Skills enact-docs-guide

📦

enact-docs-guide

Name: enact-docs-guide
Author: EnactProtocol

v1.0.0 Content revision r1 Medium Risk ⚙️ External commands🔑 Env variables

Build Enact Tool Guides

Creating Enact tools requires clear structure, schemas, commands, and publishing steps. This skill gives Claude, Codex, and Claude Code a compact reference for Enact authoring.

Supports: Claude Codex Code(CC)

⚠️ 50 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "enact-docs-guide" from https://skillstore.io/skills/enactprotocol-enact-docs-guide.md and its manifest at https://skillstore.io/api/skills/enactprotocol-enact-docs-guide/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/enactprotocol-enact-docs-guide.md Signed manifest GET /api/skills/enactprotocol-enact-docs-guide/manifest Signed lockfile GET /api/skills/enactprotocol-enact-docs-guide/lockfile

Test it

Using "enact-docs-guide". I need a quick overview of what an Enact tool contains.

Expected outcome:

An Enact tool usually includes an enact.md file and source code. The guide explains metadata, schemas, commands, environment variables, and publishing steps.

Using "enact-docs-guide". Help me prepare a tool before publishing.

Expected outcome:

Confirm the name, description, input schema, and output schema are complete.
Use a pinned container image and document dependency installation.
Test the tool locally, then sign and publish it only after review.

Using "enact-docs-guide". How should I handle an API key in an Enact tool?

Expected outcome:

Declare the variable as a secret in the tool metadata. Set it through the Enact environment command and avoid storing it in local environment files.

Security Audit

Medium Risk

v4 • 7/5/2026 Open versioned report

Most static findings are false positives caused by Markdown code fences, inline code, placeholder API key examples, and checklist text. The remaining concern is documentation that shows direct shell parameter substitution without safety guidance, which can lead authors to create injection-prone Enact tools.

Files scanned

215

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (1)

Medium

SKILL.md:111 SKILL.md:126-156

Unsafe Command Substitution Guidance

The guide presents shell command templates that substitute user parameters directly into command strings without a warning about validation, quoting, or argv-style execution.

Multiple examples use ${input} or ${name} in shell command strings. The file is documentation, so the risk is indirect but credible for tool authors who copy the pattern.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium

SKILL.md:64-103

Ruby/shell backtick execution

```yaml

This Markdown template includes a shell command field using direct parameter substitution. It is documentation, but following it without quoting or argument separation can create command injection risk.

Medium

SKILL.md:111

Ruby/shell backtick execution

| `command` | No* | Shell command with `${param}` substitution |

The field reference describes shell commands with ${param} substitution. The guidance does not warn authors to validate inputs or avoid shell interpolation.

Medium

SKILL.md:126-130

Ruby/shell backtick execution

```yaml

This language example passes ${input} directly through a command string. The example is documentation, but it can teach an unsafe pattern if input is not escaped.

Medium

SKILL.md:133-137

Ruby/shell backtick execution

```yaml

This language example passes ${input} directly through a command string. The example is documentation, but it can teach an unsafe pattern if input is not escaped.

Medium

SKILL.md:140-144

Ruby/shell backtick execution

```yaml

This language example passes ${input} directly through a command string. The example is documentation, but it can teach an unsafe pattern if input is not escaped.

Medium

SKILL.md:147-151

Ruby/shell backtick execution

```yaml

This language example passes ${input} directly through a command string. The example is documentation, but it can teach an unsafe pattern if input is not escaped.

Medium

SKILL.md:154-156

Ruby/shell backtick execution

```yaml

The shell example interpolates ${name} into an echo command. Even simple shell examples should warn authors about quoting and attacker-controlled values.

Risk Factors

⚙️ External commands (46)

🔑 Env variables (5)

SKILL.md:182 SKILL.md:90 SKILL.md:175 SKILL.md:180 SKILL.md:182

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/enactprotocol-enact-docs-guide/audits/4?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/enactprotocol-enact-docs-guide/security.svg)](https://skillstore.io/skills/enactprotocol-enact-docs-guide?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/enactprotocol-enact-docs-guide?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/enactprotocol-enact-docs-guide/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/enactprotocol-enact-docs-guide.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

EnactProtocol. (2026). enact-docs-guide security audit report (audit version 4) [Author version 1.0.0]. Skillstore. https://skillstore.io/skills/enactprotocol-enact-docs-guide/audits/4

BibTeX citation

@techreport{enactprotocol-enactprotocol-enact-docs-guide-2026,
  author = {EnactProtocol},
  title = {enact-docs-guide security audit report (audit version 4)},
  institution = {Skillstore},
  year = {2026},
  number = {4},
  url = {https://skillstore.io/skills/enactprotocol-enact-docs-guide/audits/4},
  note = {Author version 1.0.0}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "enact-docs-guide security audit report (audit version 4)"
version: "1.0.0"
type: report
authors:
  - name: "EnactProtocol"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/enactprotocol-enact-docs-guide/audits/4"
identifiers:
  - type: other
    value: "skillstore:enactprotocol-enact-docs-guide:audit:4"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: High

Architecture

100

Maintainability

Content

Community

Spec Compliance

What You Can Build

Create a first Enact tool

Use the guide to understand the required files, metadata fields, schemas, and local test command.

Prepare a tool for publishing

Review the signing, publishing, metadata, and checklist steps before sharing a tool.

Teach agents Enact conventions

Give an AI assistant a concise reference for Enact structure, command fields, and secret handling.

Try These Prompts

Explain Enact basics

Explain the Enact tool structure using this guide. Focus on the purpose of enact.md, main source files, and structured input and output.

Draft an enact.md outline

Help me outline an enact.md file for a tool that accepts one text input and returns one text result. Include required fields and schema notes.

Review a tool design

Review my Enact tool plan against the guide checklist. Identify missing metadata, schema gaps, command concerns, and publishing steps.

Harden command and secret usage

Analyze my Enact command field and environment variable plan. Recommend safer parameter handling, secret storage, and validation before publishing.

Best Practices

Use the guide as a checklist before running or publishing Enact tools.
Validate inputs and outputs with schemas before relying on tool behavior.
Treat command and secret examples as templates that need project-specific review.

Avoid

Do not copy command templates without checking quoting and input validation.
Do not publish a tool before testing its schema and runtime output.
Do not place real secrets in documentation, prompts, or local environment files.

Frequently Asked Questions

What does this skill help with?

It helps AI assistants explain Enact tool structure, commands, schemas, secrets, and publishing workflow.

Does it create a complete tool automatically?

No. It provides guidance and examples that can support tool creation, review, and publishing preparation.

Can Claude, Codex, and Claude Code use it?

Yes. The report lists support for Claude, Codex, and Claude Code.

Does it run shell commands by itself?

No. The skill is a Markdown guide. Any command execution should require user review and approval.

How does it describe secrets?

It shows secret metadata and recommends setting secret values through Enact instead of storing them in environment files.

What should users review carefully?

Users should review command substitution, input validation, dependency installation, and publishing permissions before using examples.

Developer Details

Author

EnactProtocol

License

MIT

Author version

v1.0.0

Skillstore revision

Repository

https://github.com/EnactProtocol/enact/tree/main/examples/guide

Ref

30c73eac2afe762f6aa9c4553158769369d47351

Maintenance freshness

7/18/2026

Usage

5 downloads · 135 views

File structure

📄 SKILL.md