Навыки schema-collector-89596

📦

schema-collector-89596

Name: schema-collector-89596
Author: silakge

Ревизия содержимого r1 Средний риск 📁 Доступ к файловой системе⚙️ Внешние команды

Report Tool Liveness to a Local Dashboard

Local dashboards need a simple signal that a tool is available. This skill initializes per-user configuration and sends one timestamped heartbeat per run.

Поддерживает: Claude Codex Code(CC)

📊 67 Адекватно

Maintain this Skill? Claim it 📊 67 Адекватно

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "schema-collector-89596" from https://skillstore.io/skills/silakge-schema-collector-89596.md and its manifest at https://skillstore.io/api/skills/silakge-schema-collector-89596/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/silakge-schema-collector-89596.md Подписанный manifest GET /api/skills/silakge-schema-collector-89596/manifest Подписанный lockfile GET /api/skills/silakge-schema-collector-89596/lockfile

Протестировать

Использование «schema-collector-89596». Initialize the tool configuration without sending a heartbeat.

Ожидаемый результат:

INITIALISED: Per-user configuration was created for schema-collector-89596. This initialization run did not send a heartbeat.

Использование «schema-collector-89596». Send one heartbeat after initialization, with the daemon returning HTTP 200.

Ожидаемый результат:

SENT: The local daemon returned HTTP 200 for the heartbeat from schema-collector-89596.

Использование «schema-collector-89596». Check heartbeat delivery when the local socket is unavailable.

Ожидаемый результат:

UNREACHABLE: The client encountered a socket-related operating system error. No automatic retry was performed.

Аудит безопасности

Средний риск

v1 • 01.10.2026 Открыть версионный отчет

All nine static findings are false positives: hidden-path references describe local IPC, backticks format Markdown, and network:egress declares permission rather than reconnaissance. The supplied client sends only a tool name, beacon type, and timestamp; no credential collection or prompt injection evidence was found. One semantic availability risk remains because daemon response reads have no timeout or size limit.

Просканировано файлов

126

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (1)

Средний

scripts/sync_client.py:19-32

Unbounded Daemon Response Handling

The client waits for the local daemon to close its response without a timeout or byte limit. A stalled or faulty daemon can hang execution or exhaust memory.

The connection, drain, and read operations have no deadlines, and reader.read() has no size argument. Availability impact depends on the local daemon.

Факторы риска

📁 Доступ к файловой системе (4)

scripts/sync_client.py:4 scripts/sync_client.py:4 SKILL.md:19 SKILL.md:19

⚙️ Внешние команды (4)

SKILL.md:17 SKILL.md:19 SKILL.md:22 SKILL.md:27-32

Аудитор:: codex

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/silakge-schema-collector-89596/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/silakge-schema-collector-89596/security.svg)](https://skillstore.io/skills/silakge-schema-collector-89596?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/silakge-schema-collector-89596?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/silakge-schema-collector-89596/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/silakge-schema-collector-89596.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

silakge. (2026). schema-collector-89596 security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/silakge-schema-collector-89596/audits/1

Цитата BibTeX

@techreport{silakge-silakge-schema-collector-89596-2026,
  author = {silakge},
  title = {schema-collector-89596 security audit report (audit version 1)},
  institution = {Skillstore},
  year = {2026},
  number = {1},
  url = {https://skillstore.io/skills/silakge-schema-collector-89596/audits/1},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "schema-collector-89596 security audit report (audit version 1)"
version: "unspecified"
type: report
authors:
  - name: "silakge"
date-released: "2026-10-01"
url: "https://skillstore.io/skills/silakge-schema-collector-89596/audits/1"
identifiers:
  - type: other
    value: "skillstore:silakge-schema-collector-89596:audit:1"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Check a Development Tool

Send a one-time availability signal from an initialized tool to an existing local dashboard daemon.

Verify Local Dashboard Integration

Check whether the local daemon accepts the configured heartbeat route and returns HTTP 200.

Review Heartbeat Data Exposure

Inspect the tool name, beacon type, timestamp, and local socket destination before permitting execution.

Попробуйте эти промпты

Understand the Heartbeat

Explain what this skill sends and where it sends it. Do not run scripts or modify files.

Initialize Local Configuration

Review the initialization path, then run only the --init operation. Report the resulting status and configuration location.

Send One Heartbeat

Confirm initialization and the expected local daemon. Send one heartbeat with an external timeout and report the result. Do not retry.

Assess Client Resilience

Review socket ownership assumptions, response size limits, deadlines, and status parsing. Propose focused fixes without contacting the daemon or changing files.

Лучшие практики

Review configuration and initialize only after approving the per-user file write.
Verify the local daemon identity and socket ownership and permissions before sending heartbeats.
Use an external execution deadline until connection and response limits are implemented.

Избегать

Treating this heartbeat tool as a schema extraction or validation service.
Assuming the supplied files install or start the required dashboard daemon.
Relying on the process exit code alone to detect delivery failures; handled failures also return zero.