Навыки caveman-discover

📦

caveman-discover

Name: caveman-discover
Author: juliusbrussee

Ревизия содержимого r1 Средний риск ⚙️ Внешние команды

Label LLM Workflows for Caveman Cloud

Unlabeled LLM traffic hides which jobs create spend. This skill discovers repository workflows, proposes durable labels, applies approved changes, and verifies attribution.

Поддерживает: Claude Codex Code(CC)

📊 70 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "caveman-discover" from https://skillstore.io/skills/juliusbrussee-caveman-discover.md and its manifest at https://skillstore.io/api/skills/juliusbrussee-caveman-discover/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/juliusbrussee-caveman-discover.md Подписанный manifest GET /api/skills/juliusbrussee-caveman-discover/manifest Подписанный lockfile GET /api/skills/juliusbrussee-caveman-discover/lockfile

Протестировать

Использование «caveman-discover». Discover workflows in a service with a support endpoint and nightly summary job.

Ожидаемый результат:

support-reply: answers inbound support tickets from the reply handler.
nightly-digest: creates the scheduled summary from the digest job.
Approval required before applying either label.

Использование «caveman-discover». Report results after labeling one routed workflow and finding one direct provider call.

Ожидаемый результат:

Labeled support-reply and verified its request succeeded. The direct evaluation call remains not wired because it bypasses the Caveman gateway.

Использование «caveman-discover». Handle an unclear evaluation script during discovery.

Ожидаемый результат:

Proposed eval-suite with review status because its purpose was inferred from the filename. No edit was applied pending confirmation.

Аудит безопасности

Средний риск

v1 • 12.08.2026 Открыть версионный отчет

All 26 static findings are false positives caused by Markdown backticks, fenced examples, and inline technical identifiers in SKILL.md. The skill does direct approved code changes and repository-native command execution, creating a moderate operational risk when used on untrusted projects.

Просканировано файлов

119

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

SKILL.md:92-93

Untrusted Repository Command Execution

The skill directs the agent to run a repository test, development script, or curl command, which may execute project-controlled behavior.

Lines 92-93 explicitly require exercising a labeled path with repository tooling or curl. The command is unspecified and therefore may inherit untrusted side effects.

Факторы риска

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/juliusbrussee-caveman-discover/security.svg)](https://skillstore.io/skills/juliusbrussee-caveman-discover?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/juliusbrussee-caveman-discover?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/juliusbrussee-caveman-discover/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/juliusbrussee-caveman-discover.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

juliusbrussee. (2026). caveman-discover security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1

Цитата BibTeX

@techreport{juliusbrussee-juliusbrussee-caveman-discover-2026,
  author = {juliusbrussee},
  title = {caveman-discover security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "caveman-discover security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "juliusbrussee"
date-released: "2026-08-12"
url: "https://skillstore.io/skills/juliusbrussee-caveman-discover/audits/1"
identifiers:
  - type: other
    value: "skillstore:juliusbrussee-caveman-discover:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Attribute Product AI Spend

Separate support, onboarding, and reporting costs by the product job that generated each request.

Label Scheduled Automation

Identify cron jobs, queue workers, and CI tasks that consume LLM tokens and assign stable labels.

Audit Agent Workflows

Map graphs, agents, chains, and evaluation suites into distinct workflows before reviewing their spend.

Попробуйте эти промпты

Discover Workflows

Discover LLM workflows in this repository. Present the proposed workflow table, but do not edit files yet.

Review Workflow Names

Review the proposed workflow labels for valid syntax, clear job names, and uncertain purposes. Mark uncertain labels for review.

Apply Approved Labels

Apply the approved workflow labels with minimal changes. Label callers, preserve repository style, and list calls without Caveman gateway routing.

Verify and Report

Verify one labeled path using the repository's existing method. Report observed results, dashboard timing, unlabeled traffic, and unresolved workflow names.

Лучшие практики

Review and approve the workflow table before any repository files change.
Name each human-recognizable job instead of its provider, model, or shared helper.
Inspect verification commands and referenced scripts before running them.

Избегать

Do not label a shared LLM helper when several distinct jobs call it.
Do not invent a workflow purpose when repository evidence is unclear.
Do not claim dashboard verification before the labeled workflow actually runs.

Часто задаваемые вопросы

Does this skill configure the Caveman gateway?

No. The repository must already route LLM requests through the Caveman gateway.

Will it modify code without approval?

No. It presents a workflow table and waits for user approval before applying changes.

Which LLM entry points can it inspect?

It covers handlers, scheduled jobs, workers, scripts, evaluations, agents, chains, and raw HTTP calls.

How are workflow names chosen?

Names describe stable human-recognizable jobs and follow the gateway's lowercase slug rules.

What happens when a workflow purpose is unclear?

The skill derives a tentative slug from the filename and marks it for review.

When do labels appear in Caveman Cloud?

Each label appears after its workflow next runs and sends traffic through the gateway.

Сведения для разработчиков

Автор

juliusbrussee

Лицензия

MIT

Ревизия Skillstore

Примечание о версии

Автор не указал версию.

Репозиторий

https://github.com/juliusbrussee/caveman/tree/a0109974ea3258a14aadaef1ed1f8ff2837d30d5/skills/caveman-discover

Ссылка

95244ee20a58fc3ea629a87b9e746dbc45854aa0

Актуальность поддержки

13.08.2026

Использование

0 загрузок · 0 просмотров

Структура файлов

📄 SKILL.md