📦

tilt

Name: tilt
Author: 0xBigBoss

Content revision r1 Medium Risk ⚙️ External commands🌐 Network access📁 Filesystem access

Diagnose Tilt Dev Environments

Local Tilt environments can hide failing resources, stale logs, and Docker Compose health problems. This skill guides Claude, Codex, and Claude Code through status checks, logs, and Tiltfile fixes.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "tilt" from https://skillstore.io/skills/0xbigboss-tilt.md and its manifest at https://skillstore.io/api/skills/0xbigboss-tilt/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/0xbigboss-tilt.md Signed manifest GET /api/skills/0xbigboss-tilt/manifest Signed lockfile GET /api/skills/0xbigboss-tilt/lockfile

Test it

Using "tilt". Check Tilt health for the current project.

Expected outcome:

No runtime errors found. One resource is still in progress, so recheck before declaring success.
One Docker Compose service reports an unhealthy healthcheck. Inspect the probe output next.

Using "tilt". Investigate why the api resource is not ready.

Expected outcome:

The latest build failed before deployment completed.
Recent logs point to a missing dependency during startup.
Verify the dependency and trigger a rebuild after approval.

Using "tilt". Review this Tiltfile for faster local updates.

Expected outcome:

Move rebuild triggers before sync steps in the live update list.
Add labels to group backend and frontend resources.
Keep manual trigger mode for expensive builds.

Security Audit

Medium Risk

v9 • 7/6/2026 Open versioned report

Several Markdown backtick detections are false positives, but command examples intentionally guide agents to run local Tilt, Docker, git, jq, and zmx commands. The main concern is state-changing Tilt lifecycle operations, especially trigger, up, and down, which should require explicit user approval. I found no prompt injection or hidden data-exfiltration intent in SKILL.md, CLI_REFERENCE.md, or TILTFILE_API.md.

Files scanned

754

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:69-73

State-Changing Tilt Commands Need Consent

The skill presents tilt trigger, tilt up, and tilt down as lifecycle commands. These commands can modify or remove local development resources, so agents should request explicit approval before running them.

The cited lines directly list lifecycle commands, including tilt down, which the CLI reference says removes resources created by tilt up. The risk is operational rather than malicious.

Capability review items (11)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:12-20

Ruby/shell backtick execution

```bash

The fenced shell block instructs the agent to run tilt and jq against the local Tilt environment. These are legitimate read-only diagnostics, but they are still external command execution over local deployment state.

Medium

SKILL.md:20-26

Ruby/shell backtick execution

# An `Up (unhealthy)` compose container keeps runtimeStatus=ok/update=ok, so

This range includes a tilt and jq query for Docker Compose health and a status summary. It is expected operational tooling, but it executes local commands and may expose deployment details.

Medium

SKILL.md:30

Ruby/shell backtick execution

**Docker-compose resources are a blind spot.** Their `runtimeStatus`/`updateStatus` reflect only bui

The prose tells the agent to drop to docker inspect when Tilt status is insufficient. This is a legitimate diagnostic step, but it reads local container health data through an external command.

Medium

SKILL.md:36-39

Ruby/shell backtick execution

```bash

The fenced block contains tilt get and tilt logs commands with a custom port. They are legitimate diagnostics, but they execute local CLI commands and can reveal local service data.

Medium

SKILL.md:43-52

Ruby/shell backtick execution

```bash

The resource status section instructs running tilt get and tilt wait commands. This is normal Tilt use, but it queries and waits on local deployment resources through external commands.

Medium

SKILL.md:60-65

Ruby/shell backtick execution

```bash

The logs section instructs running tilt logs commands, including JSON output. This is expected troubleshooting behavior, but logs may contain sensitive application or deployment information.

Medium

SKILL.md:69-73

Ruby/shell backtick execution

```bash

The lifecycle block instructs running tilt trigger, tilt up, and tilt down. These commands change local development resources and should require explicit user approval.

Medium

SKILL.md:77

Ruby/shell backtick execution

Follow `zmx` skill patterns — check for existing sessions, derive name from git root, use `zmx run`

The line directs the agent to use zmx run for Tilt sessions. It is an intentional external command workflow, although the exact command appears in the following block.

Medium

SKILL.md:79-89

Ruby/shell backtick execution

```bash

The fenced shell block derives a project name, checks zmx sessions, and can start tilt up. This is real external command execution that can start local services.

Medium

SKILL.md:80

Shell command substitution

PROJECT=$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" || basename "$PWD")

The shell example uses command substitution to call git and derive a project name from the working tree. It is quoted and not an injection pattern, but it still executes local commands.

Medium

SKILL.md:79-89

Template literal with command substitution

```bash

The fenced shell template contains command substitution and zmx commands intended to be run by the agent. It is operationally useful, but it starts local processes when executed.

Risk Factors

⚙️ External commands (21)

🌐 Network access (4)

SKILL.md:104 TILTFILE_API.md:253 TILTFILE_API.md:342 TILTFILE_API.md:343

📁 Filesystem access (2)

SKILL.md:80 SKILL.md:83

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/0xbigboss-tilt/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/0xbigboss-tilt/security.svg)](https://skillstore.io/skills/0xbigboss-tilt?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/0xbigboss-tilt?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/0xbigboss-tilt/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/0xbigboss-tilt.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

0xBigBoss. (2026). tilt security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/0xbigboss-tilt/audits/9

BibTeX citation

@techreport{0xbigboss-0xbigboss-tilt-2026,
  author = {0xBigBoss},
  title = {tilt security audit report (audit version 9)},
  institution = {Skillstore},
  year = {2026},
  number = {9},
  url = {https://skillstore.io/skills/0xbigboss-tilt/audits/9},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "tilt security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
  - name: "0xBigBoss"
date-released: "2026-07-06"
url: "https://skillstore.io/skills/0xbigboss-tilt/audits/9"
identifiers:
  - type: other
    value: "skillstore:0xbigboss-tilt:audit:9"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Check Local Deployment Health

Find failing Tilt resources, pending updates, and Docker Compose healthcheck problems after a code change.

Triage Build And Runtime Errors

Use status queries and recent logs to identify why a local service did not reach a ready state.

Improve Tiltfile Workflows

Review Tiltfile resource definitions, live update ordering, dependency links, and UI labels.

Try These Prompts

Run A Health Check

Check this Tilt environment for errors first. Summarize failing resources, pending resources, and Docker Compose health issues. Ask before running commands that change state.

Investigate One Resource

Investigate the <resource> Tilt resource. Use status and recent logs. Explain the likely cause and the next verification step.

Review A Tiltfile

Review my Tiltfile for dependency order, live update steps, trigger modes, and resource labels. Suggest minimal changes with clear reasons.

Build A Troubleshooting Flow

Create a troubleshooting flow for intermittent Tilt failures on port <port>. Include status polling, log filters, Docker Compose health checks, and valid restart cases.

Best Practices

Check error states before broad pending status lists.
Re-poll resources that are in progress before reporting success.
Use structured Tilt output when you need reliable status decisions.

Avoid

Declaring a deployment healthy while resources are still pending or in progress.
Restarting Tilt for normal code or Tiltfile changes.
Ignoring Docker Compose healthStatus because runtimeStatus is ok.

Frequently Asked Questions

Does this skill run Tilt automatically?

It provides command guidance. The assistant should ask before commands that change local resources.

Can it work with non-default Tilt ports?

Yes. It includes guidance for passing a custom port to Tilt commands.

What tools are expected?

Tilt is required. jq, rg, docker, kubectl, and zmx are useful for some workflows.

Can it help edit Tiltfiles?

Yes. It can guide edits for resources, live update, dependencies, configuration, and UI links.

Does it cover Docker Compose?

Yes. It highlights Docker Compose healthcheck signals that basic Tilt status can miss.

Is it intended for production clusters?

No. It is focused on local development. Review context and permissions before using shared clusters.

Developer Details

Author

0xBigBoss

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/0xBigBoss/claude-code/tree/main/.claude/skills/tilt

Ref

2e36836131679643f7a49e4cfff588d67adc404b

Maintenance freshness

7/18/2026

Usage

16 downloads · 385 views

File structure

📄 CLI_REFERENCE.md

📄 SKILL.md

📄 TILTFILE_API.md