Skills blocklet-converter

📦

blocklet-converter

Name: blocklet-converter
Author: ArcBlock

Content revision r1 Medium Risk 🔑 Env variables⚙️ External commands🌐 Network access

Convert Web Projects to Blocklets

Preparing a web project for ArcBlock deployment requires correct metadata, assets, and bundle settings. This skill guides Claude, Codex, or Claude Code through conversion and validation steps.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "blocklet-converter" from https://skillstore.io/skills/arcblock-blocklet-converter.md and its manifest at https://skillstore.io/api/skills/arcblock-blocklet-converter/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/arcblock-blocklet-converter.md Signed manifest GET /api/skills/arcblock-blocklet-converter/manifest Signed lockfile GET /api/skills/arcblock-blocklet-converter/lockfile

Test it

Using "blocklet-converter". Convert a Vite React project with a valid Blocklet DID.

Expected outcome:

The skill identifies a static web app, builds the project, finds the dist output, creates Blocklet metadata, and verifies the bundle.

Using "blocklet-converter". Convert a plain HTML project with no package.json.

Expected outcome:

The skill detects index.html, skips dependency installation, creates missing assets, and configures the Blocklet main path.

Using "blocklet-converter". Convert a project with TypeScript build errors.

Expected outcome:

The skill stops after the build failure and reports the error instead of creating incomplete Blocklet files.

Security Audit

Medium Risk

v12 • 7/9/2026 Open versioned report

Most static findings are false positives caused by Markdown backticks, documented Blocklet runtime environment variables, and normal deployment metadata. The confirmed risk is intended external command execution: the skill installs dependencies, runs build commands, and invokes the Blocklet CLI in the target project.

Files scanned

398

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:57-63

Dependency Installation and Build Script Execution

The skill directs the agent to run dependency installation and project build commands. This can execute package lifecycle scripts from the target project and may run untrusted code if the project is not trusted.

The workflow explicitly includes dependency installation and build execution. This is expected for conversion, but it creates a real local execution risk in untrusted repositories.

Capability review items (8)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:59-61

Ruby/shell backtick execution

```bash

The workflow instructs the agent to run dependency installation and a build command. This can execute project package scripts and should require user awareness.

Medium

SKILL.md:61-67

Ruby/shell backtick execution

```

This code block contains the build workflow that executes local package manager commands. Such commands are expected but can run arbitrary package lifecycle scripts.

Medium

SKILL.md:95-97

Ruby/shell backtick execution

```bash

The workflow directs execution of the Blocklet CLI for metadata validation. This is intended behavior, but it is still an external command run in the user project.

Medium

SKILL.md:97-101

Ruby/shell backtick execution

```

The surrounding command block invokes the Blocklet CLI. The operation is legitimate but should be treated as external command execution.

Medium

SKILL.md:101-103

Ruby/shell backtick execution

```bash

The workflow directs bundling a Next.js blocklet with the Blocklet CLI. This is legitimate deployment tooling but executes an external command.

Medium

SKILL.md:103-107

Ruby/shell backtick execution

```

The surrounding command block invokes blocklet bundle for Next.js projects. It is intended but remains external command execution.

Medium

SKILL.md:107-109

Ruby/shell backtick execution

```bash

The workflow directs bundling a static webapp with the Blocklet CLI. This is legitimate deployment tooling but executes an external command.

Medium

SKILL.md:109-119

Ruby/shell backtick execution

```

The surrounding command block invokes blocklet bundle for static projects. It is intended but remains external command execution.

Risk Factors

🔑 Env variables (6)

assets/nextjs-entry.txt:3 assets/nextjs-entry.txt:8 assets/nextjs-entry.txt:11 assets/nextjs-entry.txt:3 assets/nextjs-entry.txt:8 assets/nextjs-entry.txt:11

⚙️ External commands (44)

🌐 Network access (1)

templates/static-blocklet.yml:34

Audited by: claude View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/arcblock-blocklet-converter/audits/12?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/arcblock-blocklet-converter/security.svg)](https://skillstore.io/skills/arcblock-blocklet-converter?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/arcblock-blocklet-converter?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/arcblock-blocklet-converter/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/arcblock-blocklet-converter.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

ArcBlock. (2026). blocklet-converter security audit report (audit version 12) [Author version unspecified]. Skillstore. https://skillstore.io/skills/arcblock-blocklet-converter/audits/12

BibTeX citation

@techreport{arcblock-arcblock-blocklet-converter-2026,
  author = {ArcBlock},
  title = {blocklet-converter security audit report (audit version 12)},
  institution = {Skillstore},
  year = {2026},
  number = {12},
  url = {https://skillstore.io/skills/arcblock-blocklet-converter/audits/12},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "blocklet-converter security audit report (audit version 12)"
version: "unspecified"
type: report
authors:
  - name: "ArcBlock"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/arcblock-blocklet-converter/audits/12"
identifiers:
  - type: other
    value: "skillstore:arcblock-blocklet-converter:audit:12"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Package a React site for ArcBlock

Convert a Vite or React static site into a Blocklet with generated metadata and deployment files.

Prepare a Next.js project for Blocklet bundling

Add the required Blocklet entry point and configuration for a production Next.js application.

Validate deployment readiness

Check that build outputs, assets, and Blocklet metadata are present before creating a release bundle.

Try These Prompts

Convert a simple web app

Convert this project to an ArcBlock blocklet using DID z8iaExampleDidValue. Stop if the project is not a supported web app.

Convert and explain required changes

Review this project for Blocklet conversion using DID z8iaExampleDidValue. Tell me what files you will create or update before running commands.

Prepare a Next.js Blocklet

Convert this Next.js project into a Blocklet with DID z8iaExampleDidValue. Verify the production entry point and blocklet.yml settings.

Audit conversion readiness

Check this project for Blocklet readiness using DID z8iaExampleDidValue. Validate metadata, output paths, assets, and bundle commands before creating a release.

Best Practices

Review the target project before allowing dependency installation or build commands.
Generate the Blocklet DID before starting the conversion workflow.
Confirm the detected output directory before creating the final bundle.

Avoid

Do not run the conversion in an untrusted repository without reviewing scripts first.
Do not use this skill for backend services or API-only projects.
Do not continue after build, metadata, or bundle validation errors.