📦

caveman-setup

Name: caveman-setup
Author: juliusbrussee

Revisão do conteúdo r1 Risco alto ⚙️ Comandos externos🌐 Acesso à rede🔑 Variáveis de ambiente

Connect your app to Caveman measurement

LLM requests can be difficult to measure across SDKs and providers. This skill identifies live callsites, routes them through Caveman, and verifies one measured request.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "caveman-setup" from https://skillstore.io/skills/juliusbrussee-caveman-setup.md and its manifest at https://skillstore.io/api/skills/juliusbrussee-caveman-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/juliusbrussee-caveman-setup.md manifest assinado GET /api/skills/juliusbrussee-caveman-setup/manifest lockfile assinado GET /api/skills/juliusbrussee-caveman-setup/lockfile

Testar

Usando "caveman-setup". Set up measurement for the repository.

Resultado esperado:

Found two LLM callsites in the API service.
Added gateway URL and gateway key references through the existing environment configuration.
Verification is ready and requires approval before sending a provider request.

Usando "caveman-setup". Check whether the gateway integration succeeded.

Resultado esperado:

Verification returned HTTP 200.
The response included usage details for the configured model.
Record mode is enabled and no optimization was configured.

Auditoria de segurança

Risco alto

v9 • 08/09/2026 Abrir o relatório versionado

Most static findings are false positives caused by Markdown formatting, configuration examples, and documented environment-variable use. The skill intentionally routes LLM requests through a third-party gateway and can forward provider credentials in byok mode. It also directs agents to send a billable verification request without obtaining approval at execution time.

Arquivos analisados

223

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

SKILL.md:67-78

Credential forwarding to third-party gateway

The integration instructs clients in bring-your-own-key mode to forward an existing provider key to the configured Caveman gateway. This creates a credential disclosure boundary that users must explicitly assess before use.

The instructions explicitly require the upstream-key header in byok mode and describe gateway handling of provider authentication.

Alto

SKILL.md:146-173

Network action bypasses interactive confirmation

The skill instructs the agent to send a real billable verification request without pausing for approval. This can cause external network activity and provider charges without confirmation at the time of execution.

The instructions explicitly state not to ask permission and provide curl commands for a real billable provider request.

Itens de revisão de capacidade (10)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

SKILL.md:68

Generic API/secret keys

plus one auth header.** Gateway auth is `x-cave-api-key: CAVE_API_KEY`

The documented integration sends a gateway or upstream provider API credential in an HTTP header. This intentionally discloses a usable credential to the configured gateway and requires explicit trust in that endpoint.

Alto

SKILL.md:69

Generic API/secret keys

(`Authorization: Bearer CAVE_API_KEY` also works where a header is awkward).

Alto

SKILL.md:87

Generic API/secret keys

apiKey: process.env.OPENAI_API_KEY, // byok: unchanged · stored: use CAVE_API_KEY

Alto

SKILL.md:89

Generic API/secret keys

"x-cave-api-key": process.env.CAVE_API_KEY!,

Alto

SKILL.md:91

Generic API/secret keys

"x-cave-upstream-key": process.env.OPENAI_API_KEY!,

Alto

SKILL.md:105

Generic API/secret keys

api_key=os.environ["ANTHROPIC_API_KEY"], # byok: unchanged · stored: use CAVE_API_KEY

Alto

SKILL.md:107

Generic API/secret keys

"x-cave-api-key": os.environ["CAVE_API_KEY"],

Alto

SKILL.md:109

Generic API/secret keys

"x-cave-upstream-key": os.environ["ANTHROPIC_API_KEY"],

Alto

SKILL.md:160

Generic API/secret keys

-H "x-cave-api-key: $CAVE_API_KEY" \

Alto

SKILL.md:166

Generic API/secret keys

-H "x-cave-api-key: $CAVE_API_KEY" \

Fatores de risco

⚙️ Comandos externos (50)

🌐 Acesso à rede (4)

SKILL.md:16 SKILL.md:19 SKILL.md:130 SKILL.md:16

🔑 Variáveis de ambiente (26)

Auditado por: claude Ver histórico de auditoria →

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/juliusbrussee-caveman-setup/security.svg)](https://skillstore.io/skills/juliusbrussee-caveman-setup?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/juliusbrussee-caveman-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/juliusbrussee-caveman-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/juliusbrussee-caveman-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

juliusbrussee. (2026). caveman-setup security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9

Citação BibTeX

@techreport{juliusbrussee-juliusbrussee-caveman-setup-2026,
  author = {juliusbrussee},
  title = {caveman-setup security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "caveman-setup security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "juliusbrussee"
date-released: "2026-09-08"
url: "https://skillstore.io/skills/juliusbrussee-caveman-setup/audits/9"
identifiers:
  - type: other
    value: "skillstore:juliusbrussee-caveman-setup:audit:9"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Measure a production AI service

Route existing application LLM traffic through the gateway to capture request usage and spend.

Standardize SDK gateway routing

Apply documented gateway configuration to OpenAI, Anthropic, or framework-based LLM clients.

Verify observability onboarding

Send one minimal request and confirm that the gateway records usage before wider rollout.

Teste estes prompts

Set up basic measurement

Set up Caveman measurement for this repository. First identify all live LLM callsites and show me the planned changes.

Configure an OpenAI client

Configure the existing OpenAI SDK client to use the Caveman gateway. Use environment variables and preserve current provider behavior.

Review gateway changes

Review this repository for LLM callsites and propose the minimal Caveman gateway integration. Do not make unrelated changes.

Verify controlled rollout

After configuring Caveman, show the exact verification request and wait for my approval before sending any billable traffic.

Boas práticas

Review the proposed file changes before applying them.
Store gateway and provider credentials only in ignored environment files or a managed secret store.
Confirm the target gateway and approve the billable verification request before it runs.

Evitar

Do not hardcode gateway or provider credentials in application source.
Do not route traffic to an unverified gateway URL.
Do not report successful measurement without an observed verification result.

Perguntas frequentes

What does this skill configure?

It routes supported LLM client traffic through the Caveman gateway for usage and spend measurement.

Does it change model output?

The skill describes record-mode routing intended to preserve request behavior, but you should verify this in your environment.

Which client libraries are covered?

It includes patterns for OpenAI, Anthropic, Vercel AI SDK, LangChain, LangGraph, LiteLLM, and raw HTTP.

Are credentials required?

Yes. A Caveman API key is required, and bring-your-own-key mode may send an existing provider key to the gateway.

Does verification cost money?

Yes. Verification sends one real provider request and can create provider charges.

Should I approve network activity first?

Yes. Confirm the gateway URL, credential handling, and verification request before allowing network activity.

Detalhes do desenvolvedor

Autor

juliusbrussee

Licença

MIT

Revisão da Skillstore

Aviso de versão

O autor não declarou uma versão.

Repositório

https://github.com/juliusbrussee/caveman/tree/15581d14007fd01fb3f132016741962f34936ca2/skills/caveman-setup

Referência

0acc95b40c367e2016e824a72b27b83b507ef020

Atualidade da manutenção

08/09/2026

Uso

0 downloads · 0 visualizações

Estrutura de arquivos

📄 SKILL.md