Skills Error Resolver
📦
Error Resolver
Content revision r1 Critical ⚡ Contains scripts⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables
Resolve Errors With Root Cause Analysis
Debugging errors wastes time when messages lack context. This skill guides classification, root cause analysis, fixes, verification, and reusable solution records.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "Error Resolver" from https://skillstore.io/skills/davila7-error-resolver.md and its manifest at https://skillstore.io/api/skills/davila7-error-resolver/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "Error Resolver". A Node.js app reports that a required package cannot be found after cloning a repository.
Expected outcome:
The skill identifies a dependency setup issue, checks package metadata, suggests installing dependencies, and verifies application startup.
Using "Error Resolver". A Docker container cannot write to a mounted data directory.
Expected outcome:
The skill separates permission, ownership, and volume causes, then recommends safer ownership alignment before broad permission changes.
Using "Error Resolver". An API request returns unauthorized errors after token rotation.
Expected outcome:
The skill checks token presence, format, expiry, scopes, and retry behavior, then defines verification and prevention steps.
Security Audit
Criticalv11 • 7/19/2026 Open versioned report
Most static detections are Markdown examples, language syntax, or diagnostic placeholders rather than executable malware. Confirmed risks remain in agent-actionable troubleshooting recipes: privileged commands, SSH private key access, TLS verification bypass, broad chmod fixes, process or container termination, and untrusted replay application.
14
Files scanned
6,628
Lines analyzed
21
Review items
0
False positives ignored
Confirmed security concerns (18)
Critical
SSH directory access
ssh-add ~/.ssh/id_ed25519 # Or your key file
The guidance directs access to the user SSH directory for a private key. This is sensitive credential material.
Critical
SSH private key file
ssh-add ~/.ssh/id_ed25519 # Or your key file
The guidance references ~/.ssh/id_ed25519, which is a private SSH key file. Access to this file is a critical sensitive-data risk.
High
Weak cryptographic algorithm
# Change 'peer' to 'md5' or 'scram-sha-256' for password auth
The PostgreSQL guidance offers md5 authentication as an option. MD5 is a weak authentication choice and should be replaced with scram-sha-256.
High
Overly permissive chmod
chmod 777 /host/path # Not recommended for production
The volume fix includes chmod 777 on a host path. World-writable permissions can expose or corrupt local data.
High
Environment file access
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
The flagged line is not an environment file, but it disables TLS certificate verification through process.env. The security impact is real.
High
Overly permissive chmod
- "chmod 777 /host/path" # Quick but not secure
The replay example records chmod 777 as an immediate fix. Replaying that solution could create world-writable host paths.
High
Replay Records Can Drive Untrusted Fix Actions
The replay lookup tells the agent to search `.claude/error-solutions/` and apply a recorded solution. Repository-controlled replay files could steer an agent toward unsafe commands if not reviewed.
The workflow explicitly says to apply recorded solutions from project files. This is useful, but it creates a clear trust boundary for repository-controlled instructions.
High
Destructive Git Recovery Recipes Risk Data Loss
The Git troubleshooting guide presents discard and hard reset commands as recovery options. These can delete uncommitted work if an agent applies them without user confirmation.
The commands are explicit and destructive, although labeled careful. This is a concrete integrity risk for agent-assisted debugging.
Show all 18 confirmed findings
Medium
Debug Commands Can Expose Environment Secrets
The general debugging section recommends environment-variable inspection commands. If copied into chat or stored in replay records, this can disclose secrets such as tokens or passwords.
The command list includes environment variable inspection. The risk depends on the selected variable, so confidence is high enough to warn but not critical.
Low
Network reconnaissance
netstat -an | grep 5432
The guidance recommends netstat to inspect a local database port. This is legitimate troubleshooting, but it collects host network state and should remain user-approved.
Low
Network reconnaissance
netstat -tulpn | grep 3000
The guidance recommends netstat to identify local port listeners. This is useful troubleshooting, but it collects host network state.
Low
Network reconnaissance
netstat -an | grep 3000
The guidance recommends netstat to inspect local port listeners. This gathers host network state and should be user-approved.
Low
System reconnaissance
nslookup hostname
The guidance recommends nslookup for a hostname. This is normal diagnosis, but it performs network reconnaissance about the target name.
Low
System reconnaissance
dig hostname
The guidance recommends dig for a hostname. This is normal diagnosis, but it queries DNS information about the target name.
Low
System reconnaissance
ping hostname
The guidance recommends ping for a hostname. This is normal diagnosis, but it probes network reachability.
Low
System reconnaissance
curl -I https://hostname
The guidance recommends curl -I against a hostname. This makes an outbound diagnostic request and should be user-approved.
Low
Network reconnaissance
netstat -an | grep 3000
The guidance recommends netstat to inspect local port listeners. This gathers host network state and should be user-approved.
Low
Network reconnaissance
netstat -an | grep [port]
The top-level debug command list recommends netstat for port usage. This collects local network state and should be user-approved.
Capability review items (21)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
sudo privilege escalation
sudo systemctl start postgresql # Linux
The solution recommends sudo systemctl start postgresql, which performs a privileged system service action. In an agent-executed skill this needs explicit user approval.
High
sudo privilege escalation
sudo systemctl start mysql # Linux
The solution recommends sudo systemctl start mysql, which performs a privileged system service action. In an agent-executed skill this needs explicit user approval.
High
sudo privilege escalation
sudo -u postgres psql
The solution recommends sudo -u postgres psql for database administration. This can alter database users or credentials if followed without confirmation.
High
sudo privilege escalation
sudo systemctl start mongod # Linux
The solution recommends sudo systemctl start mongod, which performs a privileged service action on the host. Agent execution should be gated by user confirmation.
High
sudo privilege escalation
sudo systemctl start redis # Linux
The solution recommends sudo systemctl start redis, which performs a privileged service action on the host. Agent execution should be gated by user confirmation.
High
sudo privilege escalation
sudo systemctl start docker
The solution recommends sudo systemctl start docker, a privileged host service action. Agent execution should require clear confirmation.
High
sudo privilege escalation
sudo usermod -aG docker $USER
The guidance recommends adding the user to the docker group. Docker group membership can effectively grant root-equivalent host control.
High
sudo privilege escalation
# Run with sudo (not recommended for regular use)
The permission workaround suggests running Docker with sudo. This gives the command elevated host privileges and is unsafe as a default fix.
High
sudo privilege escalation
sudo docker ps
The example sudo docker ps still normalizes elevated Docker usage. Docker commands with sudo should require explicit user consent.
High
sudo privilege escalation
sudo usermod -aG docker $USER
The guidance recommends adding the user to the docker group. Docker group membership can grant broad host control through Docker.
High
Hidden file in home directory
ssh-add ~/.ssh/id_ed25519 # Or your key file
The command references ~/.ssh/id_ed25519, a private SSH key path under a hidden home directory. Agent access to that path is sensitive.
High
Hidden file access
ssh-add ~/.ssh/id_ed25519 # Or your key file
The command references ~/.ssh/id_ed25519, a private SSH key path. Even normal ssh-agent use should be user-approved.
High
Environment variable access (dot notation)
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
The code sets NODE_TLS_REJECT_UNAUTHORIZED to 0. This disables TLS certificate verification and can expose traffic to interception.
High
Environment variable object
process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0'
The code modifies process.env to disable TLS certificate verification. This weakens transport security even if labeled development-only.
High
sudo privilege escalation
sudo chown $USER:$USER /path/to/file
The fix recommends sudo chown on an arbitrary path. This can change ownership of files outside the project and needs explicit approval.
High
sudo privilege escalation
sudo chown -R $USER /usr/local/lib/node_modules
The fix recommends recursive sudo chown on /usr/local/lib/node_modules. Recursive ownership changes on system paths are high risk.
High
sudo privilege escalation
sudo chown $USER:$USER /path/to/file
The fix recommends sudo chown on an arbitrary path. This can change ownership of files outside the project and needs explicit approval.
Medium
Shell command substitution
docker stop $(docker ps -q --filter publish=3000)
The command uses docker stop with command substitution over running containers. It can stop local containers and should not run automatically.
Medium
Shell command substitution
kill $(lsof -t -i:3000)
The command uses kill with command substitution from lsof. It can terminate a local process selected by port and needs explicit approval.
Medium
Unix shell invocation
docker run -it image_name /bin/sh
The recipe opens an interactive shell inside a container. This is a normal debug action, but it is still command execution in the target environment.
Medium
Shell command substitution
eval "$(ssh-agent -s)"
The command evaluates ssh-agent output in the shell. It is common Git setup, but it is still shell evaluation and should not be automatic.
Risk Factors
⚡ Contains scripts (4)
⚙️ External commands (50)
analysis/root-cause.md:299-302 patterns/database.md:209 patterns/database.md:457-458 patterns/database.md:43 patterns/database.md:47 patterns/database.md:71 patterns/database.md:419 patterns/database.md:495 patterns/docker.md:229 patterns/docker.md:232 patterns/docker.md:79 patterns/docker.md:175 patterns/docker.md:543 patterns/docker.md:123 patterns/docker.md:129 patterns/docker.md:245 patterns/docker.md:246 patterns/docker.md:249 patterns/git.md:79 patterns/network.md:68-75 patterns/network.md:75-81 patterns/network.md:81-87 patterns/network.md:140-145 patterns/network.md:574-579 patterns/network.md:579-583 patterns/nodejs.md:498-500 patterns/nodejs.md:212 patterns/nodejs.md:215 patterns/python.md:394 patterns/react.md:242-243 patterns/react.md:272-274 patterns/rust.md:360 patterns/rust.md:369 patterns/rust.md:418 patterns/rust.md:36-37 patterns/rust.md:70-71 patterns/rust.md:95-96 patterns/rust.md:163-165 patterns/rust.md:165 patterns/rust.md:197 patterns/rust.md:224-225 patterns/rust.md:254-255 patterns/rust.md:255-256 patterns/rust.md:280 patterns/rust.md:314 patterns/rust.md:315 patterns/rust.md:350-351 patterns/rust.md:380-381 patterns/rust.md:405-406 patterns/rust.md:430-435
🌐 Network access (43)
patterns/database.md:10 patterns/database.md:412 patterns/database.md:488 patterns/docker.md:210 patterns/docker.md:307 patterns/docker.md:315 patterns/git.md:90 patterns/git.md:99 patterns/network.md:34 patterns/network.md:66 patterns/network.md:74 patterns/network.md:80 patterns/network.md:140 patterns/network.md:188 patterns/network.md:209 patterns/network.md:274 patterns/network.md:382 patterns/network.md:412 patterns/network.md:449 patterns/network.md:514 patterns/network.md:560 patterns/network.md:570 patterns/network.md:26 patterns/network.md:130 patterns/network.md:133 patterns/network.md:134 patterns/network.md:163 patterns/network.md:167 patterns/network.md:327 patterns/network.md:470 patterns/network.md:484 patterns/network.md:490 patterns/network.md:506 patterns/network.md:314 patterns/nodejs.md:140 patterns/nodejs.md:279 patterns/nodejs.md:134 patterns/nodejs.md:135 patterns/nodejs.md:109 patterns/nodejs.md:65 patterns/react.md:202 replay/README.md:265 replay/README.md:275
📁 Filesystem access (15)
patterns/docker.md:195 patterns/git.md:80 patterns/git.md:86 patterns/git.md:80 patterns/git.md:86 patterns/network.md:447 patterns/network.md:447 patterns/nodejs.md:443 patterns/nodejs.md:446 patterns/nodejs.md:453 patterns/nodejs.md:174 patterns/nodejs.md:246 patterns/nodejs.md:482 patterns/nodejs.md:239 patterns/nodejs.md:239
🔑 Env variables (3)
Detected Patterns
Weak cryptographic algorithmNetwork reconnaissance×5Overly permissive chmod×2SSH directory accessSSH private key fileSystem reconnaissance×4
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/davila7-error-resolver/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/davila7-error-resolver?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/davila7-error-resolver?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/davila7-error-resolver/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/davila7-error-resolver.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
davila7. (2026). Error Resolver security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/davila7-error-resolver/audits/11BibTeX citation
@techreport{davila7-davila7-error-resolver-2026,
author = {davila7},
title = {Error Resolver security audit report (audit version 11)},
institution = {Skillstore},
year = {2026},
number = {11},
url = {https://skillstore.io/skills/davila7-error-resolver/audits/11},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "Error Resolver security audit report (audit version 11)"
version: "unspecified"
type: report
authors:
- name: "davila7"
date-released: "2026-07-19"
url: "https://skillstore.io/skills/davila7-error-resolver/audits/11"
identifiers:
- type: other
value: "skillstore:davila7-error-resolver:audit:11"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
82
Community
74
Spec Compliance
What You Can Build
Diagnose Runtime Failures
Classify runtime errors, trace likely causes, and choose the safest repair path.
Resolve Infrastructure Errors
Analyze Docker, database, Git, and network failures with structured checks and verification.
Build Debugging Memory
Capture successful fixes as reusable replay records for recurring project issues.
Try These Prompts
Classify This Error
Classify this error by type, severity, scope, and likely origin. Explain what details you still need before suggesting a fix.
Find the Root Cause
Use five-whys analysis on this error and stack trace. Identify the root cause, contributing factors, and the safest immediate fix.
Create a Verified Fix Plan
Diagnose this failure and provide immediate fix steps, proper fix steps, verification checks, and prevention measures.
Prepare a Replay Record
Convert this resolved incident into a reusable replay record with a normalized signature, context, diagnosis, solution, verification, and tags.
Best Practices
- Provide the full error, stack trace, recent changes, and the command that triggered the failure.
- Review every command before execution, especially commands that change permissions, services, files, or credentials.
- Record only verified solutions, and keep replay records short, specific, and current.
Avoid
- Do not apply recorded solutions blindly when the environment, dependency versions, or error context changed.
- Do not paste secrets, private keys, full environment dumps, or production tokens into troubleshooting requests.
- Do not use broad permission changes or destructive Git commands as first-line fixes.
Frequently Asked Questions
What kinds of errors can this skill analyze?
It covers language errors, stack traces, dependency failures, Docker issues, database errors, Git problems, and network or API failures.
Does it run commands automatically?
The skill contains command examples. Users should approve commands before execution, especially privileged or destructive commands.
What is the replay system?
Replay records store normalized error signatures, diagnoses, fixes, and verification steps so recurring problems can be handled faster.
Can it work without a stack trace?
Yes, but accuracy improves when you provide the full message, stack trace, recent changes, and affected code path.
How should secrets be handled?
Redact tokens, passwords, private keys, and environment values before sharing logs or command output.
Is it suitable for production incidents?
It can structure production triage, but changes should follow your review, approval, backup, and rollback processes.
Developer Details
Author
davila7License
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Ref
dbe0e719813583400773166a0621f8a9b8185c72
Maintenance freshness
7/23/2026
Usage
5 downloads · 984 views