스킬 vectoree

📦

vectoree

Name: vectoree
Author: vectoreeai

v0.9.0 콘텐츠 리비전 r1 중간 위험 🌐 네트워크 접근🔑 환경 변수⚙️ 외부 명령어📁 파일 시스템 접근

Connect Apps and Agents to Vectoree Cloud

Connecting models, authentication, data, and agent tools can require separate integration workflows. This skill provides Vectoree CLI playbooks and server-side integration guidance.

지원: Claude Codex Code(CC)

⚠️ 50 나쁨

Maintain this Skill? Claim it ⚠️ 50 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "vectoree" from https://skillstore.io/skills/vectoreeai-vectoree.md and its manifest at https://skillstore.io/api/skills/vectoreeai-vectoree/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/vectoreeai-vectoree.md 서명된 manifest GET /api/skills/vectoreeai-vectoree/manifest 서명된 lockfile GET /api/skills/vectoreeai-vectoree/lockfile

테스트해 보기

"vectoree" 사용 중입니다. Check an already linked project's Vectoree connection without changing settings.

예상 결과:

Example result: the current directory is linked to a Vectoree project.
Existing login and project settings remain unchanged.
Credentials are omitted from the report.

"vectoree" 사용 중입니다. Plan app-user login with email verification.

예상 결과:

Integration plan: the browser submits to the application's backend-for-frontend.
The backend uses a scoped project key to call Vectoree App Auth.
Registration and verification use an eight-digit email code.
OAuth setup remains with the project owner when provider credentials are missing.

"vectoree" 사용 중입니다. Review the proposed Codex provider setup.

예상 결과:

Review result: back up existing configuration and preserve unrelated MCP entries.
Configure the requested Vectoree provider with a project or employee key.
Do not run the remote installer until its contents and integrity have been verified.

보안 감사

중간 위험

v1 • 2026. 10. 21. 버전별 보고서 열기

Most static matches are Markdown delimiters, placeholders, or documented server-side authentication and configuration. Four URL findings recommend executing mutable remote installers without integrity verification. Additional workflow risks include unsolicited search-server replacement and persistent installation of mutable remote instructions; no evidence found of deliberate credential exfiltration.

스캔된 파일

1,006

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (2)

중간

SKILL.md:174-179 scenarios/tool-hub.md:15-32

Search setup examples can remove existing providers without a switch request

The add-search example uses --replace-search, although the playbook reserves removal for an explicit switch request. Following it can delete working search integrations without authorization.

The intent table distinguishes adding from switching, but the shared commands always include the removal flag. This directly contradicts the stated preservation rule.

중간

SKILL.md:59-65 SKILL.md:320-331

Mutable remote instructions become persistent agent guidance

Setup says, "Also save the latest copy of this file into the agent skill directory and enable it." Missing playbooks load from mutable main-branch URLs without review or integrity checks, allowing later upstream changes to become trusted agent instructions.

The text explicitly enables the latest remote copy and offers mutable playbook fallbacks. No version pin or content-integrity gate is specified for these instructions.

기능 검토 항목 (4)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

높음

scenarios/model-gateway.md:155

Hardcoded URL

bash <(curl -fsSL https://vectoree.ai/scripts/codex-vectoree-setup.sh)

The command executes a freshly downloaded shell script without integrity verification or prior inspection. A compromised response would run with the user's shell privileges.

높음

scenarios/model-gateway.md:160

Hardcoded URL

irm https://vectoree.ai/scripts/codex-vectoree-setup.ps1 | iex

The command pipes a freshly downloaded PowerShell script directly to Invoke-Expression. No pinned artifact, signature check, or prior inspection protects the user's environment.

높음

SKILL.md:291

Hardcoded URL

bash <(curl -fsSL https://vectoree.ai/scripts/codex-vectoree-setup.sh)

The example prompt tells the agent to run a downloaded shell script immediately. No integrity verification or inspection protects local credentials and configuration.

높음

SKILL.md:293

Hardcoded URL

irm https://vectoree.ai/scripts/codex-vectoree-setup.ps1 | iex

The example prompt pipes remote PowerShell content directly into execution. The mutable script is not pinned or verified before obtaining local execution privileges.

위험 요인

🌐 네트워크 접근 (31)

🔑 환경 변수 (23)

⚙️ 외부 명령어 (50)

📁 파일 시스템 접근 (8)

scenarios/model-gateway.md:147 scenarios/model-gateway.md:171 scenarios/model-gateway.md:187 scenarios/model-gateway.md:147 scenarios/model-gateway.md:171 scenarios/model-gateway.md:187 scenarios/tool-hub.md:81 scenarios/tool-hub.md:81

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/vectoreeai-vectoree/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/vectoreeai-vectoree/security.svg)](https://skillstore.io/skills/vectoreeai-vectoree?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/vectoreeai-vectoree?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vectoreeai-vectoree/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/vectoreeai-vectoree.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

vectoreeai. (2026). vectoree security audit report (audit version 1) [Author version 0.9.0]. Skillstore. https://skillstore.io/skills/vectoreeai-vectoree/audits/1

BibTeX 인용

@techreport{vectoreeai-vectoreeai-vectoree-2026,
  author = {vectoreeai},
  title = {vectoree security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vectoreeai-vectoree/audits/1},
  note = {Author version 0.9.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "vectoree security audit report (audit version 1)"
version: "0.9.0"
type: report
authors:
  - name: "vectoreeai"
date-released: "2026-10-21"
url: "https://skillstore.io/skills/vectoreeai-vectoree/audits/1"
identifiers:
  - type: other
    value: "skillstore:vectoreeai-vectoree:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

100

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Build an application backend

Connect a project and add app-user login, persistent records, and image uploads through documented server-side integration paths.

Integrate model capabilities

Discover available models, test the requested modality, and adapt existing SDK calls to the Vectoree gateway.

Configure coding-agent services

Add hosted MCP tools or configure a requested Codex provider change while preserving unrelated settings.

이 프롬프트를 사용해 보세요

Check project connection

Check this project's Vectoree connection. Report the linked project without printing credentials or changing configuration. Ask before making any billable validation call.

Add server-side chat

Add a Vectoree chat route to this application. Discover a suitable model, keep the project key server-side, and request approval before a billable test.

Add app-user authentication

Add Vectoree app-user login with email verification. Use a server-side BFF and scoped auth key. Keep developer Cloud login separate.

Plan a Codex provider change

Prepare a Vectoree provider configuration for Codex. Show a minimal configuration diff and backup plan. Do not execute remote installers or modify settings without approval.

모범 사례

Keep scoped project credentials server-side and exclude credential-bearing environment and MCP files from version control.
Review and verify downloaded installers and skill updates before executing or enabling them.
Confirm provider changes, search replacement, destructive SQL, and billable validation calls before proceeding.

피하기

Expose project secrets in browser bundles, public environment variables, logs, or committed configuration.
Replace existing search providers or change Codex configuration without an explicit request.
Treat authentication, model, or storage commands as interchangeable, or invent unsupported platform APIs.

자주 묻는 질문

Does this skill include the Vectoree CLI?

No. It provides instructions that call the external Vectoree CLI and documented service endpoints.

Can this skill work without a Vectoree account?

Cloud operations need project access and appropriate credentials. Reviewing the playbooks does not require an account.

Where should project API keys be stored?

Use server-side configuration and exclude credential-bearing files from git. Never expose project keys in browser bundles or printed results.

Are model and tool tests free?

Do not assume they are free. Model calls, Tool Hub requests, and app authentication email can consume the organization wallet.

Can it configure Codex to use Vectoree?

Yes, the playbook documents provider configuration and backup guidance. Its remote installer examples require independent inspection and integrity verification.

Does it deploy applications or provide signed storage URLs?

No. Self-service deployment and CLI signed-URL commands are outside the documented launch scope.