📦

captain-obvious

Name: captain-obvious
Author: shmulc8

Ревизия содержимого r1 Средний риск 📁 Доступ к файловой системе⚙️ Внешние команды⚡ Содержит скрипты🌐 Доступ к сети

Audit TypeScript and Python Test Quality

Redundant assertions can inflate confidence without protecting observable behavior. Captain Obvious combines deterministic scanners with contextual review and a test-authoring contract checklist.

Поддерживает: Claude Codex Code(CC)

⚠️ 50 Плохо

Maintain this Skill? Claim it ⚠️ 50 Плохо

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "captain-obvious" from https://skillstore.io/skills/shmulc8-captain-obvious.md and its manifest at https://skillstore.io/api/skills/shmulc8-captain-obvious/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/shmulc8-captain-obvious.md Подписанный manifest GET /api/skills/shmulc8-captain-obvious/manifest Подписанный lockfile GET /api/skills/shmulc8-captain-obvious/lockfile

Протестировать

Использование «captain-obvious». Review a Python test that assigns a local value of five and immediately checks that it equals five.

Ожидаемый результат:

Finding: local constant echo.
Reason: the assertion repeats the test arrangement and does not inspect production behavior.
Next step: identify the intended contract before replacing or removing the test.

Использование «captain-obvious». Review a TypeScript promise rejection assertion that is not awaited.

Ожидаемый результат:

Finding: advisory asynchronous assertion.
Reason: failure behavior depends on the test runner, and the assertion is not awaited.
Proposal: await the assertion, then run the focused test after approval.

Использование «captain-obvious». Review a conditional assertion when coverage shows that its line never executed.

Ожидаемый результат:

Finding: conditional assertion promoted to proven by coverage.
Reason: the supplied coverage report records zero executions for the assertion line.
Proposal: investigate the guard and preserve the intended contract. Do not automatically delete this report-only finding.

Аудит безопасности

Средний риск

v1 • 21.10.2026 Открыть версионный отчет

Most static alerts are false positives involving documentation, template literals, AST identifiers, or legitimate toolchain operations. Confirmed risks involve shadow-file overwrite and deletion, plus symlink-following report writes to documented predictable temporary paths. The fix guards also permit irreversible changes to untracked tests; no evidence found of credential exfiltration or prompt injection.

Просканировано файлов

3,933

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

scripts/co_py/gitguard.py:24-32 scripts/co_ts/gitguard.mjs:23-30 scripts/co_py/fixer.py:155-156 scripts/co_ts/fixer.mjs:88-92

Untracked Tests Bypass Recovery Safeguards

Both Git guards use --untracked-files=no, but test discovery includes untracked files. --fix can overwrite those tests without backups or Git restoration.

Both guards explicitly exclude untracked files, while discovery and fixers do not restrict edits to tracked targets. Neither fixer creates recovery backups.

Пункты проверки возможностей (7)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Средний

scripts/captain_obvious_py.py:285

Python file write/append

with open(args.json, "w") as fh:

The report writer truncates its destination and follows symlinks. The documented predictable /tmp destination permits another local actor to redirect this write.

Средний

scripts/captain_obvious_ts.mjs:245

Node.js fs operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

writeFileSync follows symlinks and truncates existing destinations. Combined with the documented predictable /tmp path, this allows local report-write redirection.

Средний

scripts/captain_obvious_ts.mjs:245

Synchronous file operations

if (jsonOut) fs.writeFileSync(jsonOut, JSON.stringify(report, null, 2));

The report write follows existing symlinks and truncates their targets. The documented fixed /tmp output path makes this a local overwrite risk.

Средний

scripts/co_py/mypy_pass.py:167

Python file write/append

with open(shadow, "w", encoding="utf-8") as f:

The predictable shadow path is opened with truncation after only a symlink check. Existing regular files or hard-linked targets can be overwritten during scanning.

Средний

scripts/co_py/mypy_pass.py:271

Python os file operations

os.remove(s)

Cleanup removes every recorded shadow path, including paths that existed before the scan and were truncated. Existing file contents are lost without recovery.

Средний

SKILL.md:72

Temp directory access

node <skill-dir>/scripts/captain_obvious_ts.mjs --project <repo> --json /tmp/co-ts.json

The documented command writes to predictable /tmp/co-ts.json. An existing symlink can redirect the truncating report write to another writable file.

Средний

SKILL.md:73

Temp directory access

python3 <skill-dir>/scripts/captain_obvious_py.py --path <repo> --json /tmp/co-py.json

The documented command writes to predictable /tmp/co-py.json. An existing symlink can redirect Python's truncating report write to another writable file.

Факторы риска

📁 Доступ к файловой системе (43)

⚙️ Внешние команды (50)

⚡ Содержит скрипты (3)

scripts/captain_obvious_ts.mjs:78 scripts/captain_obvious_ts.mjs:80 scripts/co_py/analyzer.py:7-19

🌐 Доступ к сети (1)

scripts/co_py/analyzer.py:570

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/shmulc8-captain-obvious/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg)](https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/shmulc8-captain-obvious?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/shmulc8-captain-obvious/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/shmulc8-captain-obvious.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

shmulc8. (2026). captain-obvious security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/shmulc8-captain-obvious/audits/1

Цитата BibTeX

@techreport{shmulc8-shmulc8-captain-obvious-2026,
  author = {shmulc8},
  title = {captain-obvious security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/shmulc8-captain-obvious/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "captain-obvious security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "shmulc8"
date-released: "2026-10-21"
url: "https://skillstore.io/skills/shmulc8-captain-obvious/audits/1"
identifiers:
  - type: other
    value: "skillstore:shmulc8-captain-obvious:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Review Generated Test Suites

Find tautologies and mock echoes in generated tests, then review advisory findings against the production behavior.

Maintain Shared Test Standards

Use contract questions and documented detector categories to distinguish meaningful regression checks from redundant assertions during review.

Compare Test Changes in CI

Compare supported proven syntactic findings against a Git baseline without enabling fixes. Comparison errors return success with a diagnostic.

Попробуйте эти промпты

Review One Python Test

Review this Python test using the authoring questions. Identify its observable contract and a plausible regression. Do not run commands or edit files.

Run a Report-Only Python Audit

Audit this trusted Python repository with --no-types and without --fix. Use stdout instead of a report file. Summarize findings without deleting tests.

Review Coverage-Based Findings

Audit this trusted TypeScript project using its existing coverage report. Separate proven and advisory findings. Propose advisory changes for approval; do not edit files.

Plan a Baseline Quality Check

Review the --check workflow for this trusted repository against [base]. Explain fail-open behavior and excluded categories. Propose a report-only CI command for approval.

Лучшие практики

Scan only trusted repositories, start without fixes, and avoid predictable shared temporary report paths.
Back up untracked tests and existing shadow-named files before scanning or fixing; Python --no-types avoids shadow-file creation.
Review each proposed deletion against its contract, obtain approval for advisory edits, and run type checks and tests afterward.

Избегать

Treating a clean scanner report as proof that every test can detect meaningful regressions.
Deleting advisory findings or weakening security contract tests solely because their assertions look repetitive.
Using --force, trusting Git cleanliness for untracked files, or running repository toolchains without reviewing their trust boundary.

Часто задаваемые вопросы

Which languages and test styles are supported?

The bundled scanners target TypeScript and JavaScript Jest-style or Vitest-style tests, plus Python pytest and unittest patterns.

Does scanning execute my tests?

The scanners parse tests rather than run the test suite. They can load repository TypeScript code or execute mypy plugins and environment commands.

Can I scan without modifying Python files?

Use --no-types without --fix or a file output option. Single-file Python mode also parses source without mypy shadow files.

Are all findings automatically deleted?

No. Explicit --fix targets findings marked safe. Advisory and report-only findings require review, and advisory edits require user approval.

What does coverage input add?

Coverage can confirm that a conditional assertion never executed or suppress a finding when it did. The report must include test-file lines.

Can the baseline check enforce every finding?

No. It compares newly introduced proven syntactic findings. Type-dependent and coverage-dependent categories are excluded, and comparison failures return success with diagnostics.