📦

astrale-cli

Name: astrale-cli
Author: astrale-os

Ревизия содержимого r1 Средний риск ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе

Manage Astrale Kernels with CLI Workflows

Astrale operations require precise paths, identity selection, and command options. This reference guides assistants through Kernel operations, graph workflows, diagnostics, and local UI setup.

Поддерживает: Claude Codex Code(CC)

📊 69 Адекватно

Maintain this Skill? Claim it 📊 69 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "astrale-cli" from https://skillstore.io/skills/astrale-os-astrale-cli.md and its manifest at https://skillstore.io/api/skills/astrale-os-astrale-cli/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/astrale-os-astrale-cli.md Подписанный manifest GET /api/skills/astrale-os-astrale-cli/manifest Подписанный lockfile GET /api/skills/astrale-os-astrale-cli/lockfile

Протестировать

Использование «astrale-cli». Explain how to read notes from staging without changing data.

Ожидаемый результат:

Select staging explicitly and use an identity authorized to read notes.
Query the Note class with a finite limit and structured output.
Resume with each returned cursor until no continuation remains.

Использование «astrale-cli». Explain how to review a mutation before sending it.

Ожидаемый результат:

Use mutation dry mode to admit and display the canonical document without connecting to a Kernel.
Review the operations and preconditions against the intended instance.
Require approval before executing the atomic transition.

Использование «astrale-cli». Explain how to protect locally edited Astrale UI components.

Ожидаемый результат:

Ordinary component addition refuses to replace locally edited installed files.
Preview proposed changes with dry-run mode.
Use overwrite and confirmation flags only after reviewing the intended replacement.

Аудит безопасности

Средний риск

v1 • 10.10.2026 Открыть версионный отчет

All 269 static findings are documentation false positives, including Markdown delimiters, example URLs, and descriptions of owner-private credential caches. Token examples introduce one semantic risk by passing bearer credentials through command-line arguments. No evidence found of prompt injection, malicious exfiltration, or unauthorized execution; external CLI implementation was not included.

Просканировано файлов

631

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

SKILL.md:373-374 SKILL.md:387

Bearer Credentials Exposed Through Command Arguments

The examples pass minted bearer credentials using --creds "$TOKEN" and --creds "$(astrale token --raw)". Shell expansion places credentials in process arguments, potentially exposing them to process inspection or execution logging while tokens remain valid.

The examples directly expand bearer credentials into argv. Exposure depends on local process visibility and logging; short token lifetimes reduce the exploitation window.

Факторы риска

⚙️ Внешние команды (50)

🌐 Доступ к сети (6)

SKILL.md:60 SKILL.md:158 SKILL.md:228 SKILL.md:274 SKILL.md:275 SKILL.md:277

📁 Доступ к файловой системе (2)

SKILL.md:592 SKILL.md:592

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/astrale-os-astrale-cli/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg)](https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/astrale-os-astrale-cli?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/astrale-os-astrale-cli/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/astrale-os-astrale-cli.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

astrale-os. (2026). astrale-cli security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/astrale-os-astrale-cli/audits/1

Цитата BibTeX

@techreport{astrale-os-astrale-os-astrale-cli-2026,
  author = {astrale-os},
  title = {astrale-cli security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/astrale-os-astrale-cli/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "astrale-cli security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "astrale-os"
date-released: "2026-10-10"
url: "https://skillstore.io/skills/astrale-os-astrale-cli/audits/1"
identifiers:
  - type: other
    value: "skillstore:astrale-os-astrale-cli:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Inspect Application Graph Data

Read nodes, inspect callable schemas, and paginate bounded graph queries on an explicitly selected instance.

Plan Domain Updates

Review installed releases, dependency compatibility, and issuer changes before approving a grouped domain installation.

Configure Local UI Projects

Initialize React and Tailwind CSS projects, search available patterns, and review source changes before adding components.

Попробуйте эти промпты

Check Connection and Identity

Use astrale-cli to explain read-only connection and identity checks for staging. Do not print tokens or change configuration.

Prepare a Paginated Graph Query

Prepare a bounded query for /:notes.example:class.Note on staging using identity reader. Explain cursor pagination without running mutations.

Review a Mutation Before Execution

Review mutation.v3.json and prepare an Astrale mutation dry run. Explain preconditions and atomicity; require approval before execution.

Plan an Authorized Domain Upgrade

Plan a grouped domain upgrade on staging. Review release pins, compatibility, and issuer consent using an authorized identity; require approval before installation.

Лучшие практики

Select the instance and least-privileged identity explicitly, and verify current command help before remote operations.
Review dry runs and release pins; approve mutations, issuer changes, root recovery, and destructive uninstalls explicitly.
Prefer identity selection over bearer arguments; keep secret payloads in protected files or stdin, and redact shared diagnostics.

Избегать

Relying on an ambient active instance or root identity for unattended production changes.
Placing bearer credentials or secret payloads in command arguments, logs, or issue reports.
Treating partial domain inventory or authorization-masked reads as proof that data is missing.

Часто задаваемые вопросы

What does this skill provide?

It provides an Astrale CLI reference for assistants. It does not include the CLI binary or verify its implementation.

Which assistants can use it?

The marketplace lists Claude, Codex, and Claude Code. Executing commands also requires a local CLI installation and authorized credentials.

Can it deploy domains?

No. The CLI connects to existing Kernels and installs published releases. Building, deploying, and publishing use the separate astrale-domain binary.

Can I inspect changes without applying them?

Mutations support --dry, while calls and UI additions support --dry-run. These previews do not replace permission checks during execution.

How should I handle credentials?

Prefer identity selection. Bearer arguments can expose tokens; use protected files or stdin for secret call payloads and avoid logging credentials.

Why is a domain absent from the installed list?

The list omits built-in, local, and unreadable domains. An absent origin does not prove that the domain is not installed.

Сведения для разработчиков

Автор

astrale-os

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/astrale-os/cli/tree/db2fc39650aa2fbd37e8439804d5e627ac83bcb0/skills/astrale-cli

Ссылка

e406bf64b5db6e514879399e87b346fa7ff7c2fb

Актуальность поддержки

11.10.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md