스킬 vibestart

📦

vibestart

Name: vibestart
Author: vinkydev

콘텐츠 리비전 r1 중간 위험 ⚙️ 외부 명령어

Create and Maintain VibeStart TypeScript Projects

Project scaffolding and template upgrades require consistent choices and careful review of existing code. This skill guides vibestart CLI discovery, previews, capability additions, and maintenance.

지원: Claude Codex Code(CC)

⚠️ 50 나쁨

Maintain this Skill? Claim it ⚠️ 50 나쁨

내 에이전트로 설치

이 요청을 에이전트에 복사하세요. 공식 Skill 페이지와 매니페스트가 포함되어 있습니다.

에이전트 요청

Review the Skillstore skill "vibestart" from https://skillstore.io/skills/vinkydev-vibestart.md and its manifest at https://skillstore.io/api/skills/vinkydev-vibestart/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

에이전트는 계속해서 계획을 표시하고 보안 정책에서 요구하는 확인을 요청해야 합니다.

에이전트가 읽기 쉬운 리소스

AI 에이전트, 크롤러, 스크립트가 전체 페이지 대신 정리된 컨텍스트만 필요할 때 이 링크를 사용하세요.

Markdown 상세 GET /skills/vinkydev-vibestart.md 서명된 manifest GET /api/skills/vinkydev-vibestart/manifest 서명된 lockfile GET /api/skills/vinkydev-vibestart/lockfile

테스트해 보기

"vibestart" 사용 중입니다. Preview a new TypeScript project without writing files.

예상 결과:

Illustrative result: The selected stack is supported and the creation plan is ready for review.
No project files were written. Dependency installation and application validation were not run.
Next action: Review the destination, resolved choices, and file list before requesting creation.

"vibestart" 사용 중입니다. Explain a maintenance result that reports needs-install.

예상 결과:

Project files were written, but dependency installation and validation remain unfinished.
An exit code of zero does not mean the project checks passed.
Next action: Follow the returned installation and check steps, then review conflicts and manual changes.

"vibestart" 사용 중입니다. Explain an upgrade result containing manual source changes.

예상 결과:

The CLI reports template changes for project-owned source files but does not write those files.
Compare the previous and target template content, then adapt the relevant changes to the existing application.
Report each manual change as applied or deliberately declined, and list the validation actually completed.

보안 감사

중간 위험

v1 • 2026. 10. 10. 버전별 보고서 열기

Ten detections are false positives involving Markdown or ordinary project workflows; six describe commands that fetch and execute an unpinned npm package. Broad rollback instructions can discard unrelated edits and delete untracked files created after the operation starts. No evidence found of prompt injection, credential theft, or malicious exfiltration in the reviewed skill files; external package implementation was not available.

스캔된 파일

172

분석된 줄 수

검토 항목

오탐 무시됨

확인된 보안 우려 사항 (1)

중간

references/maintenance.md:47-53

Broad Rollback Can Delete Unrelated Project Work

The abandonment guidance uses `git restore . && git clean -fd`. It can discard unrelated tracked edits and permanently delete untracked files added after the operation.

The reference provides a blanket destructive rollback without a deletion preview or change ownership check. A clean starting worktree does not protect later additions.

기능 검토 항목 (6)

이 스킬에 대해 예상될 수 있는 실제 로컬 기능이므로 검토가 필요하지만, 확인된 악의적 동작으로는 집계되지 않습니다.

중간

SKILL.md:13

Ruby/shell backtick execution

2. Run the CLI from npm with `npx --yes vibestart-cli` (or `pnpm dlx vibestart-cli`); a global insta

The launcher fetches and executes an unpinned npm package, with npx automatically approving installation. Later preview/application pinning does not protect this initial invocation.

중간

SKILL.md:15

Ruby/shell backtick execution

4. Read `npx --yes vibestart-cli --help` for creation or `npx --yes vibestart-cli COMMAND --help` fo

The help commands invoke the unpinned npm launcher with automatic installation approval. Help inspection still executes external package code before its trust is established.

중간

SKILL.md:23

Ruby/shell backtick execution

| Create a project or use a recipe | `npx --yes vibestart-cli --list --json`

Stack discovery invokes an unpinned npm package through npx with automatic installation approval. Listing output does not eliminate the external code execution risk.

중간

SKILL.md:24

Ruby/shell backtick execution

| Add a capability | `npx --yes vibestart-cli add --list --json`

Capability discovery invokes an unpinned npm package with automatic installation approval. Even a read-only capability list executes the downloaded CLI code.

중간

SKILL.md:25

Ruby/shell backtick execution

| Diagnose an existing project | `npx --yes vibestart-cli doctor --offline --js

The doctor command uses an unpinned npx launcher with automatic installation approval. Its offline flag controls diagnostics, not the launcher's package download or execution.

중간

SKILL.md:26

Ruby/shell backtick execution

| Update a generated project | `npx --yes vibestart-cli upgrade --dry-run --j

The upgrade preview invokes an unpinned npm launcher with automatic installation approval. Preview/application pinning is advised elsewhere, but this example still exposes external package execution.

위험 요인

⚙️ 외부 명령어 (15)

SKILL.md:12 SKILL.md:13 SKILL.md:15 SKILL.md:23 SKILL.md:24 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:29 SKILL.md:34 SKILL.md:36 SKILL.md:37 SKILL.md:38 SKILL.md:42 SKILL.md:44

감사자: codex

이 보고서 공유 및 인용

버전이 지정된 평가 보고서, 중립 배지, 임베드 카드 및 인용을 공유하세요. Skillstore는 근거를 보고하지만 이 Skill의 안전 여부를 판단하지 않습니다.

버전별 보고서 열기

보고서 링크 복사

https://skillstore.io/skills/vinkydev-vibestart/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 배지

[![Skillstore security assessment](https://skillstore.io/badges/skills/vinkydev-vibestart/security.svg)](https://skillstore.io/skills/vinkydev-vibestart?utm_source=security_passport_badge)

HTML 배지

<a href="https://skillstore.io/skills/vinkydev-vibestart?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/vinkydev-vibestart/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

임베드 카드

<iframe src="https://skillstore.io/embed/skills/vinkydev-vibestart.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

학술 인용 (APA · BibTeX · CFF)

APA 인용

vinkydev. (2026). vibestart security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/vinkydev-vibestart/audits/1

BibTeX 인용

@techreport{vinkydev-vinkydev-vibestart-2026,
  author = {vinkydev},
  title = {vibestart security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/vinkydev-vibestart/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "vibestart security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "vinkydev"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/vinkydev-vibestart/audits/1"
identifiers:
  - type: other
    value: "skillstore:vinkydev-vibestart:audit:1"
    description: "Skillstore immutable audit report identifier"

Skillstore 점수

이 점수의 이유 증거 신뢰도: 중간

아키텍처

유지보수성

콘텐츠

커뮤니티

사양 준수

만들 수 있는 것

Start a TypeScript Application

Discover supported stack choices and preview a new project before creating files and installing dependencies.

Add Project Tooling

Preview supported Knip, Ultracite, or Docker additions while preserving project choices and reviewing resulting changes.

Review Template Upgrades

Diagnose maintenance state, preview an exact target release, and identify conflicts, manual changes, and required validation.

이 프롬프트를 사용해 보세요

Beginner: Inspect Project State

Inspect my vibestart project at [directory]. Use an approved CLI version, run offline diagnostics, and report configuration issues without applying changes.

Intermediate: Preview a New Project

Preview a TypeScript project at [destination] using [requirements]. Discover supported choices, ask about missing decisions, and do not create files yet.

Intermediate: Add Capabilities

Add Knip and Ultracite to [directory]. Pin an approved CLI version, preview changes, preserve unrelated work, and apply only the requested additions.

Advanced: Upgrade and Resolve Changes

Upgrade [directory] to [exact version]. Preview changes, preserve business edits, resolve conflicts, review manual source changes, and report checks and remaining work.

모범 사례

Approve and pin an exact CLI version before discovery, preview, or application; review external installation requirements.
Preview requested changes and start maintenance writes from a clean worktree without discarding unrelated edits.
Review conflicts and manual entries, then report only installation and validation steps that actually completed.

피하기

Do not apply a preview when the user requested inspection only.
Do not hand-edit the project record or use creation to migrate an existing project.
Do not use blanket rollback commands without reviewing affected files and obtaining approval for deletions.

자주 묻는 질문

Does installing this skill install the required tools?

No. The CLI, Vite+, and project dependencies require separate installation or invocation within your approved environment.

Can I inspect a project without applying changes?

Yes. Doctor is read-only, and creation or maintenance previews avoid applying project changes. The npm launcher can still require registry access.

Which capabilities can I add?

The references list Knip, Ultracite, and Docker. Check the live capability list for the approved CLI release.

Will an upgrade replace my application code?

Upgrades merge supported configuration and dependency files. Project-owned source changes appear as manual entries for review, and conflicts require resolution.

Does a successful result mean all tests passed?

No. Previews and doctor results do not validate application behavior. Deferred installation is unfinished even when the exit code is zero.

Can adding capabilities change my framework or database?

No. The add workflow is not a framework, database, runtime, or package-manager migration. Use it only for supported capability additions.