Habilidades insforge-integrations

📦

insforge-integrations

Name: insforge-integrations
Author: insforge

Revisão do conteúdo r1 Crítico 🌐 Acesso à rede🔑 Variáveis de ambiente⚙️ Comandos externos

Build InsForge Auth and x402 Integrations

Connecting external identity and payment providers to InsForge requires careful token, database, and protocol setup. This skill provides provider-specific implementation and verification guidance.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Não instale este Skill automaticamente.

A política canônica exige a revisão de um operador antes de qualquer ação de instalação.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "insforge-integrations" from https://skillstore.io/skills/insforge-insforge-integrations.md and its manifest at https://skillstore.io/api/skills/insforge-insforge-integrations/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/insforge-insforge-integrations.md manifest assinado GET /api/skills/insforge-insforge-integrations/manifest lockfile assinado GET /api/skills/insforge-insforge-integrations/lockfile

Testar

Usando "insforge-integrations". Connect Clerk to an InsForge notes application with owner-only access.

Resultado esperado:

A Clerk JWT template configuration using the InsForge signing secret.
A client token-refresh flow that updates InsForge authentication state.
A notes table design with string user IDs and owner-only policies.

Usando "insforge-integrations". Plan a Better Auth integration for a Vite application and InsForge Postgres.

Resultado esperado:

A dedicated Better Auth schema and migration sequence.
A server bridge that validates sessions and issues short-lived InsForge tokens.
A same-origin proxy plan with cookie and origin requirements.

Usando "insforge-integrations". Design a secure OKX x402 endpoint for a paid report.

Resultado esperado:

A payment challenge flow with explicit network, asset, amount, and recipient checks.
A facilitator verification and settlement sequence with failure handling.
A private payment ledger and production readiness checklist.

Auditoria de segurança

Crítico

v1 • 10/09/2026 Abrir o relatório versionado

The static alerts are false positives caused by documentation, placeholders, structured encoding, and intended provider calls. Semantic review found critical payment-signing weaknesses, a production payment bypass risk, and public exposure of linked payment metadata.

Arquivos analisados

2,663

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (4)

Crítico

references/okx-x402.md:98 references/okx-x402.md:640-651

Mock Mode Still Requests a Real Transfer Authorization

The guide states that mock mode still asks the wallet for a real EIP-3009 signature. A reusable authorization may expose test users to unintended settlement.

The guide explicitly says mock mode preserves real wallet signing, and the sample calls signTypedData for TransferWithAuthorization.

Crítico

references/okx-x402.md:622-651

Payment Challenge Is Signed Without Client Validation

The client signs the first challenge entry without enforcing expected network, token, recipient, amount, domain, or timeout limits. A compromised endpoint could request an unintended authorization.

The sample copies every security-sensitive field from the decoded challenge into signTypedData and performs only an empty-array check.

Alto

references/okx-x402.md:191-223

Mock Configuration Can Bypass Paid Endpoint Enforcement

A single environment flag makes verification and settlement succeed without cryptographic checks. If enabled outside local development, arbitrary callers can receive paid content.

The MOCK branches return successful verification and settlement results, with no runtime guard that restricts them to development.

Médio

references/okx-x402.md:125-128 references/okx-x402.md:489-496

Payment Metadata Is Publicly Queryable

The sample grants public reads and returns recent payment rows without authentication. This exposes wallet addresses, endpoints, amounts, and transaction hashes as linked usage records.

The SQL policy permits all SELECT operations, and the unauthenticated GET handler returns complete recent rows through a service client.

Fatores de risco

🌐 Acesso à rede (38)

🔑 Variáveis de ambiente (50)

⚙️ Comandos externos (48)

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/insforge-insforge-integrations/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/insforge-insforge-integrations/security.svg)](https://skillstore.io/skills/insforge-insforge-integrations?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/insforge-insforge-integrations?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/insforge-insforge-integrations/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/insforge-insforge-integrations.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

insforge. (2026). insforge-integrations security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/insforge-insforge-integrations/audits/1

Citação BibTeX

@techreport{insforge-insforge-insforge-integrations-2026,
  author = {insforge},
  title = {insforge-integrations security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/insforge-insforge-integrations/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "insforge-integrations security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "insforge"
date-released: "2026-09-10"
url: "https://skillstore.io/skills/insforge-insforge-integrations/audits/1"
identifiers:
  - type: other
    value: "skillstore:insforge-insforge-integrations:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Baixo

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Add SaaS Authentication

Connect an existing identity provider to InsForge and enforce per-user database access.

Deploy Self-Hosted Authentication

Run Better Auth against InsForge Postgres with isolated tables and a JWT bridge.

Prototype Paid API Access

Build an x402 endpoint that verifies payment, settles through OKX, and records results.

Teste estes prompts

Choose an Auth Provider

Compare the supported authentication providers for my InsForge application and recommend one based on these requirements: [requirements].

Implement Provider Authentication

Integrate [provider] with this InsForge project. Add token handling, required environment variables, and protected database access.

Add Row-Level Security

Create InsForge SQL for a [table] table using string user IDs, requesting_user_id(), and owner-only row-level security policies.

Harden an x402 Integration

Review this OKX x402 implementation. Validate challenge fields, isolate mock mode, protect payment metadata, and produce a production checklist.

Boas práticas

Keep signing secrets, database credentials, and service keys on trusted server processes.
Validate token claims and payment challenge fields before granting access or requesting signatures.
Test row-level security, token refresh, mock isolation, settlement errors, and retry behavior before production.

Evitar

Do not expose service keys or provider secrets through browser-prefixed environment variables.
Do not use UUID-only identity helpers when the external provider issues string user identifiers.
Do not enable payment mock mode or accept unvalidated wallet challenges in production.

Perguntas frequentes

Which authentication providers are covered?

The skill covers Clerk, Auth0, WorkOS, Kinde, Stytch, and Better Auth.

Does the skill configure provider dashboards automatically?

No. Provider applications, keys, callbacks, and dashboard settings require manual configuration.

Why are InsForge user ID columns stored as text?

The supported external providers issue string identifiers that are not compatible with UUID-only columns.

Can I use these examples outside Next.js?

Some patterns are framework-independent, and Better Auth includes Vite guidance. Other frameworks require adapted routing, sessions, and environment handling.

Does the OKX x402 flow move real funds?

Yes. Production settlement uses wallet-signed USDG authorizations on X Layer and can transfer digital assets.

Is the provided payment mock mode production-ready?

No. It bypasses verification and settlement, and the sample still requests a real wallet authorization.