스킬 caveman-setup

📦

caveman-setup

Name: caveman-setup
Author: juliusbrussee

콘텐츠 리비전 r1 높은 위험 ⚙️ 외부 명령어🌐 네트워크 접근🔑 환경 변수

Connect your app to Caveman measurement

LLM requests can be difficult to measure across SDKs and providers. This skill identifies live callsites, routes them through Caveman, and verifies one measured request.

지원: Claude Codex Code(CC)

⚠️ 38 나쁨

Maintain this Skill? Claim it ⚠️ 38 나쁨

설치 전에 중지하고 확인을 요청하세요.

계획을 검토하고 파일을 변경하기 전에 사용자의 명시적 동의를 받으세요.

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "caveman-setup" from https://skillstore.io/skills/juliusbrussee-caveman-setup.md and its manifest at https://skillstore.io/api/skills/juliusbrussee-caveman-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/juliusbrussee-caveman-setup.md 서명된 manifest GET /api/skills/juliusbrussee-caveman-setup/manifest 서명된 lockfile GET /api/skills/juliusbrussee-caveman-setup/lockfile

테스트해 보기

"caveman-setup" 사용 중입니다. Set up measurement for the repository.

예상 결과:

Found two LLM callsites in the API service.
Added gateway URL and gateway key references through the existing environment configuration.
Verification is ready and requires approval before sending a provider request.

"caveman-setup" 사용 중입니다. Check whether the gateway integration succeeded.

예상 결과:

Verification returned HTTP 200.
The response included usage details for the configured model.
Record mode is enabled and no optimization was configured.

보안 감사

높은 위험

v9 • 2026. 9. 8. 버전별 보고서 열기

Most static findings are false positives caused by Markdown formatting, configuration examples, and documented environment-variable use. The skill intentionally routes LLM requests through a third-party gateway and can forward provider credentials in byok mode. It also directs agents to send a billable verification request without obtaining approval at execution time.

스캔된 파일

223

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

높음

SKILL.md:67-78

Credential forwarding to third-party gateway

The integration instructs clients in bring-your-own-key mode to forward an existing provider key to the configured Caveman gateway. This creates a credential disclosure boundary that users must explicitly assess before use.

The instructions explicitly require the upstream-key header in byok mode and describe gateway handling of provider authentication.

높음

SKILL.md:146-173

Network action bypasses interactive confirmation

The skill instructs the agent to send a real billable verification request without pausing for approval. This can cause external network activity and provider charges without confirmation at the time of execution.

The instructions explicitly state not to ask permission and provide curl commands for a real billable provider request.

기능 검토 항목 (10)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

SKILL.md:68

Generic API/secret keys

plus one auth header.** Gateway auth is `x-cave-api-key: CAVE_API_KEY`

The documented integration sends a gateway or upstream provider API credential in an HTTP header. This intentionally discloses a usable credential to the configured gateway and requires explicit trust in that endpoint.

높음

SKILL.md:69

Generic API/secret keys

(`Authorization: Bearer CAVE_API_KEY` also works where a header is awkward).

높음

SKILL.md:87

Generic API/secret keys

apiKey: process.env.OPENAI_API_KEY, // byok: unchanged · stored: use CAVE_API_KEY

높음

SKILL.md:89

Generic API/secret keys

"x-cave-api-key": process.env.CAVE_API_KEY!,

높음

SKILL.md:91

Generic API/secret keys

"x-cave-upstream-key": process.env.OPENAI_API_KEY!,

높음

SKILL.md:105

Generic API/secret keys

api_key=os.environ["ANTHROPIC_API_KEY"], # byok: unchanged · stored: use CAVE_API_KEY

높음

SKILL.md:107

Generic API/secret keys

"x-cave-api-key": os.environ["CAVE_API_KEY"],

높음

SKILL.md:109

Generic API/secret keys

"x-cave-upstream-key": os.environ["ANTHROPIC_API_KEY"],

높음

SKILL.md:160

Generic API/secret keys

-H "x-cave-api-key: $CAVE_API_KEY" \

높음

SKILL.md:166

Generic API/secret keys

-H "x-cave-api-key: $CAVE_API_KEY" \

위험 요인

⚙️ 외부 명령어 (50)

🌐 네트워크 접근 (4)

SKILL.md:16 SKILL.md:19 SKILL.md:130 SKILL.md:16

🔑 환경 변수 (26)

감사자: claude 감사 이력 보기 →

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/juliusbrussee-caveman-setup/security.svg)](https://skillstore.io/skills/juliusbrussee-caveman-setup?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/juliusbrussee-caveman-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/juliusbrussee-caveman-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/juliusbrussee-caveman-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

juliusbrussee. (2026). caveman-setup security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9

BibTeX 인용

@techreport{juliusbrussee-juliusbrussee-caveman-setup-2026,
  author = {juliusbrussee},
  title = {caveman-setup security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "caveman-setup security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "juliusbrussee"
date-released: "2026-09-08"
url: "https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9"
identifiers:
  - type: other
    value: "skillstore:juliusbrussee-caveman-setup:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Measure a production AI service

Route existing application LLM traffic through the gateway to capture request usage and spend.

Standardize SDK gateway routing

Apply documented gateway configuration to OpenAI, Anthropic, or framework-based LLM clients.

Verify observability onboarding

Send one minimal request and confirm that the gateway records usage before wider rollout.

이 프롬프트를 사용해 보세요

Set up basic measurement

Set up Caveman measurement for this repository. First identify all live LLM callsites and show me the planned changes.

Configure an OpenAI client

Configure the existing OpenAI SDK client to use the Caveman gateway. Use environment variables and preserve current provider behavior.

Review gateway changes

Review this repository for LLM callsites and propose the minimal Caveman gateway integration. Do not make unrelated changes.

Verify controlled rollout

After configuring Caveman, show the exact verification request and wait for my approval before sending any billable traffic.

모범 사례

Review the proposed file changes before applying them.
Store gateway and provider credentials only in ignored environment files or a managed secret store.
Confirm the target gateway and approve the billable verification request before it runs.

피하기

Do not hardcode gateway or provider credentials in application source.
Do not route traffic to an unverified gateway URL.
Do not report successful measurement without an observed verification result.

자주 묻는 질문

What does this skill configure?

It routes supported LLM client traffic through the Caveman gateway for usage and spend measurement.

Does it change model output?

The skill describes record-mode routing intended to preserve request behavior, but you should verify this in your environment.

Which client libraries are covered?

It includes patterns for OpenAI, Anthropic, Vercel AI SDK, LangChain, LangGraph, LiteLLM, and raw HTTP.

Are credentials required?

Yes. A Caveman API key is required, and bring-your-own-key mode may send an existing provider key to the gateway.

Does verification cost money?

Yes. Verification sends one real provider request and can create provider charges.

Should I approve network activity first?

Yes. Confirm the gateway URL, credential handling, and verification request before allowing network activity.

개발자 세부 정보

작성자

juliusbrussee

라이선스

MIT

Skillstore 리비전

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/juliusbrussee/caveman/tree/15581d14007fd01fb3f132016741962f34936ca2/skills/caveman-setup

참조

0acc95b40c367e2016e824a72b27b83b507ef020

유지보수 최신성

2026. 9. 8.

사용량

1 다운로드 · 0 조회

파일 구조

📄 SKILL.md