스킬 gravitas
📦

gravitas

콘텐츠 리비전 r1 높은 위험 📁 파일 시스템 접근⚙️ 외부 명령어🔑 환경 변수🌐 네트워크 접근

Verify Repository Changes with Gravitas

Coding agents can change repositories without clear scope or reliable evidence. Gravitas provides task contracts, adaptive planning, and verification guidance tied to observed results.

지원: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청
Review the Skillstore skill "gravitas" from https://skillstore.io/skills/udaysharmadev-gravitas.md and its manifest at https://skillstore.io/api/skills/udaysharmadev-gravitas/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/udaysharmadev-gravitas.md 서명된 manifest GET /api/skills/udaysharmadev-gravitas/manifest 서명된 lockfile GET /api/skills/udaysharmadev-gravitas/lockfile

테스트해 보기

"gravitas" 사용 중입니다. Plan a shared authentication timeout change without editing files.

예상 결과:

  • Scope: update the timeout definition and directly affected tests only.
  • Risks: callers may depend on the previous timeout; inspect middleware and integration coverage.
  • Verification plan: reproduce current behavior, run focused tests, then check affected callers.
  • Status: planning only. No files changed and no verification results claimed.

"gravitas" 사용 중입니다. Assess verification readiness when Python test tools are missing.

예상 결과:

  • Status: unverifiable because the required test runner is unavailable.
  • Evidence: no test execution results are available.
  • Next step: obtain approval to prepare the environment, then rerun the required checks.
  • Completion: not claimed.

보안 감사

높은 위험
v1 • 2026. 10. 15. 버전별 보고서 열기

Most static alerts match Markdown formatting, local documentation links, source searches, or normal verification tooling. Four execution findings retain package download risks; semantic review identifies an unconditional refusal prohibition and verification helpers that can report success without sufficient checks. No evidence found of credential exfiltration or deliberate malware.

29
스캔된 파일
4,775
분석된 줄 수
4
검토 항목
0
오탐 무시됨

확인된 보안 우려 사항 (2)

높음
resources/persona-protocol.md:146-156
Prompt Injection Attempt Detected
The persona protocol says "execute immediately, no more warnings" after confirmation and prohibits "Refuse after user has confirmed". This unconditional compliance instruction can suppress safety refusals or permission checks beyond the skill's legitimate authority.
The prohibition is explicit and unconditional within a protocol for risky requests. User confirmation cannot replace host policy or required permission checks.
중간
scripts/run-checks.sh:174-180scripts/verify.sh:138-187scripts/verify.sh:297-300
Verification Helpers Can Report Success Without Required Checks
The quick checker initializes failure state to zero and reports success when no supported checks execute. The shell verifier also permits skipped Python checks before issuing PASS, enabling unsupported completion claims.
Both helpers determine success from failure counters without requiring executed checks. Missing Python tools produce warnings without increasing the failure count.
기능 검토 항목 (4)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음
scripts/verify.py:60
Python subprocess.run
result = subprocess.run(parts, capture_output=True, text=True, timeout=300)
The TypeScript fallback can execute unpinned npx tsc when the local compiler is unavailable. Argument-list execution avoids shell injection but not registry package execution.
중간
scripts/verify.sh:100
Shell command substitution
if output=$(npx eslint . --max-warnings 0 2>&1); then
Unpinned npx eslint can resolve and execute a registry package when no local binary exists. The script provides no local-only guard or package review step.
중간
scripts/verify.sh:113
Shell command substitution
if output=$(npx vitest run --reporter=verbose 2>&1); then
The test step invokes unpinned npx vitest, which can fetch and execute a missing registry package. Verification can therefore execute unreviewed external code.
중간
scripts/verify.sh:123
Shell command substitution
if output=$(npx jest --verbose 2>&1); then
Unpinned npx jest can execute a registry-resolved package when the local tool is absent. This lacks a local-only requirement or explicit installation approval.

위험 요인

📁 파일 시스템 접근 (23)
agents/coordinator.md:6 agents/explore.md:24 agents/explore.md:49 resources/gemini-native.md:22 scripts/run-checks.sh:83 scripts/run-checks.sh:27 scripts/run-checks.sh:37 scripts/run-checks.sh:47 scripts/run-checks.sh:57 scripts/run-checks.sh:77 scripts/run-checks.sh:81 scripts/run-checks.sh:91 scripts/run-checks.sh:99 scripts/run-checks.sh:109 scripts/run-checks.sh:124 scripts/run-checks.sh:155 scripts/verify.sh:35 scripts/verify.sh:112 scripts/verify.sh:144 scripts/verify.sh:157 scripts/verify.sh:164 scripts/verify.sh:177 scripts/verify.sh:241
⚙️ 외부 명령어 (50)
agents/explore.md:113-114 agents/explore.md:114-117 agents/explore.md:117-118 agents/explore.md:118-119 agents/explore.md:119-121 agents/explore.md:121-146 agents/plan.md:115-116 agents/plan.md:116-123 resources/adversarial-critique.md:109-136 resources/memory-protocol.md:22 resources/memory-protocol.md:92-93 resources/memory-protocol.md:93 resources/memory-protocol.md:96 resources/memory-protocol.md:108-109 resources/memory-protocol.md:109-115 resources/subagent-patterns.md:55 resources/subagent-patterns.md:58 resources/subagent-patterns.md:61 resources/subagent-patterns.md:64 resources/subagent-patterns.md:79 resources/subagent-patterns.md:106 scripts/run-checks.sh:16 scripts/run-checks.sh:83 scripts/verify.py:60 scripts/verify.sh:24 scripts/verify.sh:25 scripts/verify.sh:69 scripts/verify.sh:90 scripts/verify.sh:100 scripts/verify.sh:113 scripts/verify.sh:115 scripts/verify.sh:123 scripts/verify.sh:124 scripts/verify.sh:145 scripts/verify.sh:158 scripts/verify.sh:165 scripts/verify.sh:178 scripts/verify.sh:179 scripts/verify.sh:199 scripts/verify.sh:207 scripts/verify.sh:215 scripts/verify.sh:216 scripts/verify.sh:233 scripts/verify.sh:242 scripts/verify.sh:253 scripts/verify.sh:254 scripts/verify.sh:255 scripts/verify.sh:1 SKILL.md:29 SKILL.md:38
🔑 환경 변수 (3)
agents/explore.md:65 agents/explore.md:65 resources/verification-engine.md:190
🌐 네트워크 접근 (1)
resources/memory-protocol.md:126
감사자: codex
이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기
보안 평가

보고서 링크 복사

https://skillstore.io/skills/udaysharmadev-gravitas/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/udaysharmadev-gravitas/security.svg)](https://skillstore.io/skills/udaysharmadev-gravitas?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/udaysharmadev-gravitas?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/udaysharmadev-gravitas/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/udaysharmadev-gravitas.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
학술 인용 (APA · BibTeX · CFF)

APA 인용

udaysharmadev. (2026). gravitas security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/udaysharmadev-gravitas/audits/1

BibTeX 인용

@techreport{udaysharmadev-udaysharmadev-gravitas-2026, author = {udaysharmadev}, title = {gravitas security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/udaysharmadev-gravitas/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "gravitas security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "udaysharmadev" date-released: "2026-10-15" url: "https://skillstore.io/skills/udaysharmadev-gravitas/audits/1" identifiers: - type: other value: "skillstore:udaysharmadev-gravitas:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간
68
아키텍처
85
유지보수성
87
콘텐츠
65
커뮤니티
83
사양 준수

만들 수 있는 것

Reproduce and Verify a Bug Fix

Trace affected code, capture the failing behavior, implement a scoped repair, and compare fresh verification results.

Plan a Shared Module Refactor

Map callers and dependencies, compare implementation options, define rollback steps, and choose regression checks before editing.

Review Evidence for Risky Changes

Check acceptance criteria, execution evidence, unresolved failures, and verification gaps without modifying the repository.

이 프롬프트를 사용해 보세요

Explore a Module 
Use Gravitas to inspect [module] in read-only mode. Identify its tests, callers, and relevant configuration. Report uncertainties without changing files.
Repair a Reproducible Bug 
Investigate [bug]. Reproduce it before editing and propose a narrow write scope. Use approved local validators after repair. Report skipped checks and failures.
Prepare a Refactor Contract 
Plan [refactor] without editing files. Define acceptance criteria, non-goals, allowed write scope, dependency impact, verification depth, and rollback steps. Request approval before implementation.
Review a High-Risk Migration 
Review [migration] using deep verification planning. Map affected systems and destructive risks. Require approved local validators and explicit checkpoints. Preserve host safeguards and report unverifiable criteria.

모범 사례

  • Define explicit acceptance criteria and write boundaries before multi-file or high-risk work.
  • Use reviewed, locally installed validators and confirm which checks actually executed after the final change.
  • Keep host safety rules active and record unresolved failures, skipped checks, and uncertain claims explicitly.

피하기

  • Treating prompt instructions as a substitute for installed runtime hooks or enforced permissions.
  • Running unreviewed project commands or allowing missing tools to resolve from a package registry without approval.
  • Claiming completion from a success banner when required checks were skipped or evidence is stale.

자주 묻는 질문

What does Gravitas provide?
It provides coding workflow instructions, reference guides, agent role templates, and verification helpers focused on scope and observed evidence.
Can I use it with Claude, Codex, and Claude Code?
The skill targets these tools, but available commands, agent delegation, and enforcement depend on the host and installed runtime.
Does this directory include the complete enforcement runtime?
No. Several documented CLI commands and hook-based protections require separate Gravitas runtime components.
Which languages have bundled verification helpers?
The helpers cover TypeScript, Python, Rust, and Go. Their checks depend on installed tools and project configuration.
Can verification download or execute external code?
Some helper paths use npx, which may fetch missing packages. Project tests also execute repository code; review commands and restrict permissions.
What should I review before adoption?
Remove the unconditional refusal prohibition, prevent unapproved package downloads, and ensure skipped checks cannot produce a trusted completion result.

개발자 세부 정보

작성자

udaysharmadev

라이선스

MIT

Skillstore 리비전

r1

버전 안내

작성자가 버전을 선언하지 않았습니다.

리포지토리

https://github.com/udaysharmadev/gravitas/tree/f704734d5efed3b01f658c81280f925201411bd2/skills/gravitas

참조

13501abe353a9a57a3fd00eeb961c9d43000ef50

유지보수 최신성

2026. 10. 15.

사용량

0 다운로드 · 0 조회

파일 구조

📁 agents/

📄 coordinator.md

📄 explore.md

📄 general.md

📄 plan.md

📄 verify.md

📄 PROMPT-TEMPLATE.md

📁 references/

📄 delegation.md

📄 model-routing.md

📄 reasoning.md

📄 reconnaissance.md

📄 recovery.md

📄 task-contract.md

📄 verification.md

📁 resources/

📄 adversarial-critique.md

📄 anti-rationalization.md

📄 context-management.md

📄 gemini-native.md

📄 memory-protocol.md

📄 persona-protocol.md

📄 subagent-patterns.md

📄 tool-orchestration.md

📄 verification-engine.md

📁 scripts/

📄 detect_project.py

📄 doctor.py

📄 run-checks.sh

📄 verify.py

📄 verify.sh

📄 SESSION_FAILURES.md

📄 SKILL.md

관련 스킬

전체 보기