스킬 valet
📦
valet
콘텐츠 리비전 r1 치명적 ⚙️ 외부 명령어🌐 네트워크 접근📁 파일 시스템 접근🔑 환경 변수
Manage Valet Agents and Integrations
Building and operating Valet agents requires coordinated CLI, credential, connector, channel, and deployment steps. This skill guides those workflows with explicit confirmation, validation, and testing.
지원: Claude Codex Code(CC)
이 Skill을 자동으로 설치하지 마세요.
공식 정책에 따라 설치 작업 전에 운영자 검토가 필요합니다.
내 에이전트로 설치
이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.
에이전트 요청
Review the Skillstore skill "valet" from https://skillstore.io/skills/valetdotdev-valet.md and its manifest at https://skillstore.io/api/skills/valetdotdev-valet/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.
에이전트가 읽기 쉬운 리소스
AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.
테스트해 보기
"valet" 사용 중입니다. Create a GitHub pull request assistant for the engineering organization.
예상 결과:
A confirmed plan covering the agent project, GitHub connector, webhook channel, required token scopes, deployment, and pull request test.
"valet" 사용 중입니다. My agent needs a different API credential from other organization agents.
예상 결과:
An agent-scoped secret override plan that preserves the shared connector and limits credential exposure.
"valet" 사용 중입니다. Capture this working session as a reusable agent.
예상 결과:
- A session summary with detected tools, corrections, and workflow phases.
- A confirmation step before private session details become agent files.
- A reusable project with redacted placeholders and setup documentation.
보안 감사
치명적v1 • 2026. 8. 15. 버전별 보고서 열기
Most static matches are Markdown formatting, placeholders, or benign documentation examples rather than executable backticks or exposed credentials. Confirmed risks include unverified remote installer execution, broad organization-scoped credential sharing, private Claude session access, and predictable temporary log files. Static review was capped at 400/477 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
1
스캔된 파일
1,704
분석된 줄 수
13
검토 항목
0
오탐 무시됨
확인된 보안 우려 사항 (2)
치명적
Pipe to shell pattern
curl -fsSL https://valet.dev/install.sh | sh
The instruction downloads a remote script and executes it immediately through sh. A compromised host, DNS path, or installer can produce arbitrary code execution without integrity verification.
높음
Private Session Content Reused in Deployable Artifacts
The capture workflow reads Claude session prompts and tool history, then uses that material to generate agent files. It does not require a dedicated sensitive-data review before deployment.
The instructions explicitly read hidden session records, extract user prompts, and reuse session content when generating an agent. Placeholder replacement reduces but does not eliminate disclosure risk.
기능 검토 항목 (13)
이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.
치명적
Hardcoded URL
curl -fsSL https://valet.dev/install.sh | sh
This URL supplies a remote installer that the documented command executes immediately. Trusting mutable network content without a pinned digest or signature creates a supply-chain execution risk.
치명적
Hardcoded URL
irm https://valet.dev/install.ps1 | iex
This URL supplies a remote installer that the documented command executes immediately. Trusting mutable network content without a pinned digest or signature creates a supply-chain execution risk.
높음
Git platform tokens
3. **Org-scoped by default**: Always create connectors, channels, and env vars at the org level (`--
The guidance defaults credentials to organization scope, making one token usable through shared resources by multiple agents. This increases credential blast radius beyond least privilege.
높음
Git platform tokens
**Default to `--org` when setting env vars.** Org-scoped env vars are available to every org-scoped
The guidance defaults credentials to organization scope, making one token usable through shared resources by multiple agents. This increases credential blast radius beyond least privilege.
높음
Hidden file in home directory
`~/.claude/projects/-<cwd-with-slashes-replaced-by-dashes>/`
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
높음
Hidden file in home directory
Example: `/Users/me/Developer/my-project` → `~/.claude/projects/-Users-me-Developer-my-project/`
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
높음
Hidden file in home directory
ls -t ~/.claude/projects/-<path>/*.jsonl | head -1
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
높음
Hidden file in home directory
Also check `~/.claude/projects/<project-path>/sessions-index.json` for `summary` and `firstPrompt` f
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
중간
Hidden file access
`~/.claude/projects/-<cwd-with-slashes-replaced-by-dashes>/`
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
중간
Hidden file access
Example: `/Users/me/Developer/my-project` → `~/.claude/projects/-Users-me-Developer-my-project/`
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
중간
Hidden file access
ls -t ~/.claude/projects/-<path>/*.jsonl | head -1
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
중간
Hidden file access
Also check `~/.claude/projects/<project-path>/sessions-index.json` for `summary` and `firstPrompt` f
The workflow intentionally accesses hidden Claude project records containing session prompts and tool history. These private transcripts can contain sensitive user or project data.
중간
Temp directory access
valet logs > /tmp/valet-test-<agent-name>.log 2>&1
The workflow writes agent logs to a predictable shared /tmp path without restrictive permissions or cleanup. This can expose logs or permit symlink-based file replacement on multi-user systems.
위험 요인
⚙️ 외부 명령어 (50)
SKILL.md:7 SKILL.md:16 SKILL.md:18 SKILL.md:29-31 SKILL.md:31-35 SKILL.md:35-37 SKILL.md:37-39 SKILL.md:39-40 SKILL.md:40-47 SKILL.md:47-49 SKILL.md:49-60 SKILL.md:60-61 SKILL.md:61-68 SKILL.md:68-70 SKILL.md:70-72 SKILL.md:72-80 SKILL.md:80-86 SKILL.md:86-88 SKILL.md:88 SKILL.md:90-99 SKILL.md:99-101 SKILL.md:101-103 SKILL.md:103 SKILL.md:104 SKILL.md:106-109 SKILL.md:109 SKILL.md:113-114 SKILL.md:114-115 SKILL.md:115 SKILL.md:116 SKILL.md:117 SKILL.md:118 SKILL.md:120-124 SKILL.md:124-128 SKILL.md:128-129 SKILL.md:129 SKILL.md:130 SKILL.md:131 SKILL.md:133 SKILL.md:139 SKILL.md:140 SKILL.md:141 SKILL.md:142-144 SKILL.md:144-151 SKILL.md:151-153 SKILL.md:153-156 SKILL.md:156-158 SKILL.md:158-160 SKILL.md:160-161 SKILL.md:161-162
🌐 네트워크 접근 (10)
📁 파일 시스템 접근 (13)
감지된 패턴
Pipe to shell pattern
감사자: codex
이 보고서 공유 및 인용
버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.
보고서 링크 복사
https://skillstore.io/skills/valetdotdev-valet/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 배지
[](https://skillstore.io/skills/valetdotdev-valet?utm_source=security_passport_badge)HTML 배지
<a href="https://skillstore.io/skills/valetdotdev-valet?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/valetdotdev-valet/security.svg" alt="Skillstore security assessment" loading="lazy"></a>임베드 카드
<iframe src="https://skillstore.io/embed/skills/valetdotdev-valet.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>학술 인용 (APA · BibTeX · CFF)
APA 인용
valetdotdev. (2026). valet security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/valetdotdev-valet/audits/1BibTeX 인용
@techreport{valetdotdev-valetdotdev-valet-2026,
author = {valetdotdev},
title = {valet security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/valetdotdev-valet/audits/1},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "valet security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
- name: "valetdotdev"
date-released: "2026-08-15"
url: "https://skillstore.io/skills/valetdotdev-valet/audits/1"
identifiers:
- type: other
value: "skillstore:valetdotdev-valet:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 점수
이 점수의 이유 증거 신뢰도: 낮음 55
아키텍처
85
유지보수성
87
콘텐츠
65
커뮤니티
70
사양 준수
만들 수 있는 것
Deploy a Team Agent
Create an agent, attach shared connectors and channels, configure secrets, deploy it, and verify the complete workflow.
Build an Event Automation
Design a webhook, Slack, cron, or heartbeat agent with scoped channel instructions and tested connector access.
Capture a Repeatable Workflow
Transform a reviewed working session into reusable agent instructions, setup documentation, and deployment metadata.
이 프롬프트를 사용해 보세요
Inspect My Valet Setup
Check whether Valet is installed and authenticated. Then list my organizations and agents without making changes.
Create a Basic Agent
Create a Valet agent named <agent-name> in <organization>. Present the file and deployment plan before making changes.
Configure an Integration
Add a <service> connector and <channel-type> channel to <agent-name>. Prefer catalog resources and explain required credentials without requesting their values.
Design and Validate an Automation
Design an agent for <workflow>. Include triggers, scope boundaries, failure handling, least-privilege credentials, deployment steps, connector tests, and end-to-end validation.
모범 사례
- Review every command and target organization before execution.
- Use least-privilege secrets and test each protected connector before deployment.
- Validate manifests and complete an end-to-end channel test before declaring success.
피하기
- Do not place real credentials in prompts, project files, examples, or command history.
- Do not run installation, destructive operations, or production test events without explicit approval.
- Do not share organization-wide credentials when an agent-scoped credential is sufficient.
자주 묻는 질문
What is required before using this skill?
You need the Valet CLI. Account operations also require an authenticated Valet account.
Can the skill install the Valet CLI?
Yes, but it must explain the installer and receive explicit permission before running it.
Will the skill ask me to paste API keys?
No. It directs you to set secrets in your terminal and waits for confirmation.
Can it configure connectors and channels?
Yes. It checks Valet catalogs first, reuses existing resources, and creates custom resources only when needed.
Can it build an agent from a previous session?
Yes. Review and redact the extracted session summary before any generated project is deployed.
Does it confirm destructive operations?
Yes. Agent, connector, channel, organization, and session removal require explicit user confirmation.
개발자 세부 정보
작성자
valetdotdev라이선스
MIT
Skillstore 리비전
r1
버전 안내
작성자가 버전을 선언하지 않았습니다.
리포지토리
https://github.com/valetdotdev/skills/tree/a3e8193eb1e509e840c99cec5fec2ba1a636c296/skills/valet참조
60855416b9ec7b18f5e06fa97cdadcfda015db7a
유지보수 최신성
2026. 8. 15.
사용량
0 다운로드 · 0 조회
파일 구조
📄 SKILL.md