スキル captain-obvious

📦

captain-obvious

Name: captain-obvious
Author: shmulc8

コンテンツリビジョン r1 中リスク 📁 ファイルシステムへのアクセス⚙️ 外部コマンド⚡ スクリプトを含む🌐 ネットワークアクセス

Audit TypeScript and Python Test Quality

Redundant assertions can inflate confidence without protecting observable behavior. Captain Obvious combines deterministic scanners with contextual review and a test-authoring contract checklist.

対応: Claude Codex Code(CC)

⚠️ 50 不十分

Maintain this Skill? Claim it ⚠️ 50 不十分

自分のエージェントでインストール

このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。

エージェントリクエスト

Review the Skillstore skill "captain-obvious" from https://skillstore.io/skills/shmulc8-captain-obvious.md and its manifest at https://skillstore.io/api/skills/shmulc8-captain-obvious/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。

エージェントが読めるリソース

AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。

Markdown詳細 GET /skills/shmulc8-captain-obvious.md 署名済み manifest GET /api/skills/shmulc8-captain-obvious/manifest 署名済み lockfile GET /api/skills/shmulc8-captain-obvious/lockfile

テストする

「captain-obvious」を使用しています。 Review a Python test that assigns a local value of five and immediately checks that it equals five.

期待される結果:

Finding: local constant echo.
Reason: the assertion repeats the test arrangement and does not inspect production behavior.
Next step: identify the intended contract before replacing or removing the test.

「captain-obvious」を使用しています。 Review a TypeScript promise rejection assertion that is not awaited.

期待される結果:

Finding: advisory asynchronous assertion.
Reason: failure behavior depends on the test runner, and the assertion is not awaited.
Proposal: await the assertion, then run the focused test after approval.

「captain-obvious」を使用しています。 Review a conditional assertion when coverage shows that its line never executed.

期待される結果:

Finding: conditional assertion promoted to proven by coverage.
Reason: the supplied coverage report records zero executions for the assertion line.
Proposal: investigate the guard and preserve the intended contract. Do not automatically delete this report-only finding.

セキュリティ監査

中リスク

v1 • 2026/10/21 バージョン別レポートを開く

Most static alerts are false positives involving documentation, template literals, AST identifiers, or legitimate toolchain operations. Confirmed risks involve shadow-file overwrite and deletion, plus symlink-following report writes to documented predictable temporary paths. The fix guards also permit irreversible changes to untracked tests; no evidence found of credential exfiltration or prompt injection.

スキャンされたファイル

3,933

解析済み行数

レビュー項目

誤検知を無視

確認済みのセキュリティ上の懸念 (1)

中

scripts/co_py/gitguard.py:24-32 scripts/co_ts/gitguard.mjs:23-30 scripts/co_py/fixer.py:155-156 scripts/co_ts/fixer.mjs:88-92

Untracked Tests Bypass Recovery Safeguards

Both Git guards use --untracked-files=no, but test discovery includes untracked files. --fix can overwrite those tests without backups or Git restoration.

Both guards explicitly exclude untracked files, while discovery and fixers do not restrict edits to tracked targets. Neither fixer creates recovery backups.

機能レビュー項目 (7)

これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。

中

scripts/captain_obvious_py.py:285

Python file write/append

with open(args.json, "w") as fh:

The report writer truncates its destination and follows symlinks. The documented predictable /tmp destination permits another local actor to redirect this write.

中

scripts/captain_obvious_ts.mjs:245

Node.js fs operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

writeFileSync follows symlinks and truncates existing destinations. Combined with the documented predictable /tmp path, this allows local report-write redirection.

中

scripts/captain_obvious_ts.mjs:245

Synchronous file operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

The report write follows existing symlinks and truncates their targets. The documented fixed /tmp output path makes this a local overwrite risk.

中

scripts/co_py/mypy_pass.py:167

Python file write/append

with open(shadow, "w", encoding="utf-8") as f:

The predictable shadow path is opened with truncation after only a symlink check. Existing regular files or hard-linked targets can be overwritten during scanning.

中

scripts/co_py/mypy_pass.py:271

Python os file operations

os.remove(s)

Cleanup removes every recorded shadow path, including paths that existed before the scan and were truncated. Existing file contents are lost without recovery.

中

SKILL.md:72

Temp directory access

node <skill-dir>/scripts/captain_obvious_ts.mjs --project <repo> --json /tmp/co-ts.json

The documented command writes to predictable /tmp/co-ts.json. An existing symlink can redirect the truncating report write to another writable file.

中

SKILL.md:73

Temp directory access

python3 <skill-dir>/scripts/captain_obvious_py.py --path <repo> --json /tmp/co-py.json

The documented command writes to predictable /tmp/co-py.json. An existing symlink can redirect Python's truncating report write to another writable file.

リスク要因

📁 ファイルシステムへのアクセス (43)

⚙️ 外部コマンド (50)

⚡ スクリプトを含む (3)

scripts/captain_obvious_ts.mjs:78 scripts/captain_obvious_ts.mjs:80 scripts/co_py/analyzer.py:7-19

🌐 ネットワークアクセス (1)

scripts/co_py/analyzer.py:570

監査者: codex

このレポートを共有・引用

バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。

バージョン別レポートを開く

レポートリンクをコピー

https://skillstore.io/skills/shmulc8-captain-obvious/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdownバッジ

[![Skillstore security assessment](https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg)](https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge)

HTMLバッジ

<a href="https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

埋め込みカード

<iframe src="https://skillstore.io/embed/skills/shmulc8-captain-obvious.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

学術引用 (APA · BibTeX · CFF)

APA形式の引用

shmulc8. (2026). captain-obvious security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/shmulc8-captain-obvious/audits/1

BibTeX形式の引用

@techreport{shmulc8-shmulc8-captain-obvious-2026,
  author = {shmulc8},
  title = {captain-obvious security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/shmulc8-captain-obvious/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "captain-obvious security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "shmulc8"
date-released: "2026-10-21"
url: "https://skillstore.io/skills/shmulc8-captain-obvious/audits/1"
identifiers:
  - type: other
    value: "skillstore:shmulc8-captain-obvious:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore スコア

このスコアの理由証拠の信頼度: 中

アーキテクチャ

保守性

コンテンツ

コミュニティ

仕様準拠

作成できるもの

Review Generated Test Suites

Find tautologies and mock echoes in generated tests, then review advisory findings against the production behavior.

Maintain Shared Test Standards

Use contract questions and documented detector categories to distinguish meaningful regression checks from redundant assertions during review.

Compare Test Changes in CI

Compare supported proven syntactic findings against a Git baseline without enabling fixes. Comparison errors return success with a diagnostic.

これらのプロンプトを試す

Review One Python Test

Review this Python test using the authoring questions. Identify its observable contract and a plausible regression. Do not run commands or edit files.

Run a Report-Only Python Audit

Audit this trusted Python repository with --no-types and without --fix. Use stdout instead of a report file. Summarize findings without deleting tests.

Review Coverage-Based Findings

Audit this trusted TypeScript project using its existing coverage report. Separate proven and advisory findings. Propose advisory changes for approval; do not edit files.

Plan a Baseline Quality Check

Review the --check workflow for this trusted repository against [base]. Explain fail-open behavior and excluded categories. Propose a report-only CI command for approval.

ベストプラクティス

Scan only trusted repositories, start without fixes, and avoid predictable shared temporary report paths.
Back up untracked tests and existing shadow-named files before scanning or fixing; Python --no-types avoids shadow-file creation.
Review each proposed deletion against its contract, obtain approval for advisory edits, and run type checks and tests afterward.

回避

Treating a clean scanner report as proof that every test can detect meaningful regressions.
Deleting advisory findings or weakening security contract tests solely because their assertions look repetitive.
Using --force, trusting Git cleanliness for untracked files, or running repository toolchains without reviewing their trust boundary.

よくある質問

Which languages and test styles are supported?

The bundled scanners target TypeScript and JavaScript Jest-style or Vitest-style tests, plus Python pytest and unittest patterns.

Does scanning execute my tests?

The scanners parse tests rather than run the test suite. They can load repository TypeScript code or execute mypy plugins and environment commands.

Can I scan without modifying Python files?

Use --no-types without --fix or a file output option. Single-file Python mode also parses source without mypy shadow files.

Are all findings automatically deleted?

No. Explicit --fix targets findings marked safe. Advisory and report-only findings require review, and advisory edits require user approval.

What does coverage input add?

Coverage can confirm that a conditional assertion never executed or suppress a finding when it did. The report must include test-file lines.

Can the baseline check enforce every finding?

No. It compares newly introduced proven syntactic findings. Type-dependent and coverage-dependent categories are excluded, and comparison failures return success with diagnostics.