📦

gravitas

Name: gravitas
Author: udaysharmadev

Revisão do conteúdo r1 Risco alto 📁 Acesso ao sistema de arquivos⚙️ Comandos externos🔑 Variáveis de ambiente🌐 Acesso à rede

Verify Repository Changes with Gravitas

Coding agents can change repositories without clear scope or reliable evidence. Gravitas provides task contracts, adaptive planning, and verification guidance tied to observed results.

Suporta: Claude Codex Code(CC)

⚠️ 38 Ruim

Pare e solicite confirmação antes de instalar.

Revise o plano e obtenha o consentimento explícito do usuário antes de alterar arquivos.

Instalar com meu Agente

Copie esta solicitação para o seu Agente. Ela inclui a página canônica do Skill e o manifesto.

Solicitação do agente

Review the Skillstore skill "gravitas" from https://skillstore.io/skills/udaysharmadev-gravitas.md and its manifest at https://skillstore.io/api/skills/udaysharmadev-gravitas/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Seu Agente ainda deve apresentar o plano e solicitar qualquer confirmação exigida pela política de segurança.

Recursos legíveis por agentes

Use estes links quando um agente de IA, crawler ou script precisar de contexto limpo em vez de ler a página completa.

Detalhe em Markdown GET /skills/udaysharmadev-gravitas.md manifest assinado GET /api/skills/udaysharmadev-gravitas/manifest lockfile assinado GET /api/skills/udaysharmadev-gravitas/lockfile

Testar

Usando "gravitas". Plan a shared authentication timeout change without editing files.

Resultado esperado:

Scope: update the timeout definition and directly affected tests only.
Risks: callers may depend on the previous timeout; inspect middleware and integration coverage.
Verification plan: reproduce current behavior, run focused tests, then check affected callers.
Status: planning only. No files changed and no verification results claimed.

Usando "gravitas". Assess verification readiness when Python test tools are missing.

Resultado esperado:

Status: unverifiable because the required test runner is unavailable.
Evidence: no test execution results are available.
Next step: obtain approval to prepare the environment, then rerun the required checks.
Completion: not claimed.

Auditoria de segurança

Risco alto

v1 • 15/10/2026 Abrir o relatório versionado

Most static alerts match Markdown formatting, local documentation links, source searches, or normal verification tooling. Four execution findings retain package download risks; semantic review identifies an unconditional refusal prohibition and verification helpers that can report success without sufficient checks. No evidence found of credential exfiltration or deliberate malware.

Arquivos analisados

4,775

Linhas analisadas

Itens de revisão

Falsos positivos ignorados

Preocupações de segurança confirmadas (2)

Alto

resources/persona-protocol.md:146-156

Prompt Injection Attempt Detected

The persona protocol says "execute immediately, no more warnings" after confirmation and prohibits "Refuse after user has confirmed". This unconditional compliance instruction can suppress safety refusals or permission checks beyond the skill's legitimate authority.

The prohibition is explicit and unconditional within a protocol for risky requests. User confirmation cannot replace host policy or required permission checks.

Médio

scripts/run-checks.sh:174-180 scripts/verify.sh:138-187 scripts/verify.sh:297-300

Verification Helpers Can Report Success Without Required Checks

The quick checker initializes failure state to zero and reports success when no supported checks execute. The shell verifier also permits skipped Python checks before issuing PASS, enabling unsupported completion claims.

Both helpers determine success from failure counters without requiring executed checks. Missing Python tools produce warnings without increasing the failure count.

Itens de revisão de capacidade (4)

Estas são capacidades locais reais que podem ser esperadas para esta habilidade, portanto exigem revisão, mas não são contabilizadas como comportamento malicioso confirmado.

Alto

scripts/verify.py:60

Python subprocess.run

result = subprocess.run(parts, capture_output=True, text=True, timeout=300)

The TypeScript fallback can execute unpinned npx tsc when the local compiler is unavailable. Argument-list execution avoids shell injection but not registry package execution.

Médio

scripts/verify.sh:100

Shell command substitution

if output=$(npx eslint . --max-warnings 0 2>&1); then

Unpinned npx eslint can resolve and execute a registry package when no local binary exists. The script provides no local-only guard or package review step.

Médio

scripts/verify.sh:113

Shell command substitution

if output=$(npx vitest run --reporter=verbose 2>&1); then

The test step invokes unpinned npx vitest, which can fetch and execute a missing registry package. Verification can therefore execute unreviewed external code.

Médio

scripts/verify.sh:123

Shell command substitution

if output=$(npx jest --verbose 2>&1); then

Unpinned npx jest can execute a registry-resolved package when the local tool is absent. This lacks a local-only requirement or explicit installation approval.

Fatores de risco

📁 Acesso ao sistema de arquivos (23)

⚙️ Comandos externos (50)

🔑 Variáveis de ambiente (3)

agents/explore.md:65 agents/explore.md:65 resources/verification-engine.md:190

🌐 Acesso à rede (1)

resources/memory-protocol.md:126

Auditado por: codex

Compartilhar e citar este relatório

Compartilhe o relatório de avaliação versionado, o badge neutro, o cartão incorporável e as citações. A Skillstore apresenta evidências sem decidir se este Skill é seguro.

Abrir o relatório versionado

Copiar link do relatório

https://skillstore.io/skills/udaysharmadev-gravitas/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Badge Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/udaysharmadev-gravitas/security.svg)](https://skillstore.io/skills/udaysharmadev-gravitas?utm_source=security_passport_badge)

Badge HTML

<a href="https://skillstore.io/skills/udaysharmadev-gravitas?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/udaysharmadev-gravitas/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Cartão incorporável

<iframe src="https://skillstore.io/embed/skills/udaysharmadev-gravitas.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Citações acadêmicas (APA · BibTeX · CFF)

Citação APA

udaysharmadev. (2026). gravitas security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/udaysharmadev-gravitas/audits/1

Citação BibTeX

@techreport{udaysharmadev-udaysharmadev-gravitas-2026,
  author = {udaysharmadev},
  title = {gravitas security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/udaysharmadev-gravitas/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "gravitas security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "udaysharmadev"
date-released: "2026-10-15"
url: "https://skillstore.io/skills/udaysharmadev-gravitas/audits/1"
identifiers:
  - type: other
    value: "skillstore:udaysharmadev-gravitas:audit:1"
    description: "Skillstore immutable audit report identifier"

Pontuação do Skillstore

Por que esta pontuação Confiança das evidências: Médio

Arquitetura

Manutenibilidade

Conteúdo

Comunidade

Conformidade com a especificação

O que você pode criar

Reproduce and Verify a Bug Fix

Trace affected code, capture the failing behavior, implement a scoped repair, and compare fresh verification results.

Plan a Shared Module Refactor

Map callers and dependencies, compare implementation options, define rollback steps, and choose regression checks before editing.

Review Evidence for Risky Changes

Check acceptance criteria, execution evidence, unresolved failures, and verification gaps without modifying the repository.

Teste estes prompts

Explore a Module

Use Gravitas to inspect [module] in read-only mode. Identify its tests, callers, and relevant configuration. Report uncertainties without changing files.

Repair a Reproducible Bug

Investigate [bug]. Reproduce it before editing and propose a narrow write scope. Use approved local validators after repair. Report skipped checks and failures.

Prepare a Refactor Contract

Plan [refactor] without editing files. Define acceptance criteria, non-goals, allowed write scope, dependency impact, verification depth, and rollback steps. Request approval before implementation.

Review a High-Risk Migration

Review [migration] using deep verification planning. Map affected systems and destructive risks. Require approved local validators and explicit checkpoints. Preserve host safeguards and report unverifiable criteria.

Boas práticas

Define explicit acceptance criteria and write boundaries before multi-file or high-risk work.
Use reviewed, locally installed validators and confirm which checks actually executed after the final change.
Keep host safety rules active and record unresolved failures, skipped checks, and uncertain claims explicitly.

Evitar

Treating prompt instructions as a substitute for installed runtime hooks or enforced permissions.
Running unreviewed project commands or allowing missing tools to resolve from a package registry without approval.
Claiming completion from a success banner when required checks were skipped or evidence is stale.

Perguntas frequentes

What does Gravitas provide?

It provides coding workflow instructions, reference guides, agent role templates, and verification helpers focused on scope and observed evidence.

Can I use it with Claude, Codex, and Claude Code?

The skill targets these tools, but available commands, agent delegation, and enforcement depend on the host and installed runtime.

Does this directory include the complete enforcement runtime?

No. Several documented CLI commands and hook-based protections require separate Gravitas runtime components.

Which languages have bundled verification helpers?

The helpers cover TypeScript, Python, Rust, and Go. Their checks depend on installed tools and project configuration.

Can verification download or execute external code?

Some helper paths use npx, which may fetch missing packages. Project tests also execute repository code; review commands and restrict permissions.

What should I review before adoption?

Remove the unconditional refusal prohibition, prevent unapproved package downloads, and ensure skipped checks cannot produce a trusted completion result.