILL.md:22 SKILL.md:309-310 SKILL.md:329-330

Credential Exposure Through Command Arguments

Examples pass API keys, imported session cookies, and secret values as command arguments. Real values can reach process listings, shell history, or captured command logs.

The credential and secret examples explicitly use positional or inline arguments. Cookie import offers a pipe alternative, but argument-based examples lack exposure warnings.

中

SKILL.md:367-375 SKILL.md:381-384

Mutation-Based Endpoint Probing Without Isolation

The endpoint discovery recipe recommends authenticated POST probes and retries to learn validation rules. No sandbox requirement prevents accidental writes against live organization data.

The recipe explicitly recommends write requests as discovery probes. Actual mutation depends on endpoint defaults and validation, so successful unintended writes are a possibility.

リスク要因

⚙️ 外部コマンド (50)

🌐 ネットワークアクセス (3)

SKILL.md:8 SKILL.md:13 SKILL.md:530

📁 ファイルシステムへのアクセス (2)

SKILL.md:22 SKILL.md:22

🔑 環境変数 (4)

SKILL.md:27 SKILL.md:28 SKILL.md:49 SKILL.md:600

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/paymog-incidentio-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/paymog-incidentio-cli/security.svg)](https://skillstore.io/skills/paymog-incidentio-cli?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/paymog-incidentio-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/paymog-incidentio-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/paymog-incidentio-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

paymog. (2026). incidentio-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/paymog-incidentio-cli/audits/1

BibTeX形式の引用

@techreport{paymog-paymog-incidentio-cli-2026,
  author = {paymog},
  title = {incidentio-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/paymog-incidentio-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "incidentio-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "paymog"
date-released: "2026-10-19"
url: "https://skillstore.io/skills/paymog-incidentio-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:paymog-incidentio-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Review Active Incidents

Filter live incidents, inspect severity and status, and review related alerts and follow-ups.

Maintain Catalog Relationships

Connect services to component entries and prepare alert route expressions that populate incident custom fields.

Maintain Status Pages

Manage public page components and layouts, review subscribers, and prepare retrospective incident publications.

これらのプロンプトを試す

Check Access and Commands

Check incidentio authentication without displaying credentials. List the available incident commands and report any missing access.

Summarize Live Incidents

List live incidents in my organization. Summarize names, severities, and statuses, and follow pagination without making changes.

Prepare a Status Page Change

Inspect status page [page ID] and its components. Prepare a layout change for [requirements], and request approval before applying it.

Plan a Catalog-Based Alert Route

Inspect alert route [route ID] and service catalog relationships. Draft an affected-components expression with version checks; request approval before any write.

ベストプラクティス

Use least-privilege credentials and keep API keys, session cookies, and secret values out of command logs and shared transcripts.
Read current resource state and verify organization, permissions, and route versions before approving writes.
Use a sandbox organization for endpoint discovery and experimental internal API requests.

回避

Pasting live credentials or browser sessions into chat, inline command arguments, or shared logs.
Using production write requests as harmless endpoint discovery probes.
Applying example IDs, stale route versions, or destructive commands without checking targets and obtaining approval.

よくある質問

What must be installed before using this skill?

The incidentio CLI must already be installed. You also need network access and credentials for your incident.io organization.

Can an API key run every command?

No. Public commands use scoped Bearer keys. Internal dashboard commands require an imported authenticated browser session.

Can it create public status pages?

The documented internal commands create pages, components, and layouts. They require a browser session and remain subject to subscription limits.

Does the skill include the CLI implementation?

No. The reviewed package contains only SKILL.md instructions. The CLI implementation and its credential handling were not independently verified.

Why do alert route updates need the current version?

The documented internal API uses optimistic concurrency. Read the current version, increment it, and omit incompatible users fields from escalation targets.

How should unknown internal endpoints be tested?

Use an isolated test organization and obtain approval before write requests. Partial request bodies can still cause changes if an endpoint accepts them.

開発者情報

作成者

paymog

ライセンス

MIT

Skillstore リビジョン

バージョンに関する注意

作者はバージョンを宣言していません。

リポジトリ

https://github.com/paymog/incidentio-cli/tree/f64ee4f1e477e5b9d7a3ad90137b8c8c66566b0d/skills/incidentio-cli

参照

298c12318b1ffd7375f1acec2b5844f2ea1d16f6

メンテナンスの新しさ

2026/10/19

利用状況

0 ダウンロード · 0 閲覧

ファイル構成

📄 SKILL.md

paymog のその他のスキル

すべて表示

📦

groundcover-cli

Investigate Groundcover Production Issues

Production investigations require correlated logs, traces, metrics, and Kubernetes context. This skill provides Groundcover CLI workflows for querying telemetry and managing observability resources.

DevOps＆インフラ表示

すべて表示

📦