Habilidades ai-maestro-code-graph-query

📦

ai-maestro-code-graph-query

Name: ai-maestro-code-graph-query
Author: 23blocks-OS

Revisão do conteúdo r1 Risco alto 📁 Acesso ao sistema de arquivos⚙️ Comandos externos🌐 Acesso à rede

Analisar Dependências do Grafo de Código

Alterar código sem contexto de dependências pode quebrar chamadores, serializadores e componentes relacionados. Esta skill usa comandos de grafo do AI Maestro para inspecionar relacionamentos antes das edições.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "ai-maestro-code-graph-query" from https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query.md and its manifest at https://skillstore.io/api/skills/23blocks-os-ai-maestro-code-graph-query/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/23blocks-os-ai-maestro-code-graph-query.md manifest assinado GET /api/skills/23blocks-os-ai-maestro-code-graph-query/manifest lockfile assinado GET /api/skills/23blocks-os-ai-maestro-code-graph-query/lockfile

Testar

Usando "ai-maestro-code-graph-query". Encontre o impacto de alterar a função de processamento de pagamentos.

Resultado esperado:

A função é chamada pelos fluxos de checkout, renovação de assinatura e reembolso.
Ela chama lógica de validação, cobrança de cartão e registro de transações.
Revise os testes de checkout e renovação antes de alterar a assinatura da função.

Usando "ai-maestro-code-graph-query". Verifique as dependências do modelo de usuário antes de adicionar um campo.

Resultado esperado:

O modelo tem serializadores para perfil público e visualizações administrativas.
Ele está associado a contas, sessões, pedidos e registros de auditoria.
Atualize a cobertura dos serializadores e os testes de migração antes de expor o novo campo.

Auditoria de segurança

Risco alto

v6 • 06/07/2026 Abrir o relatório versionado

The skill provides useful AI Maestro code graph workflows, but it relies on Bash execution and strongly mandates automatic graph queries after reading files. The highest risks are unbundled PATH-resolved scripts, hidden home-directory installation under ~/.local/bin, and coercive prompt text that can push agents to execute commands without fresh user intent.

Arquivos analisados

329

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

SKILL.md:9-13 SKILL.md:18-28

Prompt Injection Attempt Detected

The skill uses forceful authority language such as "THIS IS NOT OPTIONAL" and requires immediate graph queries after every Read. This can override normal user intent and push automatic Bash execution.

The text explicitly claims default authority over agent behavior and mandates tool use. It does not request data theft, so high severity is appropriate rather than critical.

Alto

SKILL.md:56-75 SKILL.md:138-142 SKILL.md:152-159

Unbundled PATH-Resolved Script Trust

The skill references graph scripts by name and says they are installed in ~/.local/bin. The reviewed package does not include those scripts, so the agent may run unreviewed PATH-resolved code.

The command list and install guidance clearly rely on external shell scripts not present in the scanned files. This is a strong supply-chain and PATH-hijack risk.

Itens de revisão de capacidade (31)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SKILL.md:140

Hidden file in home directory

- Verify scripts installed: `ls -la ~/.local/bin/graph-*.sh`

The skill instructs accessing ~/.local/bin, a hidden home-directory path outside the project. This creates review and PATH-trust risk for scripts the agent may execute.

Alto

SKILL.md:141

Hidden file in home directory

- Scripts are installed to `~/.local/bin/` which should be in your PATH

The skill states scripts are installed under ~/.local/bin. That hidden home location can hold mutable executables outside marketplace review.

Alto

SKILL.md:159

Hidden file in home directory

This installs scripts to `~/.local/bin/`.

The install note says scripts are placed under ~/.local/bin. This hidden home-directory installation target is outside the reviewed skill package.

Médio

SKILL.md:40-45

Ruby/shell backtick execution

```bash

This command is part of the skill workflow for graph lookup and is intended to be run by the agent. It is legitimate functionality but still represents local command execution risk.

Médio

SKILL.md:48-52

Ruby/shell backtick execution

```bash

This command is part of the skill workflow for graph lookup and is intended to be run by the agent. It is legitimate functionality but still represents local command execution risk.

Médio

SKILL.md:63-64

Ruby/shell backtick execution

| `graph-describe.sh <name>` | Describe a component or function |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:64-65

Ruby/shell backtick execution

| `graph-find-callers.sh <function>` | Find all functions that call this function |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:65-66

Ruby/shell backtick execution

| `graph-find-callees.sh <function>` | Find all functions called by this function |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:66-67

Ruby/shell backtick execution

| `graph-find-related.sh <component>` | Find related components (extends, includes, etc.) |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:67-68

Ruby/shell backtick execution

| `graph-find-by-type.sh <type>` | Find all components of a type (model, controller, etc.) |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:68-69

Ruby/shell backtick execution

| `graph-find-serializers.sh <model>` | Find serializers for a model |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:69-70

Ruby/shell backtick execution

| `graph-find-associations.sh <model>` | Find model associations (belongs_to, has_many) |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:70-75

Ruby/shell backtick execution

| `graph-find-path.sh <from> <to>` | Find call path between two functions |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:75-81

Ruby/shell backtick execution

| `graph-index-delta.sh [project-path]` | **Delta index** - only re-index changed files |

The skill documents a delta indexing script that can process project paths. This is local command execution over repository content and should require user awareness.

Médio

SKILL.md:81-87

Ruby/shell backtick execution

```bash

The code block explicitly instructs running graph-index-delta.sh, optionally with a project path. This is intended Bash execution over local files.

Médio

SKILL.md:107

Ruby/shell backtick execution

| Model | `graph-describe.sh`, `graph-find-serializers.sh`, `graph-find-associations.sh` |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:108

Ruby/shell backtick execution

| Controller | `graph-describe.sh`, `graph-find-callees.sh` |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:109

Ruby/shell backtick execution

| Service | `graph-describe.sh`, `graph-find-callers.sh` |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:110

Ruby/shell backtick execution

| Function | `graph-find-callers.sh`, `graph-find-callees.sh` |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:111-112

Ruby/shell backtick execution

| Serializer | `graph-describe.sh` |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:112-126

Ruby/shell backtick execution

| Any class | `graph-find-related.sh` |

The line documents a graph command that the skill later tells agents to run automatically. Because the command is PATH-resolved, it carries local execution and trust-boundary risk.

Médio

SKILL.md:126-127

Ruby/shell backtick execution

Use with `graph-find-by-type.sh`:

This line references graph-find-by-type.sh as a command users should run with selected type values. It is lower-risk documentation but still part of Bash-driven workflow.

Médio

SKILL.md:139-140

Ruby/shell backtick execution

- Check PATH: `which graph-describe.sh`

The troubleshooting step asks the agent or user to run which against a graph script. The command is low impact but confirms local shell execution is part of the skill.

Médio

SKILL.md:140-141

Ruby/shell backtick execution

- Verify scripts installed: `ls -la ~/.local/bin/graph-*.sh`

The line instructs listing ~/.local/bin graph scripts. This reads a hidden home directory and supports execution of locally installed scripts.

Médio

SKILL.md:142-145

Ruby/shell backtick execution

- If not found, run: `./install-graph-tools.sh`

The skill tells users to run ./install-graph-tools.sh if commands are missing. The installer is not included in the scanned files, so running it is unreviewed local code execution.

Médio

SKILL.md:145-155

Ruby/shell backtick execution

- Ensure AI Maestro is running: `curl http://localhost:23000/api/agents`

The skill instructs running curl against a local API endpoint. This is a network-capable command and interacts with a local service outside the skill files.

Médio

SKILL.md:155-157

Ruby/shell backtick execution

```bash

This code block contains the install-graph-tools.sh command. Running an installer that is not present in the reviewed files is local execution risk.

Médio

SKILL.md:140

Hidden file access

- Verify scripts installed: `ls -la ~/.local/bin/graph-*.sh`

The line directs listing graph scripts in ~/.local/bin. That is access to a hidden home directory and supports execution of unbundled local tools.

Médio

SKILL.md:141

Hidden file access

- Scripts are installed to `~/.local/bin/` which should be in your PATH

The skill relies on scripts installed in ~/.local/bin. This hidden path access is part of the intended operating model.

Médio

SKILL.md:159

Hidden file access

This installs scripts to `~/.local/bin/`.

The installer destination is ~/.local/bin, a hidden home-directory path. The marketplace package does not include the installed scripts for review.

Baixo

SKILL.md:145

Hardcoded URL

- Ensure AI Maestro is running: `curl http://localhost:23000/api/agents`

The URL is limited to localhost, so there is no evidence of external exfiltration. It still directs a network request to a local service and should be disclosed.

Fatores de risco

📁 Acesso ao sistema de arquivos (8)

output.json:18 output.json:18 SKILL.md:140 SKILL.md:141 SKILL.md:159 SKILL.md:140 SKILL.md:141 SKILL.md:159

⚙️ Comandos externos (40)

🌐 Acesso à rede (1)

SKILL.md:145

Auditado por: codex Ver histórico de auditoria →

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/23blocks-os-ai-maestro-code-graph-query/security.svg)](https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/23blocks-os-ai-maestro-code-graph-query/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/23blocks-os-ai-maestro-code-graph-query.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

23blocks-OS. (2026). ai-maestro-code-graph-query security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query/audits/6

Citação BibTeX

@techreport{23blocks-os-23blocks-os-ai-maestro-code-graph-query-2026,
  author = {23blocks-OS},
  title = {ai-maestro-code-graph-query security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "ai-maestro-code-graph-query security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "23blocks-OS"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/23blocks-os-ai-maestro-code-graph-query/audits/6"
identifiers:
  - type: other
    value: "skillstore:23blocks-os-ai-maestro-code-graph-query:audit:6"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Revisar o Impacto de Alterações em Modelo

Encontrar serializadores, associações e código dependente antes de alterar um modelo.

Preparar Refatorações Mais Seguras

Identificar chamadores e chamados antes de alterar a assinatura de uma função ou mover lógica.

Explorar Bases de Código Desconhecidas

Mapear relacionamentos entre controllers, services, jobs e componentes durante o onboarding.

Teste estes prompts

Inspecionar Um Componente

Use o grafo de código para descrever este componente. Resuma do que ele depende e o que depende dele.

Verificar Impacto de Função

Encontre os chamadores e chamados desta função. Explique quais chamadores precisam de revisão antes que eu a edite.

Revisar Dependências do Modelo

Encontre serializadores, associações e componentes relacionados para este modelo. Destaque quaisquer dependências downstream arriscadas.

Rastrear Fluxo Entre Camadas

Rastreie o caminho de chamada entre este ponto de entrada e esta função interna. Explique as principais camadas e os riscos de alteração.

Boas práticas

Confirme os comandos de grafo com o usuário antes de executar Bash em um repositório.
Atualize o índice do grafo após alterações significativas no código.
Compare os resultados do grafo com os testes antes de fazer refatorações de alto impacto.

Evitar

Executar scripts de grafo resolvidos pelo PATH sem verificar sua origem.
Tratar a saída do grafo como completa quando o índice pode estar desatualizado.
Alterar funções públicas sem revisar chamadores e testes.

Perguntas frequentes

A que esta skill se conecta?

Ela espera que o AI Maestro exponha uma API local e scripts de grafo na estação de trabalho.

Ela requer Bash?

Sim. A skill é construída em torno de comandos Bash para consultas de grafo e indexação.

Ela funciona sem um grafo indexado?

Não. O projeto deve ser indexado antes que consultas de dependências possam retornar resultados úteis.

Ela envia código para um serviço externo?

Nenhuma evidência de acesso à rede externa foi encontrada. O endpoint de API documentado é localhost.

Por que revisar os comandos antes de usar?

A skill executa scripts resolvidos pelo PATH que não estão incluídos no pacote revisado.

Quem mais se beneficia desta skill?

Desenvolvedores que precisam de contexto de dependências antes de refatorar ou alterar código compartilhado são os que mais se beneficiam.

Detalhes do desenvolvedor

Autor

23blocks-OS

Licença

MIT

Revisão da Skillstore

Aviso de versão

O autor não declarou uma versão.

Repositório

https://github.com/23blocks-OS/ai-maestro/tree/main/skills/graph-query

Referência

c1fdca50ff516318f65fed0d7f9e82797c5171dc

Atualidade da manutenção

20/07/2026

Uso

27 downloads · 188 visualizações

Estrutura de arquivos

📄 output.json

📄 SKILL.md