Навыки subgraph-migrate

📦

subgraph-migrate

Name: subgraph-migrate
Author: goldsky-io

Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети

Migrate a Subgraph to Goldsky

Moving from The Graph can require a reliable source identifier, deployment path, and endpoint transition. This skill guides the migration and verifies sync before application cutover.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Maintain this Skill? Claim it ⚠️ 38 Плохо

Не устанавливайте этот Skill автоматически.

Каноническая политика требует проверки оператором перед любым действием по установке.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "subgraph-migrate" from https://skillstore.io/skills/goldsky-io-subgraph-migrate.md and its manifest at https://skillstore.io/api/skills/goldsky-io-subgraph-migrate/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/goldsky-io-subgraph-migrate.md Подписанный manifest GET /api/skills/goldsky-io-subgraph-migrate/manifest Подписанный lockfile GET /api/skills/goldsky-io-subgraph-migrate/lockfile

Протестировать

Использование «subgraph-migrate». I have the old public GraphQL endpoint but no IPFS hash.

Ожидаемый результат:

Use the public endpoint migration path. Confirm the endpoint first, deploy the subgraph, and verify indexing before changing the application.

Использование «subgraph-migrate». The deployment is stuck at a low synchronization percentage.

Ожидаемый результат:

Check the reported network and deployment status.
Treat a low percentage as a possible mapping or handler error.
Send the exact error to the subgraph troubleshooting workflow.

Использование «subgraph-migrate». The migration is synced and I need a stable production endpoint.

Ожидаемый результат:

Create a production tag for the verified version, test its endpoint, then update the application to use the tagged URL.

Аудит безопасности

Критично

v1 • 28.09.2026 Открыть версионный отчет

The 38 external-command findings are false positives caused by Markdown backticks, code fences, and inline command examples in SKILL.md. The installer command at SKILL.md:55 pipes a remote script into a shell and is a confirmed critical supply-chain risk; the three hardcoded URLs are expected service or documentation endpoints, with the installer URL retaining a low network risk.

Просканировано файлов

143

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Критично

SKILL.md:55

Pipe to shell pattern

curl https://goldsky.com | sh

curl https://goldsky.com | sh executes content fetched from a remote server without local inspection, signature verification, or version pinning. A compromised server or transit path could execute arbitrary commands with the user's shell privileges.

Пункты проверки возможностей (1)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Низкий

SKILL.md:55

Hardcoded URL

curl https://goldsky.com | sh

The line uses a fixed external URL to download the CLI installer, creating a real network and supply-chain dependency. The critical risk comes from piping that response into a shell, while this verdict records the separate network exposure.

Факторы риска

Обнаруженные паттерны

Pipe to shell pattern

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/goldsky-io-subgraph-migrate/security.svg)](https://skillstore.io/skills/goldsky-io-subgraph-migrate?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/goldsky-io-subgraph-migrate?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/goldsky-io-subgraph-migrate/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/goldsky-io-subgraph-migrate.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

goldsky-io. (2026). subgraph-migrate security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1

Цитата BibTeX

@techreport{goldsky-io-goldsky-io-subgraph-migrate-2026,
  author = {goldsky-io},
  title = {subgraph-migrate security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "subgraph-migrate security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "goldsky-io"
date-released: "2026-09-28"
url: "https://skillstore.io/skills/goldsky-io-subgraph-migrate/audits/1"
identifiers:
  - type: other
    value: "skillstore:goldsky-io-subgraph-migrate:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Низкий

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Replace a The Graph endpoint

Move a production subgraph to Goldsky while preserving the existing application query model.

Recover a sunset deployment

Use an existing endpoint or IPFS deployment hash when a former hosted subgraph endpoint is unavailable.

Validate a migration rollout

Deploy, monitor indexing, create a stable tag, and prepare the new endpoint for an application cutover.

Попробуйте эти промпты

Start a migration

Help me migrate my subgraph from The Graph to Goldsky. Ask for the current endpoint or IPFS deployment hash before choosing a path.

Choose the source

I have a public GraphQL endpoint, an IPFS deployment hash, and local source. Compare the migration paths and recommend the safest option.

Deploy and verify

Guide me through deploying this subgraph to Goldsky, checking indexing progress, and identifying whether any error requires troubleshooting.

Plan production cutover

Create a production cutover checklist for my Goldsky subgraph, including a stable tag, endpoint validation, rollback considerations, and sync verification.

Лучшие практики

Require the user to provide and verify the source endpoint or IPFS hash.
Confirm indexing progress before changing the application endpoint.
Use a stable tag so future deployments do not require frontend URL changes.

Избегать

Do not guess a The Graph endpoint, IPFS hash, network, or deployment name.
Do not declare success before the Goldsky index advances and the endpoint responds.
Do not use this workflow to diagnose complex mapping or synchronization errors.

Часто задаваемые вопросы

What source information is required?

Provide the current GraphQL endpoint, the IPFS deployment hash, or local source when the published deployment is unavailable.

Does migration require subgraph code changes?

The standard migration is a drop-in replacement, but Goldsky validation can expose specification issues that require changes.

Which migration path should I use?

Use the public endpoint when available. Use the IPFS hash when you have the deployment identifier but no queryable endpoint.

How do I know the migration is working?

Check the deployment status and query metadata to confirm that the indexed block advances without indexing errors.

How should I avoid changing my frontend later?

Create a stable Goldsky tag and configure the application to use the tagged endpoint.

What if deployment or sync fails?

Capture the exact error and route it to the subgraph troubleshooting workflow. Do not guess at network or schema changes.

Сведения для разработчиков

Автор

goldsky-io

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/goldsky-io/goldsky-agent/tree/e8e18c16233d9a7cee64dc548ba779c5fb99205a/skills/subgraph-migrate

Ссылка

8b5ad1599e7c55e9b6c627bca3f556f6e9061cb1

Актуальность поддержки

30.09.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📁 evals/

📄 trigger-eval.json

📄 SKILL.md