Навыки insforge-debug
📦
insforge-debug
Ревизия содержимого r1 Средний риск 🌐 Доступ к сети📁 Доступ к файловой системе⚙️ Внешние команды
Diagnose InsForge Backend Failures
InsForge failures can span logs, database state, policies, metrics, and deployments. This skill guides Claude, Codex, and Claude Code through evidence-based diagnosis.
Поддерживает: Claude Codex Code(CC)
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "insforge-debug" from https://skillstore.io/skills/insforge-insforge-debug.md and its manifest at https://skillstore.io/api/skills/insforge-insforge-debug/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «insforge-debug». A database request returns 403 for an authenticated user.
Ожидаемый результат:
- Primary route: inspect the PostgREST logs at the failure time.
- Verify the table policy role, USING expression, and WITH CHECK expression.
- Confirm that the configured JWT claim matches the policy helper.
Использование «insforge-debug». Several unrelated endpoints return intermittent 504 errors.
Ожидаемый результат:
The failures span subsystems, so check the platform incident report and correlate Postgres recovery events with the timeout window before concluding OOM.
Использование «insforge-debug». A frontend deployment reports an error.
Ожидаемый результат:
- Find the failed deployment and inspect its status metadata.
- Reproduce the build locally to obtain detailed output.
- Compare required environment variable keys with the deployment metadata.
Аудит безопасности
Средний рискv5 • 31.08.2026 Открыть версионный отчет
Most static alerts are Markdown syntax, example URLs, relative documentation links, or authorized troubleshooting steps. Confirmed risks involve unpinned CLI execution, privileged project inspection, infrastructure changes, and diagnostic data sent to InsForge services.
11
Просканировано файлов
907
Проанализировано строк
47
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (3)
Средний
System reconnaissance
4. **db query** (`db query "<sql>"`) — *empty-result variant only*: confirm rows that *should* be vi
The recipe queries project rows with service-role access to distinguish missing data from RLS filtering. This privileged inspection can expose records beyond the user role.
Средний
AI Diagnostic Data Leaves the Local Environment
The AI-assist command sends user-supplied errors, URLs, and status details to a backend-side LLM that also consumes project diagnostics.
The reference explicitly describes a backend-side LLM and instructs passing the issue description to it. No local-only processing is claimed.
Средний
Feedback Command Transmits Diagnostic Content
The feedback workflow submits reproduction details, commands, verbatim errors, and workarounds to InsForge without login. Pattern redaction may miss sensitive data.
The command fields and following warning explicitly describe external submission and pattern-based local redaction limitations.
Пункты проверки возможностей (47)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Средний
Ruby/shell backtick execution
**Always use `npx -y @insforge/cli`** — never install the CLI globally.
The skill directs execution through unversioned `npx -y @insforge/cli`. This can download and run package code with the user's local and project privileges.
Средний
Ruby/shell backtick execution
```bash
The skill directs execution through unversioned `npx -y @insforge/cli`. This can download and run package code with the user's local and project privileges.
Средний
Ruby/shell backtick execution
All commands run via `npx -y @insforge/cli ...`. The `(command)` shown next to each primitive is the
The skill directs execution through unversioned `npx -y @insforge/cli`. This can download and run package code with the user's local and project privileges.
Средний
Ruby/shell backtick execution
| **Logs** (`logs <source>`; `diagnose logs` for cross-source aggregate) | Time-stream of events fro
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **Metrics** (`diagnose metrics`) | EC2 instance time-series (CPU / memory / disk / network) over `
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **DB health** (`diagnose db`) | Current Postgres state via 7 named checks (`connections` / `slow-q
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **Advisor** (`diagnose advisor --json`) | Static-scan issues across 3 categories (`security` / `pe
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **Policies** (`db policies`) | Active RLS rules from `pg_policies` (USING / WITH CHECK per cmd per
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **Metadata** (`metadata --json`) | Declarative backend state dump (auth config / tables / buckets
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **Deploy state** (`deployments list` + `deployments status <id> --json` + `logs function-deploy.lo
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| **AI assist** (`diagnose --ai "<description>"`) | LLM agent that combines the other primitives — r
The recipe invokes the backend AI diagnostic command with user-supplied issue text. This executes the CLI and sends the description to a remote service.
Средний
Ruby/shell backtick execution
3. **db-health** (`connections`, `locks`, `slow-queries`) — only if the error suggests DB issue (Pos
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **logs** (`postgREST.logs`) — *403 variant only*: find the policy violation event with table and
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
4. **db query** (`db query "<sql>"`) — *empty-result variant only*: confirm rows that *should* be vi
The recipe directs a service-role SQL query against project data. This is legitimate diagnosis, but broad or substituted SQL can expose sensitive rows.
Средний
Ruby/shell backtick execution
1. **logs** (`insforge.logs`) — find auth errors with timestamp and provider context.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **logs** (`function.logs`) — get the error stack and execution context.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
3. (If needed) `npx -y @insforge/cli functions code <slug>` — inspect the source for obvious issues.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **deploy-state** (`function-deploy.logs`) — find the build/push error.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **deploy-state** (`deployments list` + `status <id> --json`) — read `status`, `metadata.webhookEv
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
2. **Local** `npm run build` — reproduce the same error locally for faster iteration.
The recipe directs execution of the project's npm build script. Repository-controlled lifecycle scripts can execute arbitrary local code.
Средний
Ruby/shell backtick execution
1. **logs** (`postgres.logs`) — find the query text and timestamp.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
2. **db-health** (`slow-queries`, `index-usage`) — `slow-queries` only catches it while still runnin
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
2. **metrics** (`--range 24h`) — only a *rising* trend or OOM kills/restarts change the answer.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **metrics** (`--range 1h`) — confirm system-wide pressure (CPU / memory / disk).
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
2. **db-health** — DB is the most common bottleneck; check `connections`, `locks`, `slow-queries`.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
3. **logs** (`diagnose logs` aggregate) — error patterns across sources at the spike timestamp.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
4. **advisor** (`--severity critical`) — pre-existing known issues that may explain the degradation.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **logs** (`insforge.logs`) — WebSocket errors and subscription failures.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
2. **metrics** (`--range 1h`) — overall backend load context.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| `/api/database/records/...` | **logs** (`postgREST.logs` → `postgres.logs`) + **db-health** (`lock
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| `/functions/<slug>` | **logs** (`function.logs`) — function may be crash-looping |
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| `/api/auth/...` | **logs** (`insforge.logs`) |
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
| Any path during system-wide spike | **metrics** (`--range 1h`) |
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
**Fast path: `npx -y @insforge/cli diagnose incident`** (Platform login required). The report is
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
`diagnose logs` stops answering. It returns a verdict (`oom_likely`,
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
**logs** (`postgres.logs`) via the crash-recovery aftermath — "terminating connection because of
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **Upgrade the instance** — `npx -y @insforge/cli projects upgrade-instance <type>`
The command resizes the hosted instance, changes billing, and restarts the project. The surrounding text requires approval, but the operation remains consequential.
Средний
Ruby/shell backtick execution
go-ahead first, then run unattended with the CLI-level `--yes` (the `-y` in `npx -y` is
The recipe permits the CLI confirmation bypass after user approval. This is guarded, but misuse could execute a billing and availability change unattended.
Средний
Ruby/shell backtick execution
npm's install flag, not the confirm-skip). The resize is async — poll `projects get` until
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
> Requires Platform login (`npx -y @insforge/cli login`). **Not available when the project is linked
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **advisor** — full scan, then `--severity critical` first, then warnings.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
2. **advisor** (`--category security`) — focus on security issues; cross-verify with **policies** (R
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
3. **advisor** (`--category performance`) — cross-verify with **db-health** (`slow-queries`, `index-
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
4. **advisor** (`--category health`) — cross-verify with **metrics** (resource trends over `7d`).
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
5. After fixes, re-run **advisor** and confirm `isResolved: true` for each addressed `ruleId`.
This recipe directs an InsForge CLI diagnostic command against the user's project. The operation is legitimate, but it executes external package code with project access.
Средний
Ruby/shell backtick execution
1. **ai-assisted** (`diagnose --ai "<error or URL>"`) — get a starting hypothesis.
The recipe invokes the backend AI diagnostic command with user-supplied issue text. This executes the CLI and sends the description to a remote service.
Средний
Ruby/shell backtick execution
```bash
The fenced shell block runs the InsForge feedback command and submits diagnostic text. It executes an external CLI and transmits supplied content.
Факторы риска
🌐 Доступ к сети (2)
📁 Доступ к файловой системе (1)
⚙️ Внешние команды (50)
SKILL.md:18 SKILL.md:21 SKILL.md:27-29 SKILL.md:29-37 SKILL.md:37 SKILL.md:41 SKILL.md:42 SKILL.md:43 SKILL.md:44 SKILL.md:45 SKILL.md:46-48 SKILL.md:48 SKILL.md:49-55 SKILL.md:55-57 SKILL.md:57-59 SKILL.md:59 SKILL.md:71-73 SKILL.md:73 SKILL.md:74 SKILL.md:78-83 SKILL.md:83-84 SKILL.md:84-85 SKILL.md:85-87 SKILL.md:87-89 SKILL.md:89-92 SKILL.md:92-94 SKILL.md:94 SKILL.md:95-99 SKILL.md:99-100 SKILL.md:100 SKILL.md:108-109 SKILL.md:109-117 SKILL.md:117-118 SKILL.md:118 SKILL.md:119-120 SKILL.md:120-124 SKILL.md:124-125 SKILL.md:125-130 SKILL.md:130-131 SKILL.md:131-140 SKILL.md:140 SKILL.md:141 SKILL.md:142 SKILL.md:143-150 SKILL.md:150-153 SKILL.md:153 SKILL.md:154 SKILL.md:155 SKILL.md:158-159 SKILL.md:159-166
Обнаруженные паттерны
System reconnaissance
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/insforge-insforge-debug/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/insforge-insforge-debug?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/insforge-insforge-debug?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/insforge-insforge-debug/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/insforge-insforge-debug.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
insforge. (2026). insforge-debug security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/insforge-insforge-debug/audits/5Цитата BibTeX
@techreport{insforge-insforge-insforge-debug-2026,
author = {insforge},
title = {insforge-debug security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/insforge-insforge-debug/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "insforge-debug security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "insforge"
date-released: "2026-08-31"
url: "https://skillstore.io/skills/insforge-insforge-debug/audits/5"
identifiers:
- type: other
value: "skillstore:insforge-insforge-debug:audit:5"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 45
Архитектура
85
Сопровождаемость
87
Контент
65
Сообщество
83
Соответствие спецификации
Что вы можете построить
Trace an API Failure
Map an SDK error or HTTP status to logs, database checks, policies, or metadata.
Investigate an Active Incident
Correlate resource pressure, gateway timeouts, database health, and service logs during an outage.
Run a Pre-Launch Audit
Review advisor findings, RLS coverage, auth settings, storage exposure, and performance indicators before release.
Попробуйте эти промпты
Diagnose an Error
Diagnose this InsForge error: {error_message}. Identify the best evidence source, inspect it, and explain the likely cause.Trace an Access Denial
Investigate this InsForge access issue: {request_details}. Compare logs, RLS policies, metadata, and expected user claims before proposing a fix.Analyze an Incident
Investigate {incident_window} for widespread InsForge latency or gateway failures. Correlate metrics, database health, logs, and platform incident evidence.Audit Launch Readiness
Audit this InsForge project before launch. Prioritize critical advisor findings, then verify security, RLS, performance, health, metadata, and unresolved risks.
Лучшие практики
- Start with the smallest diagnostic source that matches the observed symptom.
- Verify AI suggestions against logs, metrics, policies, metadata, or database state.
- Obtain explicit approval before commands that deploy, resize, modify data, or change billing.
Избегать
- Do not treat a single metric value as a root cause without trend and log correlation.
- Do not paste credentials, personal data, or unrestricted production logs into AI or feedback commands.
- Do not run service-role queries or infrastructure changes without confirming scope and authorization.
Часто задаваемые вопросы
What problems can this skill diagnose?
It covers API errors, authentication failures, RLS denials, slow queries, outages, rate limits, realtime issues, and deployment failures.
Does it modify my InsForge project?
Most steps are read-only, but some recipes mention deployments, database queries, or instance resizing. Review and approve those commands separately.
Is InsForge Platform login required?
Some advisor and incident diagnostics require Platform login. Several logs, metadata, policy, and database checks may work through other project links.
Can I trust the AI-assisted diagnosis?
Treat it as a starting hypothesis. Confirm each claim with the direct diagnostic sources named in the response.
Why might a slow query check return nothing?
The check only captures queries running longer than five seconds at that moment. Use advisor data or logs for historical evidence.
How should sensitive data be handled?
Remove secrets and personal data before AI or feedback commands. Keep log queries narrow and avoid unnecessary service-role access.